{"id":"https://openalex.org/W2063770056","doi":"https://doi.org/10.1145/1456362.1456370","title":"Prioritizing software security fortification throughcode-level metrics","display_name":"Prioritizing software security fortification throughcode-level metrics","publication_year":2008,"publication_date":"2008-10-27","ids":{"openalex":"https://openalex.org/W2063770056","doi":"https://doi.org/10.1145/1456362.1456370","mag":"2063770056"},"language":"en","primary_location":{"id":"doi:10.1145/1456362.1456370","is_oa":false,"landing_page_url":"https://doi.org/10.1145/1456362.1456370","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 4th ACM workshop on Quality of protection","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5055497143","display_name":"Michael Gegick","orcid":"https://orcid.org/0000-0002-5816-4118"},"institutions":[{"id":"https://openalex.org/I137902535","display_name":"North Carolina State University","ror":"https://ror.org/04tj63d06","country_code":"US","type":"education","lineage":["https://openalex.org/I137902535"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Michael Gegick","raw_affiliation_strings":["North Carolina State University, Raleigh, NC, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"North Carolina State University, Raleigh, NC, USA","institution_ids":["https://openalex.org/I137902535"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5028171895","display_name":"Laurie Williams","orcid":"https://orcid.org/0000-0003-3300-6540"},"institutions":[{"id":"https://openalex.org/I137902535","display_name":"North Carolina State University","ror":"https://ror.org/04tj63d06","country_code":"US","type":"education","lineage":["https://openalex.org/I137902535"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Laurie Williams","raw_affiliation_strings":["North Carolina State University, Raleigh, NC, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"North Carolina State University, Raleigh, NC, USA","institution_ids":["https://openalex.org/I137902535"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5106135621","display_name":"Jason A. Osborne","orcid":null},"institutions":[{"id":"https://openalex.org/I137902535","display_name":"North Carolina State University","ror":"https://ror.org/04tj63d06","country_code":"US","type":"education","lineage":["https://openalex.org/I137902535"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Jason Osborne","raw_affiliation_strings":["North Carolina State University, Raleigh, NC, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"North Carolina State University, Raleigh, NC, USA","institution_ids":["https://openalex.org/I137902535"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5108545096","display_name":"Mladen A. Vouk","orcid":null},"institutions":[{"id":"https://openalex.org/I137902535","display_name":"North Carolina State University","ror":"https://ror.org/04tj63d06","country_code":"US","type":"education","lineage":["https://openalex.org/I137902535"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Mladen Vouk","raw_affiliation_strings":["North Carolina State University, Raleigh, NC, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"North Carolina State University, Raleigh, NC, USA","institution_ids":["https://openalex.org/I137902535"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":["https://openalex.org/I137902535"],"apc_list":null,"apc_paid":null,"fwci":4.0553,"has_fulltext":false,"cited_by_count":83,"citation_normalized_percentile":{"value":0.94822544,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":93,"max":100},"biblio":{"volume":null,"issue":null,"first_page":"31","last_page":"38"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10260","display_name":"Software Engineering Research","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10260","display_name":"Software Engineering Research","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12423","display_name":"Software Reliability and Analysis Research","score":0.9998000264167786,"subfield":{"id":"https://openalex.org/subfields/1712","display_name":"Software"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9965999722480774,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.6932103633880615},{"id":"https://openalex.org/keywords/software-security-assurance","display_name":"Software security assurance","score":0.6879810094833374},{"id":"https://openalex.org/keywords/source-lines-of-code","display_name":"Source lines of