{"id":"https://openalex.org/W4206767299","doi":"https://doi.org/10.1109/tse.2022.3140868","title":"The Secret Life of Software Vulnerabilities: A Large-Scale Empirical Study","display_name":"The Secret Life of Software Vulnerabilities: A Large-Scale Empirical Study","publication_year":2022,"publication_date":"2022-01-06","ids":{"openalex":"https://openalex.org/W4206767299","doi":"https://doi.org/10.1109/tse.2022.3140868"},"language":"en","primary_location":{"id":"doi:10.1109/tse.2022.3140868","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tse.2022.3140868","pdf_url":null,"source":{"id":"https://openalex.org/S8351582","display_name":"IEEE Transactions on Software Engineering","issn_l":"0098-5589","issn":["0098-5589","1939-3520","2326-3881"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310320439","host_organization_name":"IEEE Computer Society","host_organization_lineage":["https://openalex.org/P4310320439","https://openalex.org/P4310319808"],"host_organization_lineage_names":["IEEE Computer Society","Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Software Engineering","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5037237385","display_name":"Emanuele Iannone","orcid":"https://orcid.org/0000-0001-7489-9969"},"institutions":[{"id":"https://openalex.org/I131729948","display_name":"University of Salerno","ror":"https://ror.org/0192m2k53","country_code":"IT","type":"education","lineage":["https://openalex.org/I131729948"]}],"countries":["IT"],"is_corresponding":false,"raw_author_name":"Emanuele Iannone","raw_affiliation_strings":["Software Engineering (SeSa) Lab, University of Salerno, Fisciano, Italy"],"raw_orcid":"https://orcid.org/0000-0001-7489-9969","affiliations":[{"raw_affiliation_string":"Software Engineering (SeSa) Lab, University of Salerno, Fisciano, Italy","institution_ids":["https://openalex.org/I131729948"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5021937687","display_name":"Roberta Guadagni","orcid":null},"institutions":[{"id":"https://openalex.org/I131729948","display_name":"University of Salerno","ror":"https://ror.org/0192m2k53","country_code":"IT","type":"education","lineage":["https://openalex.org/I131729948"]}],"countries":["IT"],"is_corresponding":false,"raw_author_name":"Roberta Guadagni","raw_affiliation_strings":["Software Engineering (SeSa) Lab, University of Salerno, Fisciano, Italy"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Software Engineering (SeSa) Lab, University of Salerno, Fisciano, Italy","institution_ids":["https://openalex.org/I131729948"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5053084752","display_name":"Filomena Ferrucci","orcid":"https://orcid.org/0000-0002-0975-8972"},"institutions":[{"id":"https://openalex.org/I131729948","display_name":"University of Salerno","ror":"https://ror.org/0192m2k53","country_code":"IT","type":"education","lineage":["https://openalex.org/I131729948"]}],"countries":["IT"],"is_corresponding":false,"raw_author_name":"Filomena Ferrucci","raw_affiliation_strings":["Software Engineering (SeSa) Lab, University of Salerno, Fisciano, Italy"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Software Engineering (SeSa) Lab, University of Salerno, Fisciano, Italy","institution_ids":["https://openalex.org/I131729948"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5079088548","display_name":"Andrea De Lucia","orcid":"https://orcid.org/0000-0002-4238-1425"},"institutions":[{"id":"https://openalex.org/I131729948","display_name":"University of Salerno","ror":"https://ror.org/0192m2k53","country_code":"IT","type":"education","lineage":["https://openalex.org/I131729948"]}],"countries":["IT"],"is_corresponding":false,"raw_author_name":"Andrea De Lucia","raw_affiliation_strings":["Software Engineering (SeSa) Lab, University of Salerno, Fisciano, Italy"],"raw_orcid":"https://orcid.org/0000-0002-4238-1425","affiliations":[{"raw_affiliation_string":"Software Engineering (SeSa) Lab, University of Salerno, Fisciano, Italy","institution_ids":["https://openalex.org/I131729948"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5033738898","display_name":"Fabio Palomba","orcid":"https://orcid.org/0000-0001-9337-5116"},"institutions":[{"id":"https://openalex.org/I131729948","display_name":"University of Salerno","ror":"https://ror.org/0192m2k53","country_code":"IT","type":"education","lineage":["https://openalex.org/I131729948"]}],"countries":["IT"],"is_corresponding":false,"raw_author_name":"Fabio