Estimating Software Vulnerabilities from Git Project Open Source: A Machine Learning Approach

This study investigates the use of machine learning, specifically linear regression, to estimate software vulnerabilities in open-source GitHub projects. A dataset comprising 30 PHP projects was developed through static analysis to generate 53 features, including metrics related to the size and complexity of the codebase. Feature selection was performed using Pearson correlation, with features exhibiting a correlation above 0.75 with the target variable being included in the model. The study highlights the importance of the number of paths and executable statements in predicting vulnerabilities, suggesting that the complexity of execution paths and the number of executable statements significantly influence the presence of software vulnerabilities. The model’s performance was evaluated using Mean Squared Error (MSE) and R-squared metrics, with improvements observed following hyperparameter tuning and regularization.