Vulnerability Prediction Models Research Articles

Enhancing Financial Vulnerability Models for Non-Profit Organizations: Integrating Financial Ratios and Macroeconomic Indicators for Comprehensive Risk Assessment

Purpose: This research advances the financial vulnerability prediction model for Non-Profit Organizations (NPOs) by incorporating a comprehensive set of financial and macroeconomic indicators, aiming to refine risk management and strategic planning within the sector. Theoretical Framework: Building upon Tuckman and Chang (1991) foundational work, this study addresses the evolving financial landscape's complexities. It expands on traditional financial ratio analyses to include broader economic conditions affecting NPOs, recognizing the limitations of previous literature. Design/Methodology/Approach: The study analyzes financial data from two NPOs (2017-2021), using three models to assess the influence of internal financial ratios (e.g., Debt Ratio, Cash Ratio, Net Operating Margin) and external macroeconomic factors (e.g., inflation, GDP growth) on NPO financial vulnerability and performance. Findings: Results highlight a significant positive relationship between the Cash Ratio and Return on Assets, underscoring liquidity management’s importance for NPO sustainability. Other factors showed minimal impact, suggesting a nuanced approach to financial vulnerability. Research Implications: The findings emphasize the necessity of integrating financial ratios with macroeconomic indicators in NPO management strategies, offering a refined model for understanding and mitigating financial risk. Originality/Value: This study enhances the financial management literature for NPOs by incorporating macroeconomic indicators into vulnerability assessment models. It provides a comprehensive framework for robust financial planning, filling a crucial gap in non-profit financial analysis and contributing to the sector’s resilience.

The impact of hard and easy negative training data on vulnerability prediction performance

Vulnerability prediction models have been shown to perform poorly in the real world. We examine how the composition of negative training data influences vulnerability prediction model performance. Inspired by other disciplines (e.g. image processing), we focus on whether distinguishing between negative training data that is ‘easy’ to recognise from positive data (very different from positive data) and negative training data that is ‘hard’ to recognise from positive data (very similar to positive data) impacts on vulnerability prediction performance. We use a range of popular machine learning algorithms, including deep learning, to build models based on vulnerability patch data curated by Reis and Abreu, as well as the MSR dataset. Our results suggest that models trained on higher ratios of easy negatives perform better, plateauing at 15 easy negatives per positive instance. We also report that different ML algorithms work better based on the negative sample used. Overall, we found that the negative sampling approach used significantly impacts model performance, potentially leading to overly optimistic results. The ratio of ‘easy’ versus ‘hard’ negative training data should be explicitly considered when building vulnerability prediction models for the real world.

Development of a seismic vulnerability and risk model for typical bridges considering innovative intensity measures

Seismic intensity measures are one of the core parameters for estimating regional bridges’ seismic risk and vulnerability. Using macroscopic seismic intensity indicators to predict and assess the seismic vulnerability of bridges can contribute positively to establishing urban and rural earthquake risk models. However, the developed vulnerability model rarely considers the contribution of instrument intensity to its quantification results and ignores the influence of nondamage bridge samples on the development of bridge risk models and the membership relationship between seismic vulnerability levels, which makes the developed model somewhat localized and uncertain. This study proposes a quantitative method and innovative model considering composite seismic intensity (instrumental and macroseismic intensity) indicators. The model was updated and validated using 300,000 acceleration records monitored by ten seismic stations during the Luding earthquake on September 5, 2022, in China, and the features of seismic motion parameters were analysed. The established empirical vulnerability dataset of bridges during the 2008 Wenchuan earthquake in China was updated and optimized using the developed models and methods. The traditional vulnerability level of bridges has been expanded by adding and refining actual samples (2317 bridges) from different seismic intensity zones. A vulnerability prediction model based on an updated extended bridge database was developed using nonlinear regression methods. A fragility membership index calculation model for estimating the correlation features of bridge vulnerability levels is proposed by combining the probability risk and fuzzy membership correlation algorithm. The traditional method for calculating the seismic vulnerability index has been improved, and a multiparameter bridge vulnerability model validation and rationality analysis have been conducted using the newly developed bridge sample dataset.

