{"id":"https://openalex.org/W4403413483","doi":"https://doi.org/10.1145/3674805.3686670","title":"Automated Code-centric Software Vulnerability Assessment: How Far Are We? An Empirical Study in C/C++","display_name":"Automated Code-centric Software Vulnerability Assessment: How Far Are We? An Empirical Study in C/C++","publication_year":2024,"publication_date":"2024-10-15","ids":{"openalex":"https://openalex.org/W4403413483","doi":"https://doi.org/10.1145/3674805.3686670"},"language":"en","primary_location":{"id":"doi:10.1145/3674805.3686670","is_oa":false,"landing_page_url":"https://doi.org/10.1145/3674805.3686670","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 18th ACM/IEEE International Symposium on Empirical Software Engineering and Measurement","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["arxiv","crossref"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://arxiv.org/pdf/2407.17053","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5058577278","display_name":"Anh-Th\u01b0 T. Nguy\u1ec5n","orcid":"https://orcid.org/0000-0001-8979-1037"},"institutions":[{"id":"https://openalex.org/I5681781","display_name":"The University of Adelaide","ror":"https://ror.org/00892tw58","country_code":"AU","type":"education","lineage":["https://openalex.org/I5681781"]}],"countries":["AU"],"is_corresponding":false,"raw_author_name":"Anh The Nguyen","raw_affiliation_strings":["Self, Viet Nam","CREST -The Centre for Research on Engineering Software Technologies, The University of Adelaide Adelaide, Australia","Cyber Security Cooperative Research Centre, Australia","Independent Researcher, Vietnam"],"raw_orcid":"https://orcid.org/0000-0001-8979-1037","affiliations":[{"raw_affiliation_string":"Self, Viet Nam","institution_ids":[]},{"raw_affiliation_string":"CREST -The Centre for Research on Engineering Software Technologies, The University of Adelaide Adelaide, Australia","institution_ids":["https://openalex.org/I5681781"]},{"raw_affiliation_string":"Cyber Security Cooperative Research Centre, Australia","institution_ids":[]},{"raw_affiliation_string":"Independent Researcher, Vietnam","institution_ids":[]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5017801401","display_name":"Triet Huynh Minh Le","orcid":"https://orcid.org/0000-0003-1935-037X"},"institutions":[{"id":"https://openalex.org/I5681781","display_name":"The University of Adelaide","ror":"https://ror.org/00892tw58","country_code":"AU","type":"education","lineage":["https://openalex.org/I5681781"]}],"countries":["AU"],"is_corresponding":false,"raw_author_name":"Triet Huynh Minh Le","raw_affiliation_strings":["CREST - The Centre for Research on Engineering Software Technologies, The University of Adelaide, Australia","CREST -The Centre for Research on Engineering Software Technologies, The University of Adelaide Adelaide, Australia","Cyber Security Cooperative Research Centre, Australia","Independent Researcher, Vietnam"],"raw_orcid":"https://orcid.org/0000-0003-1935-037X","affiliations":[{"raw_affiliation_string":"CREST - The Centre for Research on Engineering Software Technologies, The University of Adelaide, Australia","institution_ids":["https://openalex.org/I5681781"]},{"raw_affiliation_string":"CREST -The Centre for Research on Engineering Software Technologies, The University of Adelaide Adelaide, Australia","institution_ids":["https://openalex.org/I5681781"]},{"raw_affiliation_string":"Cyber Security Cooperative Research Centre, Australia","institution_ids":[]},{"raw_affiliation_string":"Independent Researcher, Vietnam","institution_ids":[]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5103075476","display_name":"Muhammad Ali Babar","orcid":"https://orcid.org/0000-0001-9696-3626"},"institutions":[{"id":"https://openalex.org/I5681781","display_name":"The University of