{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,3,26]],"date-time":"2026-03-26T15:52:32Z","timestamp":1774540352058,"version":"3.50.1"},"reference-count":30,"publisher":"World Scientific Pub Co Pte Ltd","issue":"10","funder":[{"name":"Central government guided local science and Technology Development Fund Project","award":["226Z0701G"],"award-info":[{"award-number":["226Z0701G"]}]},{"DOI":"10.13039\/501100003787","name":"Natural Science Foundation of Hebei Province","doi-asserted-by":"publisher","award":["F2022203026"],"award-info":[{"award-number":["F2022203026"]}],"id":[{"id":"10.13039\/501100003787","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100003787","name":"Natural Science Foundation of Hebei Province","doi-asserted-by":"publisher","award":["F2022203089"],"award-info":[{"award-number":["F2022203089"]}],"id":[{"id":"10.13039\/501100003787","id-type":"DOI","asserted-by":"publisher"}]},{"name":"Science and Technology Project of Hebei Education Department","award":["BJK2022029"],"award-info":[{"award-number":["BJK2022029"]}]},{"name":"Science and Technology Project of Hebei Education Department","award":["QN2021145"],"award-info":[{"award-number":["QN2021145"]}]},{"name":"Innovation Capability Improvement Plan Project of Hebei Province","award":["22567637H"],"award-info":[{"award-number":["22567637H"]}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Int. J. Soft. Eng. Knowl. Eng."],"published-print":{"date-parts":[[2022,10]]},"abstract":"<jats:p> Software vulnerabilities are one of the roots of computer security problems. The traditional static analysis and dynamic analysis methods based on software source code mainly have some deficiencies, such as high false positive rate, high false negative rate and insufficient semantic information captured. Nevertheless, the application of machine learning, Natural Language Processing and other technologies in software vulnerability prediction can effectively mitigate such issues. This paper proposed a vulnerability prediction method based on multiple-level N-gram feature extraction and heterogeneous ensemble learning. First, by code intermediate representation and constructing a multiple-level N-gram feature generation model, two kinds of N-gram semantic features with different window size and different granularity at word and char level were extracted to retain the semantic and structural information of code. Second, TF\u2013IDF was used to construct the vector space model as the input of prediction model. As a single classifier was prone to overfitting and poor generalization, this paper conducted benchmark testing on five classical machine learning algorithms (NB, SVM, DT, LR, RF), and then combined four (SVM, DT, LR, RF) among them, which had better performance as the base classifiers to form the stacking heterogeneous ensemble method to build the vulnerability prediction model. Finally, the proposed method was verified on buffer overflow vulnerability and resource management vulnerability datasets, with a lowest false positive rate and false negative rate which can reach 1.58% and 4.06%, respectively. <\/jats:p>","DOI":"10.1142\/s0218194022500620","type":"journal-article","created":{"date-parts":[[2022,9,30]],"date-time":"2022-09-30T06:14:58Z","timestamp":1664518498000},"page":"1559-1582","source":"Crossref","is-referenced-by-count":5,"title":["Approach to Predict Software Vulnerability Based on Multiple-Level <i>N<\/i>-gram Feature Extraction and Heterogeneous Ensemble Learning"],"prefix":"10.1142","volume":"32","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-9867-8439","authenticated-orcid":false,"given":"Bing","family":"Zhang","sequence":"first","affiliation":[{"name":"School of Information Science and Engineering, Yanshan University, Qinhuangdao, P.\u00a0R.