ICST.Table 1 - Revision history

Programsam: Blanked the page

2013-08-24T22:34:28Z

Blanked the page

← Older revision		Revision as of 22:34, 24 August 2013
Line 1:		Line 1:
	~~{\| class="wikitable" style="text-align: left; width: 100%;"~~
	~~\|+ Table 1. Results per Project~~
	!
	~~! WordPress~~
	~~! WikkaWiki~~
	\|-
	~~\|Releases Analysed~~
	~~\|Nine~~
	~~\|Six~~
	\|-
	~~\| Security issue reports analyzed~~
	~~\| 97~~
	~~\| 61~~
	\|-
	~~\| Vulnerable files (over project's history)~~
	~~\| 26% (85 / 326)~~
	~~\| 29% (44 / 209)~~
	\|-
	~~\| Average number of hotspots (over project's history~~
	~~\| 255~~
	~~\| 92~~
	\|-
	~~\| Average percent of files having at least one hotspot~~
	~~\| 14.2%~~
	~~\| 8.42%~~
	\|-
	~~\|colspan="3" style="background: #eeeeee" \| '''Hypotheses&dagger; about files'''~~
	\|-
	~~\| '''H1.''' The more hotspots a file contains per line of code, the more likely it is that the file contains any web application vulnerability.~~
	~~\| True (Logistic Regression, p<0.05)~~
	~~\| True (Logistic Regression, p<0.05)~~
	\|-
	~~\| '''H2.''' The more hotspots a file contains, the more times that file was changed due to any kind of vulnerability (not just input validation vulnerabilities).~~
	~~\| True (Simple Linear Regression, p<0.0001, Adjusted R2 = 0.4208)~~
	~~\| True (Simple Linear Regression, p<0.0001, Adjusted R2 = 0.3802)~~
	\|-
	~~\|colspan="3" style="background: #eeeeee" \| '''Hypotheses about issue reports'''~~
	\|-
	~~\| '''H3'''. Input validation vulnerabilities result in a higher number average repository revisions than any other type of vulnerability*.~~
	~~\| True (MWW, p<0.05)~~
	~~\| True (MWW, p<0.05)~~
	\|-
	~~\|colspan="3" style="background: #eeeeee" \| '''Hypotheses about prediction'''~~
	\|-
	~~\| '''H4.''' Hotspots can be used to predict files that will contain any type of web application vulnerability in the current release.~~
	~~\| True (Predictive Modeling, see Table 2)~~
	~~\| True (Predictive Modeling, see Table 3)~~
	\|-
	~~\| '''H5.''' The more hotspots a file contains, the more likely that file will be vulnerable in the next release.~~
	~~\| True (Positive Coefficient on Predictive Models)~~
	~~\| True (Positive Coefficient on Predictive Models)~~
	\|-
	~~\|colspan="3" style="background: #eeeeee" \| '''Hypotheses comparing projects'''~~
	\|-
	~~\| '''H6.''' The average number of hotspots per file is more variable in WordPress than in WikkaWikki.~~
	~~\| colspan=2 \| True (F-test, p<0.000001)~~
	\|-
	~~\| '''H7.''' WordPress suffered a higher proportion of input validation vulnerabilities than WikkaWiki.~~
	~~\| colspan=2 \| True (Chi-Squared, p=0.0692)~~
	\|-
	~~\| '''H8.''' In WordPress, more of the lines of code that were changed due to security issues were hotspots.~~
	~~\| colspan=2 \| True (Chi-Square, p<0.00001)~~
	\|-
	\| colspan=3 style="border-style: solid; border-width: 0 1px 1px 0" \| *This finding is consistent with the report from SANS (see Section 1) that indicates that the most popular types of web application attacks are input validation vulnerabilities.
	~~&dagger;Please note that we use the term "hypothesis" in this table with respect to scientific hypotheses and not statistical hypotheses.~~

	\|}

Programsam at 22:34, 24 August 2013

2013-08-24T22:34:22Z

← Older revision		Revision as of 22:34, 24 August 2013
Line 1:		Line 1:
	{\| class="wikitable" style="text-align: left; width: 100%;"		{\| class="wikitable" style="text-align: left; width: 100%;"
	\|+ ~~This is a caption~~		\|+ Table 1. Results per Project
	!		!
	! WordPress		! WordPress

Programsam at 22:34, 24 August 2013

2013-08-24T22:34:11Z

← Older revision		Revision as of 22:34, 24 August 2013
Line 1:		Line 1:
	{\| class="wikitable" style="text-align: left; width: 100%;"		{\| class="wikitable" style="text-align: left; width: 100%;"
			\|+ This is a caption
	!		!
	! WordPress		! WordPress