Adelaide","ror":"https://ror.org/00892tw58","country_code":"AU","type":"education","lineage":["https://openalex.org/I5681781"]}],"countries":["AU"],"is_corresponding":false,"raw_author_name":"M. Ali Babar","raw_affiliation_strings":["CREST - The Centre for Research on Engineering Software Technologies, The University of Adelaide, Australia","CREST -The Centre for Research on Engineering Software Technologies, The University of Adelaide Adelaide, Australia","Cyber Security Cooperative Research Centre, Australia","Independent Researcher, Vietnam"],"raw_orcid":"https://orcid.org/0000-0001-9696-3626","affiliations":[{"raw_affiliation_string":"CREST - The Centre for Research on Engineering Software Technologies, The University of Adelaide, Australia","institution_ids":["https://openalex.org/I5681781"]},{"raw_affiliation_string":"CREST -The Centre for Research on Engineering Software Technologies, The University of Adelaide Adelaide, Australia","institution_ids":["https://openalex.org/I5681781"]},{"raw_affiliation_string":"Cyber Security Cooperative Research Centre, Australia","institution_ids":[]},{"raw_affiliation_string":"Independent Researcher, Vietnam","institution_ids":[]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":["https://openalex.org/I5681781"],"apc_list":null,"apc_paid":null,"fwci":1.4079,"has_fulltext":true,"cited_by_count":5,"citation_normalized_percentile":{"value":0.84189917,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":97,"max":98},"biblio":{"volume":null,"issue":null,"first_page":"72","last_page":"83"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T12423","display_name":"Software Reliability and Analysis Research","score":0.9995999932289124,"subfield":{"id":"https://openalex.org/subfields/1712","display_name":"Software"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T12423","display_name":"Software Reliability and Analysis Research","score":0.9995999932289124,"subfield":{"id":"https://openalex.org/subfields/1712","display_name":"Software"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10260","display_name":"Software Engineering Research","score":0.9988999962806702,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.9936000108718872,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.6787254810333252},{"id":"https://openalex.org/keywords/vulnerability","display_name":"Vulnerability (computing)","score":0.5544643402099609},{"id":"https://openalex.org/keywords/vulnerability-assessment","display_name":"Vulnerability assessment","score":0.4651656448841095},{"id":"https://openalex.org/keywords/code","display_name":"Code (set theory)","score":0.4353514611721039},{"id":"https://openalex.org/keywords/software","display_name":"Software","score":0.4181002676486969},{"id":"https://openalex.org/keywords/software-engineering","display_name":"Software engineering","score":0.3622457981109619},{"id":"https://openalex.org/keywords/programming-language","display_name":"Programming language","score":0.23278093338012695},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.20696023106575012},{"id":"https://openalex.org/keywords/psychology","display_name":"Psychology","score":0.08795174956321716}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6787254810333252},{"id":"https://openalex.org/C95713431","wikidata":"https://www.wikidata.org/wiki/Q631425","display_name":"Vulnerability (computing)","level":2,"score":0.5544643402099609},{"id":"https://openalex.org/C167063184","wikidata":"https://www.wikidata.org/wiki/Q1400839","display_name":"Vulnerability assessment","level":3,"score":0.4651656448841095},{"id":"https://openalex.org/C2776760102","wikidata":"https://www.wikidata.org/wiki/Q5139990","display_name":"Code (set theory)","level":3,"score":0.4353514611721039},{"id":"https://openalex.org/C2777904410","wikidata":"https://www.wikidata.org/wiki/Q7397","display_name":"Software","level":2,"score":0.4181002676486969},{"id":"https://openalex.org/C115903868","wikidata":"https://www.wikidata.org/wiki/Q80993","display_name":"Software