Automated Categorization of Bug Reports as Security Related or Non-security Related: A Machine Learning-based Solution

Purpose: This research paper proposes an automated approach for categorizing bug reports as security-related bugs (SRBs) or non-security-related bug reports (NSBRs) using machine learning techniques and software vulnerability information. The purpose of this paper is to address the challenges associated with identifying SRBs manually and provide an effective automated solution to ensure that potential security risks are identified and addressed promptly. Methods: The proposed approach leverages software vulnerability information from authorized sources such as Common Weakness Enumeration (CWE) and manually collected security-related keywords to generate a list of security keywords. The authors use machine learning techniques and performance measures such as F1, false positive rate (FPR), and area under the curve (AUC), Balance, Accuracy to evaluate the effectiveness of the proposed approach. Statistical non-parametric tests, namely, Friedman test and the Kruskal–Wallis test, are conducted to compare the performance of different classifiers. Results: The results of the paper indicate that XGBoost outperformed other classifiers in building bug prediction models. The proposed approach offers significant benefits over the traditional manual extraction of SRBs from large datasets using security-related keywords. Conclusion: The paper concludes that automating the process of identifying SRBs is essential to ensure that potential security risks are identified and addressed promptly. The proposed approach provides an effective solution to the problem of identifying SRBs using machine learning techniques and software vulnerability information. The results of the paper highlight the importance of automating the process of identifying SRBs to ensure the security of software systems.