Programsam at 22:33, 24 August 2013

2013-08-24T22:33:32Z

← Older revision		Revision as of 22:33, 24 August 2013
Line 24:		Line 24:
	\| 8.42%		\| 8.42%
	\|-		\|-
	\|colspan="3" style="background: #eeeeee" \| '''Hypotheses about files'''		\|colspan="3" style="background: #eeeeee" \| '''Hypotheses&dagger; about files'''
	\|-		\|-
	\| '''H1.''' The more hotspots a file contains per line of code, the more likely it is that the file contains any web application vulnerability.		\| '''H1.''' The more hotspots a file contains per line of code, the more likely it is that the file contains any web application vulnerability.
Line 62:		Line 62:
	\|-		\|-
	\| colspan=3 style="border-style: solid; border-width: 0 1px 1px 0" \| *This finding is consistent with the report from SANS (see Section 1) that indicates that the most popular types of web application attacks are input validation vulnerabilities.		\| colspan=3 style="border-style: solid; border-width: 0 1px 1px 0" \| *This finding is consistent with the report from SANS (see Section 1) that indicates that the most popular types of web application attacks are input validation vulnerabilities.
	† Please note that we use the term "hypothesis" in this table with respect to scientific hypotheses and not statistical hypotheses.		&dagger;Please note that we use the term "hypothesis" in this table with respect to scientific hypotheses and not statistical hypotheses.

	\|}		\|}

Programsam at 22:32, 24 August 2013

2013-08-24T22:32:22Z

← Older revision		Revision as of 22:32, 24 August 2013
Line 61:		Line 61:
	\| colspan=2 \| True (Chi-Square, p<0.00001)		\| colspan=2 \| True (Chi-Square, p<0.00001)
	\|-		\|-
	\| colspan=~~2 \|~~ style="border-style: solid; border-width: 0 1px 1px 0" \| *This finding is consistent with the report from SANS (see Section 1) that indicates that the most popular types of web application attacks are input validation vulnerabilities.		\| colspan=3 style="border-style: solid; border-width: 0 1px 1px 0" \| *This finding is consistent with the report from SANS (see Section 1) that indicates that the most popular types of web application attacks are input validation vulnerabilities.
	† Please note that we use the term "hypothesis" in this table with respect to scientific hypotheses and not statistical hypotheses.		† Please note that we use the term "hypothesis" in this table with respect to scientific hypotheses and not statistical hypotheses.

	\|}		\|}

Programsam at 22:32, 24 August 2013

2013-08-24T22:32:00Z

← Older revision		Revision as of 22:32, 24 August 2013
Line 61:		Line 61:
	\| colspan=2 \| True (Chi-Square, p<0.00001)		\| colspan=2 \| True (Chi-Square, p<0.00001)
	\|-		\|-
	\| style="border-style: solid; border-width: 0 1px 1px 0" \| *This finding is consistent with the report from SANS (see Section 1) that indicates that the most popular types of web application attacks are input validation vulnerabilities.		\| colspan=2 \| style="border-style: solid; border-width: 0 1px 1px 0" \| *This finding is consistent with the report from SANS (see Section 1) that indicates that the most popular types of web application attacks are input validation vulnerabilities.
	† Please note that we use the term "hypothesis" in this table with respect to scientific hypotheses and not statistical hypotheses.		† Please note that we use the term "hypothesis" in this table with respect to scientific hypotheses and not statistical hypotheses.

	\|}		\|}

Programsam at 22:31, 24 August 2013

2013-08-24T22:31:26Z

← Older revision		Revision as of 22:31, 24 August 2013
Line 60:		Line 60:
	\| '''H8.''' In WordPress, more of the lines of code that were changed due to security issues were hotspots.		\| '''H8.''' In WordPress, more of the lines of code that were changed due to security issues were hotspots.
	\| colspan=2 \| True (Chi-Square, p<0.00001)		\| colspan=2 \| True (Chi-Square, p<0.00001)
			\|-
			\| style="border-style: solid; border-width: 0 1px 1px 0" \| *This finding is consistent with the report from SANS (see Section 1) that indicates that the most popular types of web application attacks are input validation vulnerabilities.
			† Please note that we use the term "hypothesis" in this table with respect to scientific hypotheses and not statistical hypotheses.

	\|}		\|}

Programsam at 22:29, 24 August 2013

2013-08-24T22:29:52Z

← Older revision		Revision as of 22:29, 24 August 2013
Line 55:		Line 55:
	\| colspan=2 \| True (F-test, p<0.000001)		\| colspan=2 \| True (F-test, p<0.000001)
	\|-		\|-
			\| '''H7.''' WordPress suffered a higher proportion of input validation vulnerabilities than WikkaWiki.
			\| colspan=2 \| True (Chi-Squared, p=0.0692)
			\|-
			\| '''H8.''' In WordPress, more of the lines of code that were changed due to security issues were hotspots.
			\| colspan=2 \| True (Chi-Square, p<0.00001)
	\|}		\|}

