# Collecting Vulnerable Source Code from Open-Source Repositories for Dataset Generation
###### Abstract  
Different Machine Learning techniques to detect software vulnerabilities have emerged in scientific and industrial scenarios. Different actors in these scenarios aim to develop algorithms for predicting security threats without requiring human intervention. However, these algorithms require data-driven engines based on the processing of huge amounts of data, known as datasets. This paper introduces the SonarCloud Vulnerable Code Prospector for C (SVCP4C). This tool aims to collect vulnerable source code from open source repositories linked to SonarCloud, an online tool that performs static analysis and tags the potentially vulnerable code. The tool provides a set of tagged files suitable for extracting features and creating training datasets for Machine Learning algorithms. This study presents a descriptive analysis of these files and overviews current status of C vulnerabilities, specifically buffer overflow, in the reviewed public repositories. v 20202019; Accepted: 7 February 2020; Published: 13 February  
the corresponding low-level security checks. One example of this are array and pointer references. None of them are automatically bounds-checked, therefore relegating security to the programmer's skills. Besides, many of the standard C library functions such as gets(), scan() or strcpy() are vulnerable [12; 13; 14]. Although C is one unsafe programming language whose misuse could lead to buffer overflows, it is not the only one. Buffer overflow vulnerabilities occur in languages that provide no built-in protection against out of bounds memory accesses such as C++ [15]. This leaves us with a single and clear conclusion: buffer overflow is still an ever-present vulnerability and it seriously jeopardizes security. Prevention and defensive mechanisms are much needed to deal with such a menace to security. Techniques and tools, such as manual audition of code, static analyzers, compiler, and hardware modifications or dynamic analyzers, have been proposed for years. Manual audit of code to find vulnerabilities is a challenging, error-prone, and time-consuming task. Besides, it relies on people trained enough to efficiently detect vulnerabilities, which is equally demanding [16]. However, manually reviewing the code can be complemented with static analyzers, which automatically identify potential security holes. One such static analyzer is SonarCloud ([[https://sonarcloud.io/about](https://sonarcloud.io/about)]([https://sonarcloud.io/about](https://sonarcloud.io/about))), a platform that helps developers write secure and clean code. It supports many different languages, and it is free when the project under analysis is open source. There are many other static analyzers, such as ITS4, a static C, and C++ source code scanner that splits the code into lexical tokens for further application of pattern matching [17]. The MIT Lincoln Laboratory exhaustively tested several static analyzers in order to measure their performance and accuracy rates [18]. Their conclusion is that further work is needed toward static detection of buffer overflow. Some static analysis tools can detect in-the-wild buffer overflows but are disappointing because false alarm rates are high and discrimination is poor. Another way of preventing buffer overflows is writing code in programming languages that natively perform bounds-checking, such as Java or Pascal. These languages, however, lack low-level manipulation. With these limitations in mind, researchers have developed \"safe dialects of C\" that natively perform several security procedures such as controlled access to memory, strong object-typing, and bounds-checking. Unfortunately, security operations like bounds-checking generate up to 100% overhead [19]. Another approach consists of re-compiling the source code with security-aware modified compilers. StackGuard is one example of such modifications. It prevents stack-based buffer-overflow attacks by inserting canaries into the stack [9].