Open source vulnerability prediction with machine learning ensemble

A non-transitory, computer-readable medium having program code stored thereon that is executable by a computing device, the program code comprising instructions to:

• invoke k-fold cross validation to train and test a set of classifiers and program code to train a logistic regression model with probability vectors from the set of classifiers generated from the k-fold cross validation;
• input a software development artifact derived vector to an ensemble of the trained set of classifiers and the trained logistic regression model,
• wherein the trained set of classifiers generates a set of probabilities that a software component identified by the software development artifact from which the vector is derived has a vulnerability or flaw,
• wherein the ensemble generates a probability that the software component has a vulnerability or flaw based on fitting a linear combination of the set of probabilities to the trained logistic regression model;
• and
• update a database with the probability generated from the ensemble in association with identity of the software component.

An apparatus comprising:

• a processor;
• and
• a non-transitory computer-readable medium having instructions stored thereon that are executable by the processor to cause the apparatus to,
• train and test a set of classifiers with k-fold cross validation on a first dataset comprising labels and vectors representing software components,
• wherein each label indicates whether a respective one of the software components has a vulnerability or flaw,
• wherein a set of probability values generated for each of the vectors by the set of classifiers from the testing is stored;
• train a logistic regression model with the stored sets of probability values and the labels;
• and
• combine the trained set of classifiers and the trained logistic regression model to generate an ensemble that indicates whether a software component has a flaw.