Programsam at 22:28, 24 August 2013

2013-08-24T22:28:37Z

@@ Line 41: / Line 41: @@
 |-
 |colspan="3" style="background: #eeeeee" | '''Hypotheses about prediction'''
 |-
 |}

Programsam at 22:26, 24 August 2013

2013-08-24T22:26:49Z

← Older revision		Revision as of 22:26, 24 August 2013
Line 34:		Line 34:
	\| True (Simple Linear Regression, p<0.0001, Adjusted R2 = 0.3802)		\| True (Simple Linear Regression, p<0.0001, Adjusted R2 = 0.3802)
	\|-		\|-
	\|colspan="3" style="background: #eeeeee" \| Hypotheses about issue reports		\|colspan="3" style="background: #eeeeee" \| '''Hypotheses about issue reports'''
			\|-
			\| '''H3'''. Input validation vulnerabilities result in a higher number average repository revisions than any other type of vulnerability*.
			\| True (MWW, p<0.05)
			\| True (MWW, p<0.05)
			\|-
			\|colspan="3" style="background: #eeeeee" \| '''Hypotheses about prediction'''
	\|-		\|-
	\|}		\|}

← Older revision		Revision as of 22:34, 24 August 2013
Line 1:		Line 1:
	~~{\| class="wikitable" style="text-align: left; width: 100%;"~~
	~~\|+ Table 1. Results per Project~~
	!
	~~! WordPress~~
	~~! WikkaWiki~~
	\|-
	~~\|Releases Analysed~~
	~~\|Nine~~
	~~\|Six~~
	\|-
	~~\| Security issue reports analyzed~~
	~~\| 97~~
	~~\| 61~~
	\|-
	~~\| Vulnerable files (over project's history)~~
	~~\| 26% (85 / 326)~~
	~~\| 29% (44 / 209)~~
	\|-
	~~\| Average number of hotspots (over project's history~~
	~~\| 255~~
	~~\| 92~~
	\|-
	~~\| Average percent of files having at least one hotspot~~
	~~\| 14.2%~~
	~~\| 8.42%~~
	\|-
	~~\|colspan="3" style="background: #eeeeee" \| '''Hypotheses&dagger; about files'''~~
	\|-
	~~\| '''H1.''' The more hotspots a file contains per line of code, the more likely it is that the file contains any web application vulnerability.~~
	~~\| True (Logistic Regression, p<0.05)~~
	~~\| True (Logistic Regression, p<0.05)~~
	\|-
	~~\| '''H2.''' The more hotspots a file contains, the more times that file was changed due to any kind of vulnerability (not just input validation vulnerabilities).~~
	~~\| True (Simple Linear Regression, p<0.0001, Adjusted R2 = 0.4208)~~
	~~\| True (Simple Linear Regression, p<0.0001, Adjusted R2 = 0.3802)~~
	\|-
	~~\|colspan="3" style="background: #eeeeee" \| '''Hypotheses about issue reports'''~~
	\|-
	~~\| '''H3'''. Input validation vulnerabilities result in a higher number average repository revisions than any other type of vulnerability*.~~
	~~\| True (MWW, p<0.05)~~
	~~\| True (MWW, p<0.05)~~
	\|-
	~~\|colspan="3" style="background: #eeeeee" \| '''Hypotheses about prediction'''~~
	\|-
	~~\| '''H4.''' Hotspots can be used to predict files that will contain any type of web application vulnerability in the current release.~~
	~~\| True (Predictive Modeling, see Table 2)~~
	~~\| True (Predictive Modeling, see Table 3)~~
	\|-
	~~\| '''H5.''' The more hotspots a file contains, the more likely that file will be vulnerable in the next release.~~
	~~\| True (Positive Coefficient on Predictive Models)~~
	~~\| True (Positive Coefficient on Predictive Models)~~
	\|-
	~~\|colspan="3" style="background: #eeeeee" \| '''Hypotheses comparing projects'''~~
	\|-
	~~\| '''H6.''' The average number of hotspots per file is more variable in WordPress than in WikkaWikki.~~
	~~\| colspan=2 \| True (F-test, p<0.000001)~~
	\|-
	~~\| '''H7.''' WordPress suffered a higher proportion of input validation vulnerabilities than WikkaWiki.~~
	~~\| colspan=2 \| True (Chi-Squared, p=0.0692)~~
	\|-
	~~\| '''H8.''' In WordPress, more of the lines of code that were changed due to security issues were hotspots.~~
	~~\| colspan=2 \| True (Chi-Square, p<0.00001)~~
	\|-
	\| colspan=3 style="border-style: solid; border-width: 0 1px 1px 0" \| *This finding is consistent with the report from SANS (see Section 1) that indicates that the most popular types of web application attacks are input validation vulnerabilities.
	~~&dagger;Please note that we use the term "hypothesis" in this table with respect to scientific hypotheses and not statistical hypotheses.~~

	\|}