Security-Oriented Code Metrics for Machine Learning–Based Vulnerability Prediction in Source Code

Resumo

Automatic Vulnerability Prediction (AVP) has emerged as a promising approach for identifying security weaknesses in source code using machine learning techniques. While classic software metrics have been widely used for this purpose, they primarily capture general code attributes such as size and complexity and do not directly quantify security-relevant characteristics. This paper proposes a novel set of security-specific code metrics explicitly designed to measure vulnerability-prone properties of C/C++ programs. The proposed metrics focus on two major sources of vulnerabilities: tainted source usage and memory management and access practices. These metrics are extracted at the code slice level through static analysis and used as features to build vulnerability prediction models. We evaluate the effectiveness of the proposed metrics using multiple machine learning classifiers on a large-scale, publicly available dataset comprising over 420,000 labeled code slices. Experimental results show that the proposed metrics achieve strong and consistent performance across multiple vulnerability types, with particularly high effectiveness for memory-related vulnerabilities. A comparative analysis with classic software metrics demonstrates that security-specific metrics significantly improve vulnerability detection for pointer- and array-related weaknesses while remaining computationally efficient. These findings highlight the value of direct security measurement for enhancing automatic vulnerability prediction.