code","score":0.5786193013191223},{"id":"https://openalex.org/keywords/software","display_name":"Software","score":0.5417059659957886},{"id":"https://openalex.org/keywords/code","display_name":"Code (set theory)","score":0.49178579449653625},{"id":"https://openalex.org/keywords/static-program-analysis","display_name":"Static program analysis","score":0.47752371430397034},{"id":"https://openalex.org/keywords/development-testing","display_name":"Development testing","score":0.46145308017730713},{"id":"https://openalex.org/keywords/software-metric","display_name":"Software metric","score":0.4538532495498657},{"id":"https://openalex.org/keywords/software-engineering","display_name":"Software engineering","score":0.4424694776535034},{"id":"https://openalex.org/keywords/software-system","display_name":"Software system","score":0.4392516613006592},{"id":"https://openalex.org/keywords/security-bug","display_name":"Security bug","score":0.43915581703186035},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.43262138962745667},{"id":"https://openalex.org/keywords/software-bug","display_name":"Software bug","score":0.42141348123550415},{"id":"https://openalex.org/keywords/software-development","display_name":"Software development","score":0.3108106255531311},{"id":"https://openalex.org/keywords/software-construction","display_name":"Software construction","score":0.30585384368896484},{"id":"https://openalex.org/keywords/operating-system","display_name":"Operating system","score":0.14619529247283936},{"id":"https://openalex.org/keywords/information-security","display_name":"Information security","score":0.1393970549106598},{"id":"https://openalex.org/keywords/security-service","display_name":"Security service","score":0.12673091888427734},{"id":"https://openalex.org/keywords/set","display_name":"Set (abstract data type)","score":0.11120954155921936},{"id":"https://openalex.org/keywords/programming-language","display_name":"Programming language","score":0.08573132753372192}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6932103633880615},{"id":"https://openalex.org/C62913178","wikidata":"https://www.wikidata.org/wiki/Q7554361","display_name":"Software security assurance","level":4,"score":0.6879810094833374},{"id":"https://openalex.org/C199519371","wikidata":"https://www.wikidata.org/wiki/Q942695","display_name":"Source lines of code","level":3,"score":0.5786193013191223},{"id":"https://openalex.org/C2777904410","wikidata":"https://www.wikidata.org/wiki/Q7397","display_name":"Software","level":2,"score":0.5417059659957886},{"id":"https://openalex.org/C2776760102","wikidata":"https://www.wikidata.org/wiki/Q5139990","display_name":"Code (set theory)","level":3,"score":0.49178579449653625},{"id":"https://openalex.org/C137287247","wikidata":"https://www.wikidata.org/wiki/Q1329550","display_name":"Static program analysis","level":4,"score":0.47752371430397034},{"id":"https://openalex.org/C63406617","wikidata":"https://www.wikidata.org/wiki/Q5266714","display_name":"Development testing","level":5,"score":0.46145308017730713},{"id":"https://openalex.org/C82214349","wikidata":"https://www.wikidata.org/wiki/Q657339","display_name":"Software metric","level":5,"score":0.4538532495498657},{"id":"https://openalex.org/C115903868","wikidata":"https://www.wikidata.org/wiki/Q80993","display_name":"Software engineering","level":1,"score":0.4424694776535034},{"id":"https://openalex.org/C149091818","wikidata":"https://www.wikidata.org/wiki/Q2429814","display_name":"Software system","level":3,"score":0.4392516613006592},{"id":"https://openalex.org/C131275738","wikidata":"https://www.wikidata.org/wiki/Q7445023","display_name":"Security bug","level":5,"score":0.43915581703186035},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.43262138962745667},{"id":"https://openalex.org/C1009929","wikidata":"https://www.wikidata.org/wiki/Q179550","display_name":"Software bug","level":3,"score":0.42141348123550415},{"id":"https://openalex.org/C529173508","wikidata":"https://www.wikidata.org/wiki/Q638608","display_name":"Software development","level":3,"score":0.3108106255531311},{"id":"https://openalex.org/C186846655","wikidata":"https://www.wikidata.org/wiki/Q3398377","display_name":"Software construction","level":4,"score":0.30585384368896484},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.14619529247283936},{"id":"https://openalex.org/C527648132","wikidata":"https://www.wikidata.org/wiki/Q189900","display_name":"Information