A metric for software vulnerabilities classification

Abstract

Vulnerability discovery and exploits detection are two wide areas of study in software engineering. This preliminary work tries to combine existing methods with machine learning techniques to define a metric classification of vulnerable computer programs. First a feature set has been defined and later two models have been tested against real world vulnerabilities. A relation between the classifier choice and the features has also been outlined.

The original version of this paper was written in Feb 2009 to report results of a Machine Learning research project at the University of Amsterdam. At the time this research has been carried out the author was affiliated (Graduate Student) with the University of Amsterdam, The Netherlands