Just-in-time software vulnerability detection: Are we there yet?

Software vulnerabilities are weaknesses in source code that might be exploited to cause harm or loss. Previous work has proposed a number of automated machine learning approaches detect them. Most these techniques at release-level, meaning they aim predicting the files will potentially vulnerable future release. Yet, researchers have shown commit-level identification issues better fit developer’s needs, speeding up their resolution. To investigate how currently available learning-based vulnerability detection mechanisms can support developers commit-level. We perform an empirical study where we consider nine projects accounting for 8991 commits and experiment with eight learners built using process, product, textual metrics. point out three main findings: (1) basic rarely well; (2) use ensemble algorithms based on boosting substantially improve performance; (3) combination more metrics does not necessarily classification capabilities. Further research should focus just-in-time detection, especially respect introduction smart feature selection training strategies.