engineering","level":1,"score":0.3622457981109619},{"id":"https://openalex.org/C199360897","wikidata":"https://www.wikidata.org/wiki/Q9143","display_name":"Programming language","level":1,"score":0.23278093338012695},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.20696023106575012},{"id":"https://openalex.org/C15744967","wikidata":"https://www.wikidata.org/wiki/Q9418","display_name":"Psychology","level":0,"score":0.08795174956321716},{"id":"https://openalex.org/C177264268","wikidata":"https://www.wikidata.org/wiki/Q1514741","display_name":"Set (abstract data type)","level":2,"score":0.0},{"id":"https://openalex.org/C137176749","wikidata":"https://www.wikidata.org/wiki/Q4105337","display_name":"Psychological resilience","level":2,"score":0.0},{"id":"https://openalex.org/C542102704","wikidata":"https://www.wikidata.org/wiki/Q183257","display_name":"Psychotherapist","level":1,"score":0.0}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.1145/3674805.3686670","is_oa":false,"landing_page_url":"https://doi.org/10.1145/3674805.3686670","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 18th ACM/IEEE International Symposium on Empirical Software Engineering and Measurement","raw_type":"proceedings-article"},{"id":"pmh:oai:arXiv.org:2407.17053","is_oa":true,"landing_page_url":"http://arxiv.org/abs/2407.17053","pdf_url":"https://arxiv.org/pdf/2407.17053","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"}],"best_oa_location":{"id":"pmh:oai:arXiv.org:2407.17053","is_oa":true,"landing_page_url":"http://arxiv.org/abs/2407.17053","pdf_url":"https://arxiv.org/pdf/2407.17053","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"pdf":true,"grobid_xml":true},"content_urls":{"pdf":"https://content.openalex.org/works/W4403413483.pdf","grobid_xml":"https://content.openalex.org/works/W4403413483.grobid-xml"},"referenced_works_count":61,"referenced_works":["https://openalex.org/W1832693441","https://openalex.org/W1985258161","https://openalex.org/W2060758175","https://openalex.org/W2112736324","https://openalex.org/W2295598076","https://openalex.org/W2493916176","https://openalex.org/W2599482629","https://openalex.org/W2743316948","https://openalex.org/W2748690817","https://openalex.org/W2766411424","https://openalex.org/W2767521898","https://openalex.org/W2768348081","https://openalex.org/W2885030880","https://openalex.org/W2890264517","https://openalex.org/W2895210669","https://openalex.org/W2901941771","https://openalex.org/W2902415484","https://openalex.org/W2912095354","https://openalex.org/W2914747561","https://openalex.org/W2951913189","https://openalex.org/W2955991060","https://openalex.org/W2962911862","https://openalex.org/W2962960733","https://openalex.org/W2977587678","https://openalex.org/W2982413960","https://openalex.org/W2995824836","https://openalex.org/W3008371681","https://openalex.org/W3014780393","https://openalex.org/W3033777149","https://openalex.org/W3083954092","https://openalex.org/W3085192122","https://openalex.org/W3091588759","https://openalex.org/W3111397039","https://openalex.org/W3111602563","https://openalex.org/W3121707215","https://openalex.org/W3126095862","https://openalex.org/W3134763859","https://openalex.org/W3141797743","https://openalex.org/W3161071537","https://openalex.org/W3161874179","https://openalex.org/W3161997752","https://openalex.org/W3168151787","https://openalex.org/W3177116043","https://openalex.org/W3183469243","https://openalex.org/W3184339106","https://openalex.org/W3194346579","https://openalex.org/W3195612455","https://openalex.org/W4210443011","https://openalex.org/W4210493608","https://openalex.org/W4225673889","https://openalex.org/W4232648333","https://openalex.org/W4312436517","https