A catalog of metrics at source code level for vulnerability prediction: A systematic mapping study

AbstractIndustry practitioners assess software from a security perspective to reduce the risks of deploying vulnerable software. Besides following security best practice guidelines during the software development life cycle, predicting vulnerability before roll‐out is crucial. Software metrics are popular inputs for vulnerability prediction models. The objective of this study is to provide a comprehensive review of the source code‐level security metrics presented in the literature. Our systematic mapping study started with 1451 studies obtained by searching the four digital libraries from ACM, IEEE, ScienceDirect, and Springer. After applying our inclusion/exclusion criteria as well as the snowballing technique, we narrowed down 28 studies for an in‐depth study to answer four research questions pertaining to our goal. We extracted a total of 685 code‐level metrics. For each study, we identified the empirical methods, quality measures, types of vulnerabilities of the prediction models, and shortcomings of the work. We found that standard machine learning models, such as decision trees, regressions, and random forests, are most frequently used for vulnerability prediction. The most common quality measures are precision, recall, accuracy, and ‐measure. Based on our findings, we conclude that the list of software metrics for measuring code‐level security is not universal or generic yet. Nonetheless, the results of our study can be used as a starting point for future studies aiming at improving existing security prediction models and a catalog of metrics for vulnerability prediction for software practitioners.

A Simplified Prediction Model of Structural Seismic Vulnerability Considering a Multivariate Fuzzy Membership Algorithm

ABSTRACT Fuzzy decision-making and analytic hierarchical processes are ubiquitously used to predict the seismic damage and vulnerability of building clusters. However, the factors affecting the seismic vulnerability of building structures are diversification, cognitive uncertainty, and complex fuzziness. To probe the impact of multiple fuzzy influencing factors on the vulnerability of regional buildings and the degree of membership between them, the development of a structural vulnerability prediction model based on fuzzy decision-making and a hierarchical system with multiple factors has strong theoretical and practical significance. This study proposes a novel method for rapidly predicting structural vulnerability based on a multivariate fuzzy membership index. Rapid fragility prediction models of fiv4e typical structures considering the multivariate fuzzy membership index are established. A new approach is proposed based on the relationship model between the empirical vulnerability index and seven fuzzy membership parameters. Five types of typical structural vulnerability index rapid prediction innovation models are developed. The new prediction model is compared and verified using the quantitative value of China’s macrointensity standard and the structural seismic loss observation data (98,050 × 104 m2 and 995,000 buildings) of 213 typical earthquakes to establish an empirical vulnerability index belt model. The proposed prediction model comprehensively considers multiple fuzzy membership parameters and the empirical structural earthquake damage database. The model analysis and validation results indicate that the proposed model can be further used for the seismic damage evaluation of typical structures and rapid fragility prediction.

КОНЦЕПТУАЛЬНЫЕ ОСНОВЫ ОЦЕНКИ УРОВНЯ ЗАЩИЩЕННОСТИ АВТОМАТИЗИРОВАННЫХ СИСТЕМ НА ОСНОВЕ ИХ УЯЗВИМОСТИ

The paper presents the conceptual framework for assessing the level of security of automated systems based on their vulnerability. The analysis of regulatory standards, methodological recommendations and regulatory documents in the field of assessment and classification of vulnerabilities of information systems is carried out. According to the analysis of the draft update of regulatory documents, it was concluded that the terms automated system and information system are equal, which allows applying all the necessary requirements, recommendations, formal descriptions, and other standardized requirements applicable to information systems. The analysis of the process and causes of the detection of vulnerabilities of the automated system, the formation of sets of vulnerabilities, the definition of the basic vulnerability of the automated system, and the current vulnerability of the automated system, as well as the ways to eliminate these vulnerabilities are considered. The method of assessing the criticality of vulnerabilities of the FSTEC of Russia, based on the international CVSS 3.1 methodology, is considered. In order to make it easier to independently calculate the criticality of vulnerability, adaptation is made, and a thorough description of the process of assessing the criticality of vulnerability of the CVSS 3.1 standard is made. A methodology for assessing the level of security is proposed by analyzing the criticality of the vulnerability of an automated system (the totality of the criticality of vulnerabilities of an automated system). Conclusions are drawn about the direction of further research: the construction of a security assessment model based on vulnerability, as well as a vulnerability prediction model.

Multi-bit Data Flow Error Detection Method Based on SDC Vulnerability Analysis

One of the most difficult data flow errors to detect caused by single-event upsets in space radiation is the Silent Data Corruption (SDC). To solve the problem of multi-bit upsets causing program SDC, an instruction multi-bit SDC vulnerability prediction model based on one-class support vector machine classification is built using SDC vulnerability analysis, which has more accurate vulnerability instruction identification capabilities. By hardening the program with selective instruction redundancy, we propose a multi-bit data flow error detection method for detecting SDC error (SDCVA-OCSVM), aiming to protect the data in the memory or register used by the program. We have also verified the effectiveness of the method through comparative experiments. The method has been verified to have a higher error detection rate and lower code size and time overhead.

