Using complexity metrics to improve software security

Information technology is quickly spreading across critical infrastructures and software has become an inevitable part of industries and organisations. At the same time, many cyberthreats are the result of poor software coding. Stuxnet, which was the most powerful cyber-weapon used against industrial control systems, exploited zero-day vulnerabilities in Microsoft Windows. 1 The US Department of Homeland Security (DHS) also announced that software vulnerabilities are among the three most common cyber-security vulnerabilities in Industrial Control Systems (ICSs). 2 Therefore, improving software security has an important role in increasing the security level of computer-based systems. Software vulnerability prediction is a tedious task, so automating vulnerability prediction would save a lot of time and resources. One recently used methodology in vulnerability prediction is based on automatic fault prediction using software metrics. Here, Sara Moshtari, Ashkan Sami and Mahdi Azimi of Shiraz University, Iran build on previous studies by providing more complete vulnerability information. They show what can be achieved using different classification techniques and more complete vulnerability information.