://openalex.org/W4312439220","https://openalex.org/W4312757223","https://openalex.org/W4312969325","https://openalex.org/W4323042475","https://openalex.org/W4384345694","https://openalex.org/W4384345698","https://openalex.org/W4387298393","https://openalex.org/W4390906246","https://openalex.org/W4391344386"],"related_works":["https://openalex.org/W1883246888","https://openalex.org/W2370114625","https://openalex.org/W1756374135","https://openalex.org/W2062873522","https://openalex.org/W2947584067","https://openalex.org/W2280562859","https://openalex.org/W230721595","https://openalex.org/W3157230915","https://openalex.org/W1496728123","https://openalex.org/W2789975780"],"abstract_inverted_index":{"Background:":[0],"The":[1],"C/C++":[2,120],"languages":[3],"hold":[4],"significant":[5],"importance":[6],"in":[7,16,35,40,49,78,114,170,234,256,278],"Software":[8],"Engineering":[9],"research":[10],"because":[11],"of":[12,46,73,96,102,126,180,186,231,248,261],"their":[13,79],"widespread":[14],"use":[15,260],"practice.":[17],"Numerous":[18],"studies":[19],"have":[20,104],"utilized":[21],"Machine":[22],"Learning":[23,27],"(ML)":[24],"and":[25,71,81,92,98,131,174,178,267],"Deep":[26],"(DL)":[28],"techniques":[29,48,251],"to":[30,90,163,203,224,264],"detect":[31],"software":[32],"vulnerabilities":[33],"(SVs)":[34],"the":[36,44,68,86,94,124,137,141,146,176,187,204,221,240,246,259],"source":[37],"code":[38,162],"written":[39],"these":[41,47],"languages.":[42],"However,":[43],"application":[45],"function-level":[50,111,209,253],"SV":[51,57,108,112,138,166,210,254],"assessment":[52,58,113,139,167,211,255],"has":[53,196],"been":[54,105],"largely":[55],"unexplored.":[56],"is":[59],"increasingly":[60],"crucial":[61],"as":[62],"it":[63],"provides":[64],"detailed":[65],"information":[66],"on":[67,145],"exploitability,":[69],"impacts,":[70],"severity":[72],"security":[74],"defects,":[75],"thereby":[76],"aiding":[77],"prioritization":[80],"remediation.":[82],"Aims:":[83],"We":[84,152,192,244],"conduct":[85],"first":[87],"empirical":[88],"study":[89],"investigate":[91],"compare":[93,175],"performance":[95,125,201],"ML":[97,129,195],"DL":[99,134,206,222,263],"models,":[100],"many":[101],"which":[103,157],"used":[106],"for":[107,110,136,208,252,275],"detection,":[109],"C/C++.":[115],"Method:":[116],"Using":[117],"9,993":[118],"vulnerable":[119,161],"functions,":[121],"we":[122],"evaluated":[123],"six":[127],"multi-class":[128,133,189,205,241],"models":[130,135,207,223],"five":[132],"at":[140],"function":[142],"level":[143],"based":[144],"Common":[147],"Vulnerability":[148],"Scoring":[149],"System":[150],"(CVSS).":[151],"further":[153],"explore":[154],"multi-task":[155,218,262],"learning,":[156],"can":[158,270],"leverage":[159],"common":[160],"predict":[164],"all":[165],"outputs":[168],"simultaneously":[169],"a":[171,272],"single":[172],"model,":[173],"effectiveness":[177],"efficiency":[179,266],"this":[181,279],"model":[182],"type":[183],"with":[184,212,228],"those":[185],"original":[188],"models.":[190,242],"Results:":[191],"show":[193],"that":[194],"matching":[197],"or":[198],"even":[199],"better":[200],"compared":[202],"significantly":[213,226],"less":[214],"training":[215],"time.":[216],"Employing":[217],"learning":[219],"allows":[220],"perform":[225],"better,":[227],"an":[229],"average":[230],"8\u201322%":[232],"increase":[233],"Matthews":[235],"Correlation":[236],"Coefficient":[237],"(MCC),":[238],"than":[239],"Conclusions:":[243],"distill":[245],"practices":[247],"using":[249],"data-driven":[250],"C/C++,":[257],"including":[258],"balance":[265],"effectiveness.":[268],"This":[269],"establish":[271],"strong":[273],"foundation":[274],"future":[276],"work":[277],"area.":[280]},"counts_by_year":[{"year":2025,"cited_by_count":5}],"updated_date":"2026-07-29T14:22:42.915294","created_date":"2024-10-16T00:00:00"}