VULNERLIZER: Cross-analysis Between Vulnerabilities and Software
  Libraries
Irdin Pekaric Michael Felderer Philipp Steinmüller
The identification of vulnerabilities is a continuous challenge in software
projects. This is due to the evolution of methods that attackers employ as well
as the constant updates to the software, which reveal additional issues. As a
result, new and innovative approaches for the identification of vulnerable
software are needed. In this paper, we present VULNERLIZER, which is a novel
framework for cross-analysis between vulnerabilities and software libraries. It
uses CVE and software library data together with clustering algorithms to
generate links between vulnerabilities and libraries. In addition, the training
of the model is conducted in order to reevaluate the generated associations.
This is achieved by updating the assigned weights. Finally, the approach is
then evaluated by making the predictions using the CVE data from the test set.
The results show that the VULNERLIZER has a great potential in being able to
predict future vulnerable libraries based on an initial input CVE entry or a
software library. The trained model reaches a prediction accuracy of 75% or
higher.