A security vulnerability predictor based on source code metrics

Detecting security vulnerabilities in the source code of software systems is one of the most important challenges in the field of software security. We need an effective solution to discover and patch vulnerabilities before our valuable information is compromised. Security testing is a type of software testing that checks whether software is vulnerable to cyber attacks. This study aimed to pursue three main objectives: (1) The first goal is to identify the vulnerable functions of a C/C++ software program based on code metrics. This can reduce the cost of software security testing and also redirect the related activities to identified vulnerable functions rather than to the entire software, (2) The second goal is to identify the type of attack related to the vulnerability function, and (3) Finally, the ultimate goal is to analyze the relationship between code metrics and the vulnerabilities. This goal can help us understand which code structure is most likely to contain vulnerable code. This paper first aimed to create a comprehensive view of the source code of the target software using graph concepts. Second, a set of source code metrics and calculated by crawling on the related graph using the static analysis approach. Finally, the vulnerability prediction model presented in this paper is based on machine learning technique applied on metrics extracted from program source code. Compared to previous work, new achievements have been made in this paper. One of the most important ones is the very high accuracy detection of the proposed model in detecting the type of vulnerability. Moreover, 15 code metrics are used to predict vulnerabilities. Our analysis on feature importance indicates that what structure the software program code has, most likely, it will be vulnerable. Experimental results in 10 real projects (OpenSSL, SQLite, FreeType, LibTiff, Libxslt, Binutils, FFmpeg, ImageMagick, OpenSC, and rdesktop) indicated that the security testing predictor proposed in this paper could predict on average 89% of the really vulnerable functions of the source code and 86% of the vulnerability type of the detected functions correctly.

Spatial prediction of the geological hazard vulnerability of mountain road network using machine learning algorithms

The current assessment index of the geological hazard vulnerability assessment for mountain road network is relatively simple, and the assessment methods used are subjective, complex, and inefficient. This study proposes a prediction model for geological hazard vulnerability assessment of mountain road network incorporating machine learning algorithms. First, based on the quantification of the characteristics of the mountain road network and the local rescue forces, an objective and reasonable index-based system of vulnerability assessment of the mountain road network was constructed by combining the population, economic, and material factors. Second, the FAHP and AHP-TOPSIS were applied for the development of the vulnerability assessment models to carry out the preliminary vulnerability assessment for different road types. Third, the results of the preliminary vulnerability assessment were used as the sample set to build a road vulnerability prediction model using SVM, RF, and BPNN algorithms. Finally, the five-fold cross-validation and statistical parameter accuracy analysis were conducted to determine the most reasonable model with the highest prediction accuracy for geological hazard vulnerability mapping of the mountain road network. The results indicated that the vulnerability prediction model based on the FAHP sample set using the RF algorithm demonstrated the highest accuracy and robustness.

The Effect of Dual Hyperparameter Optimization on Software Vulnerability Prediction Models

Background: Prediction of software vulnerabilities is a major concern in the field of software security. Many researchers have worked to construct various software vulnerability prediction (SVP) models. The emerging machine learning domain aids in building effective SVP models. The employment of data balancing/resampling techniques and optimal hyperparameters can upgrade their performance. Previous research studies have shown the impact of hyperparameter optimization (HPO) on machine learning algorithms and data balancing techniques. Aim: The current study aims to analyze the impact of dual hyperparameter optimization on metrics-based SVP models. Method: This paper has proposed the methodology using the python framework Optuna that optimizes the hyperparameters for both machine learners and data balancing techniques. For the experimentation purpose, we have compared six combinations of five machine learners and five resampling techniques considering default parameters and optimized hyperparameters. Results: Additionally, the Wilcoxon signed-rank test with the Bonferroni correction method was implied, and observed that dual HPO performs better than HPO on learners and HPO on data balancers. Furthermore, the paper has assessed the impact of data complexity measures and concludes that HPO does not improve the performance of those datasets that exhibit high overlap. Conclusion: The experimental analysis unveils that dual HPO is 64% effective in enhancing the productivity of SVP models.

