# Security Monitoring during Software Development:
## 2 Related Work  
White box testing techniques, and particularly static code analysis, have been found effective in identifying security issues (i.e., vulnerabilities) that reside in the source code of software products [30, 31, 32]. Several individual static analysis tools and broader static analysis platforms have been proposed over the years, which are able to detect specific types of security issues among other bugs (e.g., [33]). Static analysis tools process the source code of the analyzed software in an attempt to find predefined patterns that indicate the existence of vulnerabilities. In order to identify potential security weaknesses, they apply a wide range of analysis techniques ranging from simple text processing and pattern matching with the use of regular expressions, to more advanced graph-based techniques such as Abstract Syntax Trees (ASTs), Data-Flow Graphs (DFGs), Control-Flow Graphs (CFGs), and Code-Property Graphs (CPGs), in which they traverse the graphs searching for violations of specific rules or the existence of known vulnerability patterns. The output of these tools is a list of warnings (i.e., alerts) that indicate a potential security issue, providing relevant information about the issue, including its type, severity, and location in the source code. A known shortcoming of existing static code analyzers, which is known to hinder their wider adoption in practice, is the generation of long lists of raw warnings [34, 35, 36]. These warnings, although they contain important information for the security of the analyzed software, are in a raw form that is highly difficult to be comprehended by non-technical experts such as project managers [31, 34]. Hence, appropriate techniques are required on top of the results of static analysis, in order to facilitate decision-making during software development [13, 37]. Particularly, the results of static analysis could be leveraged for conducting quantitative security evaluation, providing high-level security metrics, which are easier to understand than the low-level warnings and can reflect important security aspects of the analyzed software. Several models and techniques have been proposed in the past years for providing quantitative security evaluation of software products based on the results of static analysis, demonstrating promising results [14, 15, 16, 17, 18]. However, none of the existing and widely used static analysis tools and platforms provide such quantitative evaluation models and techniques. They use only visualization techniques in order to provide more intuitive summaries of the identified security issues, but they do not provide high-level security metrics that reflect important aspects of the security of the analyzed software (e.g., Confidentiality, Integrity, Availability, etc.). Apart from quantitative security assessment, the results of the white box testing of a software product's source code can be leveraged for providing other advanced security monitoring mechanisms. One such mechanism that has recently attracted the attention of the research community is vulnerability prediction. Vulnerability prediction focuses on predicting the existence of vulnerabilities in software applications, and in fact, software components. It is based on the construction of vulnerability prediction models (VPMs), which are machine learning (ML) models that are able to predict whether a given software component may contain vulnerabilities or not [19, 38, 39]. Several models have been proposed over the years, utilizing various software-related attributes as input features (i.e., predictors), including software metrics [19, 20, 21] and text features [22, 23, 24, 25, 26, 27, 28, 29]. Among them, the text-mining-based VPMs have demonstrated the most promising results (i.e., highest predictive performance).