# Security Monitoring during Software Development:
## 2 Related Work
Initially, text-mining-based VPMs were based on simple ML models text mining techniques such as Bag of Words (BoW) [22], whereas recently, more advanced techniques have been utilized, including Convolutional Neural Networks (CNNs) and Long Short-Term Memory (LSTM) models that use sequences of tokens along with their word embedding numerical representation as input [23, 24, 25]. Recently, emphasis has been given to transformer-based pre-trained models, such as GPT and BERT [26, 27, 28], in which we have provided some contribution which will be integrated into the broader VM4 SEC platform [29]. Despite their importance in security monitoring, no operationalized VPMs can be found neither in the literature nor on the market, either standalone or as part of existing security analysis tools and platforms. For better understanding of the main novelty of the VM4 SEC platform, in Table 1, a comparison between existing widely used static analysis platforms and our VM4 SEC platform is provided. In particular, we compare the VM4 SEC platform with SonarQube ([[https://www.sonarsource.com/products/sonarqube/](https://www.sonarsource.com/products/sonarqube/)]([https://www.sonarsource.com/products/sonarqube/](https://www.sonarsource.com/products/sonarqube/)), accessed on 5 June 2023), Coverity ([[https://scan.coverity.com/](https://scan.coverity.com/)]([https://scan.coverity.com/](https://scan.coverity.com/)), accessed on 5 June 2023), and Fortify ([[https://www.microfocus.com/en-us/cyberres/application-security](https://www.microfocus.com/en-us/cyberres/application-security)]([https://www.microfocus.com/en-us/cyberres/application-security](https://www.microfocus.com/en-us/cyberres/application-security)), accessed on 5 June 2023), which are popular static code analyzers known to be able to detect security issues. As can be seen by Table 1, existing ASA platforms provide identification of security-related bugs and visualization of the analysis results in a more meaningful and easy-to-understand way. However, none of the ASA platforms provide high-level security metrics, nor a quantitative estimation of the overall security of a given software application, which is important for security monitoring and decision-making during the overall software development lifecycle of a given software product. In addition to this, none of the existing platforms provide vulnerability prediction models, and, to the best of our knowledge, no operational VPM exists on the market which can be used directly for analyzing a given software application. To the best of our knowledge, VM4 SEC is the only platform available that provides a high-level quantification of the security level of a given software product based on state-of-the-art software security evaluation models, as well as the only platform that provides ready-to-use text-mining-based VPMs. _It should be noted that since the VM4 SEC is based on static analysis, the other three platforms could be used as input for the VM4 SEC platform for providing its high-level security metrics, as well as for the VPMs. Hence, it can be also viewed as an extension of existing ASA platforms, providing additional and high-level functionality. In other words, the VM4 SEC can be used complementarily with these static analysis platforms, in order to leverage their security issue identification capabilities and enhance their functionality by providing high-level security measures and vulnerability predictions._  
Finally, it should be noted that novel security monitoring solutions such as quantitative security assessment mechanisms and vulnerability prediction models require being properly configured and adapted in order to be utilized in practice. For instance, quantitative security assessment mechanisms should be calibrated properly in order to identify specific types of security issues and compute security metrics that are more relevant and of high importance for a specific company and/or application domain.