We use cookies to improve your experience with our site.

用非平衡学习策略识别高影响漏洞报告

High-Impact Bug Report Identification with Imbalanced Learning Strategies

  • 摘要: 在实际应用中,一些漏洞比其他漏洞有更大的影响,因此更需要被立即关注。由于紧张的时间表和有限的人力资源,开发者没有足够时间去处理所有漏洞。因此,他们常常关注那些有高影响的漏洞。在文献中,高影响漏洞指那些意外出现的并带来意外影响的漏洞(意外漏洞),或破坏了原有的功能并降低了用户体验(破坏漏洞)。不幸的是,从上千漏洞报告中识别高影响漏洞不是一件易事。因此,一种能识别高影响漏洞的自动化技术能帮助开发者更早的意识到发现它们,快速修复它们,并将它们引起的损失降到最低。考虑到只有一小部分漏洞属于高影响漏洞,识别它们是一件困难的任务。本文中,我们提出用非平衡学习策略来识别高影响漏洞的方法。我们调研了不同方法变种的有效性。其中每种变种结合了一种特定的非平衡学习策略和一种特定的分类算法。我们选择了4种广泛应用的非平衡学习策略和4种常用的文本分类算法,并在4个不同开源项目的数据集上进行了实验。我们主要分析了两种高影响漏洞,即意外漏洞和破坏漏洞。结果显示不同的方法变种有不同的表现,针对意外漏洞识别的最佳变种SMOTE+KNN和针对破坏漏洞识别的最佳变种RUS+NB的在F1-scores上的表现优于两个分别由Thung等人和Garcia等人提出的最先进的方法。

     

    Abstract: In practice, some bugs have more impact than others and thus deserve more immediate attention. Due to tight schedule and limited human resources, developers may not have enough time to inspect all bugs. Thus, they often concentrate on bugs that are highly impactful. In the literature, high-impact bugs are used to refer to the bugs which appear at unexpected time or locations and bring more unexpected effects (i.e., surprise bugs), or break pre-existing functionalities and destroy the user experience (i.e., breakage bugs). Unfortunately, identifying high-impact bugs from thousands of bug reports in a bug tracking system is not an easy feat. Thus, an automated technique that can identify high-impact bug reports can help developers to be aware of them early, rectify them quickly, and minimize the damages they cause. Considering that only a small proportion of bugs are high-impact bugs, the identification of high-impact bug reports is a difficult task. In this paper, we propose an approach to identify high-impact bug reports by leveraging imbalanced learning strategies. We investigate the effectiveness of various variants, each of which combines one particular imbalanced learning strategy and one particular classification algorithm. In particular, we choose four widely used strategies for dealing with imbalanced data and four state-of-the-art text classification algorithms to conduct experiments on four datasets from four different open source projects. We mainly perform an analytical study on two types of high-impact bugs, i.e., surprise bugs and breakage bugs. The results show that different variants have different performances, and the best performing variants SMOTE (synthetic minority over-sampling technique)+KNN (K-nearest neighbours) for surprise bug identification and RUS (random under-sampling)+NB (naive Bayes) for breakage bug identification outperform the F1-scores of the two state-of-the-art approaches by Thung et al. and Garcia and Shihab.

     

/

返回文章
返回