security","level":2,"score":0.1393970549106598},{"id":"https://openalex.org/C29983905","wikidata":"https://www.wikidata.org/wiki/Q7445066","display_name":"Security service","level":3,"score":0.12673091888427734},{"id":"https://openalex.org/C177264268","wikidata":"https://www.wikidata.org/wiki/Q1514741","display_name":"Set (abstract data type)","level":2,"score":0.11120954155921936},{"id":"https://openalex.org/C199360897","wikidata":"https://www.wikidata.org/wiki/Q9143","display_name":"Programming language","level":1,"score":0.08573132753372192}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1145/1456362.1456370","is_oa":false,"landing_page_url":"https://doi.org/10.1145/1456362.1456370","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 4th ACM workshop on Quality of protection","raw_type":"proceedings-article"}],"best_oa_location":null,"sustainable_development_goals":[],"awards":[],"funders":[{"id":"https://openalex.org/F4320306076","display_name":"National Science Foundation","ror":"https://ror.org/021nxhr62"}],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":21,"referenced_works":["https://openalex.org/W1480376833","https://openalex.org/W1562658564","https://openalex.org/W1984733877","https://openalex.org/W2027483357","https://openalex.org/W2049695835","https://openalex.org/W2082314767","https://openalex.org/W2089187712","https://openalex.org/W2100945416","https://openalex.org/W2107024044","https://openalex.org/W2120990696","https://openalex.org/W2121866145","https://openalex.org/W2123127356","https://openalex.org/W2133894309","https://openalex.org/W2135366128","https://openalex.org/W2142439564","https://openalex.org/W2161470369","https://openalex.org/W2166336492","https://openalex.org/W2187231432","https://openalex.org/W2339337913","https://openalex.org/W2911270358","https://openalex.org/W4399890603"],"related_works":["https://openalex.org/W4283750846","https://openalex.org/W2007984522","https://openalex.org/W3048815537","https://openalex.org/W2038197060","https://openalex.org/W4213233191","https://openalex.org/W2186452251","https://openalex.org/W3095160805","https://openalex.org/W2043837581","https://openalex.org/W4301430471","https://openalex.org/W2804659066"],"abstract_inverted_index":{"Limited":[0],"resources":[1],"preclude":[2],"software":[3,13,46,68],"engineers":[4,32],"from":[5,63],"finding":[6],"and":[7,43,53,56,60,107],"fixing":[8],"all":[9],"vulnerabilities":[10],"in":[11,146],"a":[12,64],"system.":[14,148],"We":[15,58],"create":[16],"predictive":[17],"models":[18,36,94],"to":[19,25,37,44,81,142],"identify":[20],"which":[21],"components":[22,121],"are":[23],"likely":[24],"have":[26],"the":[27,82,96,119,124,137,147],"most":[28],"security":[29,47],"risk.":[30],"Software":[31],"can":[33],"use":[34],"these":[35],"make":[38],"measurement-based":[39],"risk":[40],"management":[41],"decisions":[42],"prioritize":[45,143],"fortification":[48,144],"efforts,":[49],"such":[50],"as":[51],"redesign":[52],"additional":[54],"inspection":[55],"testing.":[57],"mined":[59],"analyzed":[61],"data":[62],"large":[65],"commercial":[66],"telecommunications":[67],"system":[69],"containing":[70],"over":[71],"one":[72],"million":[73],"lines":[74,111],"of":[75,109,112,118,123,127],"code":[76,105],"that":[77],"had":[78],"been":[79],"deployed":[80],"field":[83],"for":[84],"two":[85],"years.":[86],"Using":[87],"recursive":[88],"partitioning,":[89],"we":[90],"built":[91],"attack-prone":[92,120],"prediction":[93],"with":[95,129],"following":[97],"code-level":[98],"metrics:":[99],"static":[100],"analysis":[101],"tool":[102],"alert":[103],"density,":[104],"churn,":[106],"count":[108],"source":[110],"code.":[113],"One":[114],"model":[115,138],"identified":[116],"100%":[117],"(40%":[122],"total":[125],"number":[126],"components)":[128],"an":[130],"8%":[131],"false":[132],"positive":[133],"rate.":[134],"As":[135],"such,":[136],"could":[139],"be":[140],"used":[141],"efforts":[145]},"counts_by_year":[{"year":2025,"cited_by_count":3},{"year":2024,"cited_by_count":3},{"year":2023,"cited_by_count":4},{"year":2022,"cited_by_count":4},{"year":2021,"cited_by_count":2},{"year":2020,"cited_by_count":2},{"year":2019,"cited_by_count":3},{"year":2018,"cited_by_count":4},{"year":2017,"cited_by_count":7},{"year":2016,"cited_by_count":13},{"year":2015,"cited_by_count":8},{"year":2014,"cited_by_count":4},{"year":2013,"cited_by_count":8},{"year":2012,"cited_by_count":2}],"updated_date":"2026-07-29T14:22:42.915294","created_date":"2025-10-10T00:00:00"}