Palomba","raw_affiliation_strings":["Software Engineering (SeSa) Lab, University of Salerno, Fisciano, Italy"],"raw_orcid":"https://orcid.org/0000-0001-9337-5116","affiliations":[{"raw_affiliation_string":"Software Engineering (SeSa) Lab, University of Salerno, Fisciano, Italy","institution_ids":["https://openalex.org/I131729948"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":["https://openalex.org/I131729948"],"apc_list":null,"apc_paid":null,"fwci":20.6156,"has_fulltext":false,"cited_by_count":76,"citation_normalized_percentile":{"value":0.99422431,"is_in_top_1_percent":true,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":99,"max":100},"biblio":{"volume":"49","issue":"1","first_page":"44","last_page":"63"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10260","display_name":"Software Engineering Research","score":0.9998000264167786,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10260","display_name":"Software Engineering Research","score":0.9998000264167786,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12423","display_name":"Software Reliability and Analysis Research","score":0.9991000294685364,"subfield":{"id":"https://openalex.org/subfields/1712","display_name":"Software"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12479","display_name":"Web Application Security Vulnerabilities","score":0.9987999796867371,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.7629016637802124},{"id":"https://openalex.org/keywords/secure-coding","display_name":"Secure coding","score":0.637977123260498},{"id":"https://openalex.org/keywords/vulnerability","display_name":"Vulnerability (computing)","score":0.5656176805496216},{"id":"https://openalex.org/keywords/software","display_name":"Software","score":0.5592987537384033},{"id":"https://openalex.org/keywords/process","display_name":"Process (computing)","score":0.4439987242221832},{"id":"https://openalex.org/keywords/harm","display_name":"Harm","score":0.4328882694244385},{"id":"https://openalex.org/keywords/software-engineering","display_name":"Software engineering","score":0.41572630405426025},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.39461007714271545},{"id":"https://openalex.org/keywords/software-security-assurance","display_name":"Software security assurance","score":0.3172508478164673},{"id":"https://openalex.org/keywords/information-security","display_name":"Information security","score":0.14739567041397095},{"id":"https://openalex.org/keywords/programming-language","display_name":"Programming language","score":0.1464994251728058}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7629016637802124},{"id":"https://openalex.org/C22680326","wikidata":"https://www.wikidata.org/wiki/Q7444867","display_name":"Secure coding","level":5,"score":0.637977123260498},{"id":"https://openalex.org/C95713431","wikidata":"https://www.wikidata.org/wiki/Q631425","display_name":"Vulnerability (computing)","level":2,"score":0.5656176805496216},{"id":"https://openalex.org/C2777904410","wikidata":"https://www.wikidata.org/wiki/Q7397","display_name":"Software","level":2,"score":0.5592987537384033},{"id":"https://openalex.org/C98045186","wikidata":"https://www.wikidata.org/wiki/Q205663","display_name":"Process (computing)","level":2,"score":0.4439987242221832},{"id":"https://openalex.org/C2777363581","wikidata":"https://www.wikidata.org/wiki/Q15098235","display_name":"Harm","level":2,"score":0.4328882694244385},{"id":"https://openalex.org/C115903868","wikidata":"https://www.wikidata.org/wiki/Q80993","display_name":"Software engineering","level":1,"score":0.41572630405426025},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.39461007714271545},{"id":"https://openalex.org/C62913178","wikidata":"https://www.wikidata.org/wiki/Q7554361","display_name":"Software security assurance","level":4,"score":0.3172508478164673},{"id":"https://openalex.org/C527648132","wikidata":"https://www.wikidata.org/wiki/Q189900","display_name":"Information security","level":2,"score":0.14739567041397095},{"id":"https://openalex.org/C199360897","wikidata":"https://www.wikidata.org/wiki/Q9143","display_name":"Programming language","level":1,"score":0.1464994251728058},{"id":"https://openalex.org/C29983905","wikidata":"https://www.wikidata.org/wiki/Q7445066","display_name":"Security