@inproceedings{4a0a4e7e0d22433eb98a79b22323122f,
title = "Using semantic templates to study vulnerabilities recorded in large software repositories",
abstract = "Software repositories are rich sources of information about vulnerabilities that occur during a product's lifecycle. Although available, such information is scattered across numerous databases. Furthermore, in large software repositories, a single vulnerability may span across multiple components and have multidimensional interactions with other vulnerabilities. Thus, identifying the patterns of vulnerability occurrence in a larger context of software development continues to be an open problem. Here we present findings from our study of vulnerable software components using an ontology-guided analysis of vulnerabilities recorded in a software project's code repository. In this approach, a semantic template for each type of vulnerability is created from information in the Common Weakness Enumeration dictionary. Next, known vulnerabilities and related concepts in the repository are tagged with concepts from the template. Based on the characteristics of the resources affected by these vulnerabilities, other similar resources in the software can be identified for closer inspection and verification. We present results from our study of vulnerabilities in the Apache web server.",
keywords = "CVE, CWE, buffer overflow, fix patterns, ontology, semantic template, software repository, vulnerability",
author = "Yan Wu and Gandhi, {Robin A.} and Harvey Siy",
year = "2010",
doi = "10.1145/1809100.1809104",
language = "English (US)",
isbn = "9781605589657",
series = "Proceedings - International Conference on Software Engineering",
pages = "22--28",
booktitle = "2010 ICSE Workshop on Software Engineering for Secure Systems, SESS 2010, in Conjunction with the 32nd ACM/IEEE International Conference on Software Engineering, ICSE 2010",
note = "2010 ICSE Workshop on Software Engineering for Secure Systems, SESS 2010, in Conjunction with the 32nd ACM/IEEE International Conference on Software Engineering, ICSE 2010 ; Conference date: 02-05-2010 Through 08-05-2010",
}