Predicting vulnerable software components

In an investigation of the Mozilla vulnerability history, it was found that components that had a single vulnerability in the past were generally not likely to have further vulnerabilities, however, component that had similar imports or function calls were likely to be vulnerable.

Abstract

Where do most vulnerabilities occur in software? Our Vulture tool automatically mines existing vulnerability databases and version archives to map past vulnerabilities to components. The resulting ranking of the most vulnerable components is a perfect base for further investigations on what makes components vulnerable.