Approach to Predict Software Vulnerability Based on Multiple-Level N-gram Feature Extraction and Heterogeneous Ensemble Learning

Software vulnerabilities are one of the roots of computer security problems. The traditional static analysis and dynamic analysis methods based on software source code mainly have some deficiencies, such as high false positive rate, high false negative rate and insufficient semantic information captured. Nevertheless, the application of machine learning, Natural Language Processing and other technologies in software vulnerability prediction can effectively mitigate such issues. This paper proposed a vulnerability prediction method based on multiple-level N-gram feature extraction and heterogeneous ensemble learning. First, by code intermediate representation and constructing a multiple-level N-gram feature generation model, two kinds of N-gram semantic features with different window size and different granularity at word and char level were extracted to retain the semantic and structural information of code. Second, TF–IDF was used to construct the vector space model as the input of prediction model. As a single classifier was prone to overfitting and poor generalization, this paper conducted benchmark testing on five classical machine learning algorithms (NB, SVM, DT, LR, RF), and then combined four (SVM, DT, LR, RF) among them, which had better performance as the base classifiers to form the stacking heterogeneous ensemble method to build the vulnerability prediction model. Finally, the proposed method was verified on buffer overflow vulnerability and resource management vulnerability datasets, with a lowest false positive rate and false negative rate which can reach 1.58% and 4.06%, respectively.

Predicting input validation vulnerabilities based on minimal SSA features and machine learning

Structured Query Language injection (SQLi) and Cross-Site Scripting (XSS) are the most renowned kinds of input validation vulnerabilities. Of late, vulnerability prediction models based on machine learning have been gaining acceptance in the domain of Web security. Such models offer an easy and effective way of dealing with web application security concerns. However, most of them, in particular, rely on complex graphs generated from source code or regex patterns based on expert knowledge. This paper proposed a method for extracting features from source code and predicting input validation vulnerabilities using machine learning algorithms. The proposed method can extract all features related to the flow of vulnerabilities among the programs and remove the features that are irrelevant to the vulnerability flow. In addition, each vulnerability’s context has been assigned, providing additional data for our model to use in learning about the vulnerability context. Compared to other related methods, the feature extraction method proposed in this paper has been found to have high reusability and better performance. The best model related to the LSTM classifier had a 98.1% recall rate, a 97.9% precision, an accuracy of 98.67%, and a 99.03% area under the curve (AUC) in the test dataset.

Examining the Capacity of Text Mining and Software Metrics in Vulnerability Prediction.

Software security is a very important aspect for software development organizations who wish to provide high-quality and dependable software to their consumers. A crucial part of software security is the early detection of software vulnerabilities. Vulnerability prediction is a mechanism that facilitates the identification (and, in turn, the mitigation) of vulnerabilities early enough during the software development cycle. The scientific community has recently focused a lot of attention on developing Deep Learning models using text mining techniques for predicting the existence of vulnerabilities in software components. However, there are also studies that examine whether the utilization of statically extracted software metrics can lead to adequate Vulnerability Prediction Models. In this paper, both software metrics- and text mining-based Vulnerability Prediction Models are constructed and compared. A combination of software metrics and text tokens using deep-learning models is examined as well in order to investigate if a combined model can lead to more accurate vulnerability prediction. For the purposes of the present study, a vulnerability dataset containing vulnerabilities from real-world software products is utilized and extended. The results of our analysis indicate that text mining-based models outperform software metrics-based models with respect to their F2-score, whereas enriching the text mining-based models with software metrics was not found to provide any added value to their predictive performance.

Predicting vulnerability inducing function versions using node embeddings and graph neural networks

Predicting software vulnerabilities over code changes is a difficult task due to obtaining real vulnerability data and their associated code fixes from software projects as software organizations are often reluctant to report those. We aim to propose a vulnerability prediction model that runs after every code change, and identifies vulnerability inducing functions in that version. We also would like to assess the success of node and token based source code representations over abstract syntax trees (ASTs) on predicting vulnerability inducing functions. We train neural networks to represent node embeddings and token embeddings over ASTs in order to obtain feature representations. Then, we build two Graph Neural Networks (GNNs) with node embeddings, and compare them against Convolutional Neural Network (CNN) and Support Vector Machine (SVM) with token representations. We report our empirical analysis over the change history of vulnerability inducing functions of Wireshark project. GraphSAGE model using source code representation via ASTs achieves the highest AUC rate, while CNN models using token representations achieves the highest recall, precision and F1 measure. Representing functions with their structural information extracted from ASTs, either in token form or in complete graph form, is great at predicting vulnerability inducing function versions. Transforming source code into token frequencies as a natural language text fails to build successful models for vulnerability prediction in a real software project.