\u00a0China"},{"name":"The Key Laboratory of Software Engineering, Yanshan University, Qinhuangdao, P.\u00a0R.\u00a0China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Yuan","family":"Gao","sequence":"additional","affiliation":[{"name":"School of Information Science and Engineering, Yanshan University, Qinhuangdao, P.\u00a0R.\u00a0China"},{"name":"The Key Laboratory of Software Engineering, Yanshan University, Qinhuangdao, P.\u00a0R.\u00a0China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Jingyi","family":"Wu","sequence":"additional","affiliation":[{"name":"School of Information Science and Engineering, Yanshan University, Qinhuangdao, P.\u00a0R.\u00a0China"},{"name":"The Key Laboratory of Software Engineering, Yanshan University, Qinhuangdao, P.\u00a0R.\u00a0China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Ning","family":"Wang","sequence":"additional","affiliation":[{"name":"School of Information Science and Engineering, Yanshan University, Qinhuangdao, P.\u00a0R.\u00a0China"},{"name":"The Key Laboratory of Software Engineering, Yanshan University, Qinhuangdao, P.\u00a0R.\u00a0China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Qian","family":"Wang","sequence":"additional","affiliation":[{"name":"School of Information Science and Engineering, Yanshan University, Qinhuangdao, P.\u00a0R.\u00a0China"},{"name":"The Key Laboratory of Software Engineering, Yanshan University, Qinhuangdao, P.\u00a0R.\u00a0China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Jiadong","family":"Ren","sequence":"additional","affiliation":[{"name":"School of Information Science and Engineering, Yanshan University, Qinhuangdao, P.\u00a0R.\u00a0China"},{"name":"The Key Laboratory of Software Engineering, Yanshan University, Qinhuangdao, P.\u00a0R.\u00a0China"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"219","published-online":{"date-parts":[[2022,10,25]]},"reference":[{"key":"S0218194022500620BIB001","volume-title":"Principles of Program Analysis","author":"Nielson F.","year":"2015"},{"key":"S0218194022500620BIB002","first-page":"1066","volume-title":"2011 33rd Int. Conf. Software Engineering","author":"Cadar C.","year":"2011"},{"issue":"5","key":"S0218194022500620BIB003","doi-asserted-by":"crossref","first-page":"505","DOI":"10.1007\/s10009-007-0044-z","volume":"9","author":"Beyer D.","year":"2007","journal-title":"Int. J. Softw. Tools Technol. Transf."},{"key":"S0218194022500620BIB004","doi-asserted-by":"crossref","first-page":"497","DOI":"10.1109\/SP.2010.37","volume-title":"2010 IEEE Symp. Security and Privacy","author":"Wang T.","year":"2010"},{"issue":"3","key":"S0218194022500620BIB005","first-page":"137","volume":"28","author":"Dong G.","year":"2018","journal-title":"Comput. Technol. Dev."},{"key":"S0218194022500620BIB006","volume-title":"Elements of Software Science (Operating and Programming Systems Series)","author":"Halstead M. H.","year":"1977"},{"key":"S0218194022500620BIB007","doi-asserted-by":"publisher","DOI":"10.1109\/TSE.1976.233837"},{"key":"S0218194022500620BIB008","doi-asserted-by":"publisher","DOI":"10.1109\/32.544352"},{"key":"S0218194022500620BIB009","first-page":"41","volume-title":"AAAI-98 Workshop Learning for Text Categorization","author":"McCallum A.","year":"1998"},{"key":"S0218194022500620BIB010","doi-asserted-by":"publisher","DOI":"10.1109\/TSE.2007.256941"},{"key":"S0218194022500620BIB011","doi-asserted-by":"publisher","DOI":"10.1016\/j.jss.2007.07.040"},{"key":"S0218194022500620BIB012","doi-asserted-by":"crossref","first-page":"417","DOI":"10.1109\/ISSRE.2004.35","volume-title":"15th Int. Symp. Software Reliability Engineering","author":"Guo L.","year":"2004"},{"key":"S0218194022500620BIB013","first-page":"40","volume-title":"2015 20th Int. Conf. Engineering of Complex Computer Systems","author":"Zhang Y.","year":"2015"},{"issue":"279","key":"S0218194022500620BIB014","first-page":"89","volume":"38","author":"Wei S.","year":"2018","journal-title":"J. Beijing Univ. Technol."