service","level":3,"score":0.0},{"id":"https://openalex.org/C17744445","wikidata":"https://www.wikidata.org/wiki/Q36442","display_name":"Political science","level":0,"score":0.0},{"id":"https://openalex.org/C199539241","wikidata":"https://www.wikidata.org/wiki/Q7748","display_name":"Law","level":1,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/tse.2022.3140868","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tse.2022.3140868","pdf_url":null,"source":{"id":"https://openalex.org/S8351582","display_name":"IEEE Transactions on Software Engineering","issn_l":"0098-5589","issn":["0098-5589","1939-3520","2326-3881"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310320439","host_organization_name":"IEEE Computer Society","host_organization_lineage":["https://openalex.org/P4310320439","https://openalex.org/P4310319808"],"host_organization_lineage_names":["IEEE Computer Society","Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Software Engineering","raw_type":"journal-article"}],"best_oa_location":null,"sustainable_development_goals":[{"display_name":"Responsible consumption and production","id":"https://metadata.un.org/sdg/12","score":0.5699999928474426}],"awards":[{"id":"https://openalex.org/G5592690287","display_name":null,"funder_award_id":"PZ00P2_186090 (TED)","funder_id":"https://openalex.org/F4320320924","funder_display_name":"Schweizerischer Nationalfonds zur F\u00f6rderung der Wissenschaftlichen Forschung"}],"funders":[{"id":"https://openalex.org/F4320320924","display_name":"Schweizerischer Nationalfonds zur F\u00f6rderung der Wissenschaftlichen Forschung","ror":"https://ror.org/00yjd3n13"}],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":94,"referenced_works":["https://openalex.org/W110007310","https://openalex.org/W1524601730","https://openalex.org/W1574060188","https://openalex.org/W1603939896","https://openalex.org/W1980567103","https://openalex.org/W1985266020","https://openalex.org/W1989354793","https://openalex.org/W1991741227","https://openalex.org/W1993760289","https://openalex.org/W2000679946","https://openalex.org/W2003315002","https://openalex.org/W2004758929","https://openalex.org/W2033514525","https://openalex.org/W2053154970","https://openalex.org/W2059507980","https://openalex.org/W2064924033","https://openalex.org/W2069268700","https://openalex.org/W2077937403","https://openalex.org/W2085925880","https://openalex.org/W2086174097","https://openalex.org/W2099558920","https://openalex.org/W2102212651","https://openalex.org/W2106578314","https://openalex.org/W2109242212","https://openalex.org/W2113157806","https://openalex.org/W2113693268","https://openalex.org/W2116610783","https://openalex.org/W2119070456","https://openalex.org/W2119871945","https://openalex.org/W2134429122","https://openalex.org/W2139885493","https://openalex.org/W2142225512","https://openalex.org/W2146648240","https://openalex.org/W2147386665","https://openalex.org/W2150898695","https://openalex.org/W2151967815","https://openalex.org/W2153887189","https://openalex.org/W2157657084","https://openalex.org/W2157820602","https://openalex.org/W2161661398","https://openalex.org/W2166336492","https://openalex.org/W2241836009","https://openalex.org/W2440056063","https://openalex.org/W2470841477","https://openalex.org/W2472384644","https://openalex.org/W2530824252","https://openalex.org/W2561301563","https://openalex.org/W2563377808","https://openalex.org/W2576115447","https://openalex.org/W2580969380","https://openalex.org/W2588952840","https://openalex.org/W2603117807","https://openalex.org/W2754913139","https://openalex.org/W2766411424","https://openalex.org/W2767231363","https://openalex.org/W2783078595","https://openalex.org/W2792425537","https://openalex.org/W2792987835","https://openalex.org/W2796056969","https://openalex.org/W2799668176","https://openalex.org/W2894722365","https://openalex.org/W2899099075","https://openalex.org/W2899407111","https://openalex.org/W2902324490","https://openalex.org/W2903359694","https://openalex.org/W2944080842","https://openalex.org/W2952117232","https://openalex.org/W2953428551","https://openalex.org/W2958994227","https://openalex.org/W2978631110","https://openalex.org/W3003877692","https://openalex.org/W3037700620","https://openalex.org/W3083081996","https://openalex.org/W3089863335","https://openalex.org/W3090088279","https://openalex.org/W3102273185","https://openalex.org/W3109666658","https://openalex.org/W3141872514","https://openalex.org/W4205192141","https://openalex.org/W4210651582","https://openalex.org/W4235354960","https://openalex.org/W4243607364","https://openalex.org/W4247781538","https://openalex.org/W4248575338","https://openalex.org/W4253136463","https://openalex.org/W4293241248","https://openalex.org/W4294214983","https://openalex.org/W6628285871","https://openalex.org/W6630065895","https://openalex.org/W6671147960","https://openalex.org/W6684372704","https://openalex.org/W6725651428","https://openalex.org/W6747261445","https://openalex.org/W6768633103"],"related_works":["https://openalex.org/W2141388993","https://openalex.org/W1978034799","https://openalex.org/W2999607548","https://openalex.org/W2956597637","https://openalex.org/W2044639210","https://openalex.org/W2293245356","https://openalex.org/W4225160120","https://openalex.org/W23486959","https://openalex.org/W1588942021","https://openalex.org/W4384518368"],"abstract_inverted_index":{"Software":[0],"vulnerabilities":[1,47,108,130,176,181],"are":[2,48,112,122,218],"weaknesses":[3],"in":[4,109,185,264],"source":[5,240],"code":[6,241],"that":[7],"can":[8,56,182],"be":[9,57,183],"potentially":[10],"exploited":[11,58],"to":[12,26,59,72,102,139,166,261],"cause":[13],"loss":[14],"or":[15],"harm.":[16],"While":[17],"researchers":[18],"have":[19],"been":[20],"devising":[21],"a":[22,33,159],"number":[23],"of":[24,36,87,107,201,213,238],"methods":[25,63,79],"deal":[27],"with":[28,131,222,235],"vulnerabilities,":[29,90],"there":[30],"is":[31],"still":[32],"noticeable":[34],"lack":[35],"knowledge":[37],"on":[38,93,144,162,189,247,255],"their":[39],"software":[40,89,110,142],"engineering":[41],"life":[42,85],"cycle,":[43],"for":[44,64,205],"example":[45],"how":[46,117,120,175,256],"introduced":[49],"and":[50,67,96,119,171,199,230],"removed":[51],"by":[52,220,251],"developers.":[53],"This":[54],"information":[55],"design":[60],"more":[61,208],"effective":[62],"vulnerability":[65,257],"prevention":[66],"detection,":[68],"as":[69,71,114,116],"well":[70,115],"understand":[73],"the":[74,84,100,103,135,163,168,214,236],"granularity":[75],"at":[76,191,206,243],"which":[77,98],"these":[78,267],"should":[80,259],"aim.":[81],"To":[82],"investigate":[83],"cycle":[86],"known":[88],"we":[91],"focus":[92],"how,":[94],"when,":[95],"under":[97],"circumstances":[99],"contributions":[101],"<italic":[104,123,215,231],"xmlns:mml=\"http://www.w3.org/1998/Math/MathML\"":[105,124,146,216,232],"xmlns:xlink=\"http://www.w3.org/1999/xlink\">introduction</i>":[106],"projects":[111,143],"made,":[113],"long,":[118],"they":[121],"xmlns:xlink=\"http://www.w3.org/1999/xlink\">removed</i>":[125,233],".":[126],"We":[127,249],"consider":[128],"3,663":[129],"public":[132],"patches":[133],"from":[134],"National":[136],"Vulnerability":[137],"Database\u2014pertaining":[138],"1,096":[140],"open-source":[141],"<sc":[145],"xmlns:xlink=\"http://www.w3.org/1999/xlink\">GitHub</small>":[147],"\u2014and":[148],"define":[149],"an":[150],"eight-step":[151],"process":[152],"involving":[153],"both":[154],"automated":[155],"parts":[156],"(e.g.,":[157,174],"using":[158],"procedure":[160],"based":[161],"SZZ":[164],"algorithm":[165],"find":[167],"vulnerability-contributing":[169],"commits)":[170],"manual":[172],"analyses":[173],"were":[177],"fixed).":[178],"The":[179],"investigated":[180],"classified":[184],"144":[186],"categories,":[187],"take":[188],"average":[190],"least":[192,207],"4":[193],"contributing":[194],"commits":[195],"before":[196],"being":[197],"introduced,":[198],"half":[200],"them":[202],"remain":[203],"unfixed":[204],"than":[209],"one":[210],"year.":[211],"Most":[212],"xmlns:xlink=\"http://www.w3.org/1999/xlink\">contributions</i>":[217],"done":[219],"developers":[221,263],"high":[223],"workload,":[224],"often":[225],"when":[226],"doing":[227],"maintenance":[228],"activities,":[229],"mostly":[234],"addition":[237],"new":[239],"aiming":[242],"implementing":[244],"further":[245],"checks":[246],"inputs.":[248],"conclude":[250],"distilling":[252],"practical":[253],"implications":[254],"detectors":[258],"work":[260],"assist":[262],"timely":[265],"identifying":[266],"issues.":[268]},"counts_by_year":[{"year":2026,"cited_by_count":10},{"year":2025,"cited_by_count":18},{"year":2024,"cited_by_count":23},{"year":2023,"cited_by_count":16},{"year":2022,"cited_by_count":9}],"updated_date":"2026-07-26T07:53:14.480251","created_date":"2025-10-10T00:00:00"}