Vulnerability prediction model of typical structures considering empirical seismic damage observation data

Vulnerability prediction model of typical structures considering empirical seismic damage observation data

Statistical and vulnerability prediction model considering empirical seismic damage to masonry structures

For a detailed analysis of the seismic vulnerability and failure features of masonry structures (MSs) under different intensity grades, the reconnaissance data of 136 typical catastrophic earthquakes that occurred in 18 territories of China from 1975 to 2013 were summarized and counted, empirical seismic damage inspection samples of 15,870.9888 × 104 m2 and 446,430 MS buildings were drawn, and the typical macro damage characteristics and mechanism of this type of structure were analysed. By employing the methods of probability and mathematical statistics, nonlinear vulnerability prediction, and numerical model analysis, multidimensional MS vulnerability probability statistical matrix considering the latest version of the China Macroseismic Intensity Scale (CSIS-20) was constructed. The Gauss prediction model and mean fragility probability prediction curve were proposed. The vulnerability nonlinear prediction model (function, curve, and point cloud) considering the failure/damage ratio and transcendental probability parameters was calculated and derived. According to the statistics and time-varying vulnerability analysis of damage observation data in four periods (before 1989, 1990–1999, 2000–2009, and after 2010), the empirical time-varying vulnerability models of each year were developed. Combined with the mean prediction damage index (MPDI) matrix parameter model and the probability matrix of the different intensity regions, the MPDI vulnerability parameter matrix and curve model of MS in the observation region were established.

Hybrid Representation to Locate Vulnerable Lines of Code

Locating vulnerable lines of code in large software systems needs huge efforts from human experts. This explains the high costs in terms of budget and time needed to correct vulnerabilities. To minimize these costs, automatic solutions of vulnerabilities prediction have been proposed. Existing machine learning (ML)-based solutions face difficulties in predicting vulnerabilities in coarse granularity and in defining suitable code features that limit their effectiveness. To addressee these limitations, in the present work, the authors propose an improved ML-based approach using slice-based code representation and the technique of TF-IDF to automatically extract effective features. The obtained results showed that combining these two techniques with ML techniques allows building effective vulnerability prediction models (VPMs) that locate vulnerabilities in a finer granularity and with excellent performances (high precision (>98%), low FNR (<2%) and low FPR (<3%) which outperforms software metrics and are equivalent to the best performing recent deep learning-based approaches.

Software Vulnerability Prediction Using Grey Wolf-Optimized Random Forest on the Unbalanced Data Sets

Any vulnerability in the software creates a software security threat and helps hackers to gain unauthorized access to resources. Vulnerability prediction models help software engineers to effectively allocate their resources to find any vulnerable class in the software, before its delivery to customers. Vulnerable classes must be carefully reviewed by security experts and tested to identify potential threats that may arise in the future. In the present work, a novel technique based on Grey wolf algorithm and Random forest is proposed for software vulnerability prediction. Grey wolf technique is a metaheuristic technique and it is used to select the best subset of features. The proposed technique is compared with other machine learning techniques. Experiments were performed on three datasets available publicly. It was observed that our proposed technique (GW-RF) outperformed all other techniques for software vulnerability prediction.

Using hierarchical clustering analysis to evaluate COVID-19 pandemic preparedness and performance in 180 countries in 2020

ObjectiveTo rank and score 180 countries according to COVID-19 cases and fatality in 2020 and compare the results to existing pandemic vulnerability prediction models and results generated by standard epidemiological...

Improving Vulnerability Inspection Efficiency Using Active Learning

Software engineers can find vulnerabilities with less effort if they are directed towards code that might contain more vulnerabilities. HARMLESS is an incremental support vector machine tool that builds a vulnerability prediction model from the source code inspected to date, then suggests what source code files should be inspected next. In this way, HARMLESS can reduce the time and effort required to achieve some desired level of recall for finding vulnerabilities. The tool also provides feedback on when to stop (at that desired level of recall) while at the same time, correcting human errors by double-checking suspicious files. This paper evaluates HARMLESS on Mozilla Firefox vulnerability data. HARMLESS found 80, 90, 95, 99 percent of the vulnerabilities by inspecting 10, 16, 20, 34 percent of the source code files. When targeting 90, 95, 99 percent recall, HARMLESS could stop after inspecting 23, 30, 47 percent of the source code files. Even when human reviewers fail to identify half of the vulnerabilities (50 percent false negative rate), HARMLESS could detect 96 percent of the missing vulnerabilities by double-checking half of the inspected files. Our results serve to highlight the very steep cost of protecting software from vulnerabilities (in our case study that cost is, for example, the human effort of inspecting 28,750 × 20% = 5,750 source code files to identify 95 percent of the vulnerabilities). While this result could benefit the mission-critical projects where human resources are available for inspecting thousands of source code files, the research challenge for future work is how to further reduce that cost. The conclusion of this paper discusses various ways that goal might be achieved.