},{"key":"S0218194022500620BIB015","first-page":"23","volume-title":"2014 IEEE 25th Int. Symp. Software Reliability Engineering","author":"Walden J.","year":"2014"},{"issue":"18","key":"S0218194022500620BIB016","first-page":"1","volume":"2018","author":"Sun H.","year":"2018","journal-title":"J. Commun."},{"issue":"10","key":"S0218194022500620BIB017","doi-asserted-by":"crossref","first-page":"993","DOI":"10.1109\/TSE.2014.2340398","volume":"40","author":"Scandariato R.","year":"2014","journal-title":"IEEE Trans. Softw. Eng."},{"key":"S0218194022500620BIB018","first-page":"1","volume-title":"Proc. 6th Int. Workshop Security Measurements and Metrics","author":"Nguyen V. H.","year":"2010"},{"key":"S0218194022500620BIB019","first-page":"45","volume-title":"2017 IEEE 29th Int. Conf. Tools with Artificial Intelligence","author":"Phan A. V.","year":"2017"},{"key":"S0218194022500620BIB022","first-page":"543","volume-title":"2015 IEEE 14th Int. Conf. Machine Learning and Applications","author":"Pang Y.","year":"2015"},{"issue":"6","key":"S0218194022500620BIB023","doi-asserted-by":"crossref","first-page":"772","DOI":"10.1109\/TSE.2010.81","volume":"37","author":"Shin Y.","year":"2010","journal-title":"IEEE Trans. Softw. Eng."},{"key":"S0218194022500620BIB024","doi-asserted-by":"crossref","first-page":"590","DOI":"10.1109\/SP.2014.44","volume-title":"2014 IEEE Symp. Security and Privacy","author":"Yamaguchi F.","year":"2014"},{"key":"S0218194022500620BIB025","doi-asserted-by":"crossref","first-page":"67","DOI":"10.1016\/j.jss.2017.11.001","volume":"137","author":"Yan R.","year":"2018","journal-title":"J. Syst. Softw."},{"key":"S0218194022500620BIB027","first-page":"476","volume-title":"2016 15th IEEE Int. Conf. Machine Learning and Applications","author":"Pang Y.","year":"2016"},{"issue":"5199","key":"S0218194022500620BIB028","doi-asserted-by":"crossref","first-page":"843","DOI":"10.1126\/science.267.5199.843","volume":"267","author":"Damashek M.","year":"1995","journal-title":"Science"},{"issue":"1","key":"S0218194022500620BIB029","doi-asserted-by":"crossref","first-page":"48","DOI":"10.1145\/951787.951766","volume":"10","author":"Salton G.","year":"1973","journal-title":"ACM SIGPLAN Not."},{"key":"S0218194022500620BIB030","doi-asserted-by":"publisher","DOI":"10.1016\/S0893-6080(05)80023-1"},{"issue":"06","key":"S0218194022500620BIB034","first-page":"167","volume":"29","author":"Shi C.","year":"2009","journal-title":"Comput. Appl."},{"issue":"2","key":"S0218194022500620BIB035","doi-asserted-by":"crossref","first-page":"157","DOI":"10.1002\/sim.2929","volume":"27","author":"Pencina M. J.","year":"2008","journal-title":"Stat. Med."},{"key":"S0218194022500620BIB036","first-page":"1137","volume-title":"Proc. 14th Int. Joint Conf. Artificial Intelligence","author":"Kohavi R.","year":"1995"}],"container-title":["International Journal of Software Engineering and Knowledge Engineering"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.worldscientific.com\/doi\/pdf\/10.1142\/S0218194022500620","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2022,11,24]],"date-time":"2022-11-24T03:13:23Z","timestamp":1669259603000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.worldscientific.com\/doi\/10.1142\/S0218194022500620"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2022,10]]},"references-count":30,"journal-issue":{"issue":"10","published-print":{"date-parts":[[2022,10]]}},"alternative-id":["10.1142\/S0218194022500620"],"URL":"https:\/\/doi.org\/10.1142\/s0218194022500620","relation":{},"ISSN":["0218-1940","1793-6403"],"issn-type":[{"value":"0218-1940","type":"print"},{"value":"1793-6403","type":"electronic"}],"subject":[],"published":{"date-parts":[[2022,10]]}}}