  Vulnerability prediction refers to the problem of identifying the system
components that are most likely to be vulnerable based on the information
gained from historical data. Typically, vulnerability prediction is performed
using manually identified features that are potentially linked with vulnerable
code. Unfortunately, recent studies have shown that existing approaches are
ineffective when evaluated in realistic settings due to some unavoidable noise
included in the historical data. To deal with this issue, we develop a
prediction method using the encoder-decoder framework of machine translation
that automatically learns the latent features (context, patterns, etc.) of code
that are linked with vulnerabilities. The key idea of our approach is to learn
from things we know, the past vulnerability fixes and their context. We
evaluate our approach by comparing it with existing techniques on available
releases of the three security-critical open source systems (Linux Kernel,
OpenSSL, and Wireshark) with historical vulnerabilities that have been reported
in the National Vulnerability Database (NVD). Our evaluation demonstrates that
the prediction capability of our approach significantly outperforms the
state-of-the-art vulnerability prediction techniques (Software Metrics,
Imports, Function Calls, and Text Mining) in both recall and precision values
(yielding 4.7 times higher MCC values) under realistic training setting.
