Paper,Response Variables,Granularity,Notes
Perl2015Finding,Vulnerability Contribution,Commit,Is a commit likely to be contributing a vulnerability?
Manadhata2011Attack,Vulnerability,Commit,Did a vulnerability-fixing patch reduce the attack surface?
Shin2011Evaluating,Vulnerability,File,
Younis2016Fear,Vulnerability Exploitability,Function,
Stephan2007Predicting,Vulnerability,Component,
Chowdhury2010Can,Number of Vulnerabilities,File,
Gegick2009Predicting,Number of Vulnerabilities and Vulnerability,Component,"The response variable is defined rather oddly because the authors use the term ""vulnerability"" to refer to software failures reported by testers, customers, and/or other third-party users."
Lwin2013Predicting,Vulnerability,Statement,Is a particular statement (HTML or SQL sink) likely to be vulnerable?
Nguyen2010Predicting,Vulnerability,Component,Is a particular component likely to be vulnerable?
Gegick2008Prioritizing,Vulnerability,Component,"The response variable is defined rather oddly because the authors say ""an attack-prone component is a vulnerability-prone component if an attacker will likely exploit one or more vulnerabilities in that component."" without actually using vulnerabilities."
Zimmermann2010Searching,Number of Vulnerabilities and Vulnerability,Binary,
Meneely2010Strengthening,Vulnerability,File,Is a particular file likely to be vulnerable?
Kim2007Vulnerability,Number of Vulnerabilities,System,The study is different from all other studies considered so far because there is no vulnerability discovery metric being proposed but instead a vulnerability discovery model is being proposed which can predict the number of vulnerabilities in a version of software given number of vulnerabilities in the previous version.
Meneely2013Patch,Vulnerability Contribution,Commit,Is a commit likely to be contributing a vulnerability?
Shin2008Empirical,Vulnerability,Function,Is a function likely to be vulnerable?
Neuhaus2009Beauty,Number of Vulnerabilities and Vulnerability,Package,Is there a relationship between number of vulnerabilities in a package and its dependencies? and Is a package likely to be vulnerable?
Shin2011Initial,Vulnerability,File,Is a file likely to be vulnerable?
Chowdhury2011Complexity,Number of Vulnerabilities and Vulnerability,File,Are metrics correlated with number of vulnerabilities? and Is file likely to be vulnerable?
Shin2013Traditional,Vulnerability,File,Is a file likely to be vulnerable?
Scandariato2014Predicting,Vulnerability,File,Is the file likely to be vulnerable?
Walden2014Predicting,Vulnerability,File,Is the file likely to be vulnerable?
Munaiah2016Beyond,Vulnerability,"File,Function",Is the file/function likely to be vulnerable?
Munaiah2017Foreshadow,Vulnerability,File,Is the file likely to be vulnerable?
Munaiah2017Natural,Missed Vulnerability,Review,Is the review likely to miss a vulnerability?
Meneely2009Secure,Vulnerability,File,Is the file likely to be vulnerable?
Gegick2009Toward,Number of Vulnerabilities and Vulnerability,Component,"The response variable if defined rather oddly because the authors treat security faults and failures as vulnerabilities. While security failures are similar to vulnerabilities, security faults are not but the study does not separate the two. The study is included here irrespective of this limitation."