# Security Monitoring during Software Development:
## 3 Methodology
### Configuration of the Core Security Monitoring Mechanisms
#### 3.3.2 Vulnerability Prediction  
As the second core security monitoring mechanism of the VM4 SEC platform, we will deploy a novel mechanism that enables the early identification of security vulnerabilities in software systems. In particular, we will utilize the models that were initially examined by [PERSON] et al. [51] and were extended in [52]. These deep learning models are based on text mining methods and use textual software attributes extracted from the source code in order to predict which software components of an analyzed application are most likely to contain vulnerabilities. An overview of the utilized vulnerability prediction model is illustrated in Figure 14.  
As can be seen in Figure 14, the source code of the analyzed software component is provided as input to the system. First, the tool applies text mining to extract the software attributes of the software component and then it tokenizes it to produce sequences of tokens. Then the token sequences are encoded in numerical vectors, which are called embedding vectors, through a sophisticated external algorithm entitled word2 vec [53]. Subsequently, the embedding vectors are passed to the embedding layer of the neural network and then to the hidden layers of a convolutional neural network (CNN). Through hyperparameter tuning, the optimal prediction model is generated. Hence, when a new software component is analyzed, the vulnerability predictor can classify it as vulnerable or not based on what it has learned. In order to construct a vulnerability prediction model that could satisfy the Company's security needs (as reported by the industrial study presented in Section 3.1.1), we created, with the collaboration of a group of Company's developers, a vulnerability dataset and then we trained and validated our model on this dataset. For the dataset construction, we followed the approach of searching those commits that fix a vulnerability in Company's projects [54; 55; 56] that are stored in GitHub repositories. To be precise, Company's GitHub projects were collected and then the history of commits to each of them was searched. The search was based on finding certain combinations of keywords within the message accompanying each commit, e.g., \"vulnerability repair\", \"dos repair\", \"dos prevention\", \"exploit prevention\", \"fix CWE\", etc. In Figure 15, we provide an overview of the implemented tool. As can be seen in Figure 15, the source of the dataset is the GitHub software repository. The tool consists of three main functionalities:  
* **GitHubCrawler**: Collects software projects from GitHub for a selected programming language (i.e., Java in our case). * **CommitCrawler**: Receives the list of software projects and obtains for each project the history of commits. Each commit is accompanied by a message where the developer states the reason for making the particular commit. CommitCrawler searches these messages for specific predefined combinations of keywords indicating changes in order to fix vulnerabilities. * **CommitCloner**: Downloads the source code of the parent version of the files that underwent changes in each selected commit, and downloads also the latest version of the software projects (where no vulnerability has been found yet). Figure 14: An overview of the text-mining-based VM4 SEC vulnerability prediction model. Figure 15: Overview of the construction of the VM4 SEC knowledge base. These two sets of Java files that are downloaded by the _CommitCloner_ constitute the VM4 SEC Vulnerability Knowledge Base. The tokenized code of these Java files can be formatted into two different ways: (1) bag of words and (2) sequences of tokens. In the former, code is represented as a set of words/tokens along with their number of occurrences in the code, whereas in the latter, code is represented as sequences of words/tokens in the same order that they appear in the actual source code.