The Secret Life of CVEs

2023-05-01

IEEE Working Conference on Mining Software Repositories

AI Summary

This study investigates the vulnerability lifetime—the time interval from CVE disclosure to patching—in software projects, systematically analyzing how programming language choice, project characteristics, and intrinsic CVE attributes influence repair latency. Methodologically, it pioneers the application of survival analysis (Cox proportional hazards modeling and Kaplan–Meier estimation) to CVE lifecycle modeling, integrating large-scale CVE databases with cross-language and cross-project feature engineering to uncover nonlinear effects of multidimensional risk factors. Results demonstrate that memory-safe languages (e.g., Rust), highly active maintenance projects, and higher CVSS severity scores significantly accelerate patching. The proposed model achieves substantially improved prediction accuracy over baseline approaches. This work contributes an interpretable, reusable, empirically grounded framework—supported by quantitative evidence—for prioritizing vulnerability response efforts in practice.

Technology Category

• Computer Vision: Language and Vision
• Planning, Routing, and Scheduling: Replanning and Plan Repair
• Natural Language Processing: Safety and Robustness

Application Category

• Security and Privacy: Large-scale security measurements
• User Modeling, Personalization and Recommendation: Attacks and countermeasures in recommendation systems
• Graph Algorithms and Modeling for the Web: Foundation models and LLMs for Web-related graphs

Abstract

The Common Vulnerabilities and Exposures (CVEs) system is a reference method for documenting publicly known information security weaknesses and exposures. This paper presents a study of the lifetime of CVEs in software projects and the risk factors affecting their existence. The study uses survival analysis to examine how features of programming languages, projects, and CVEs themselves impact the lifetime of CVEs. We suggest avenues for future research to investigate the effect of various factors on the resolution of vulnerabilities.

Problem

• Analyzing CVE lifetime in software projects
• Identifying risk factors affecting vulnerability existence
• Investigating programming language impact on CVE resolution

Innovation

• Survival analysis for CVE lifetime study
• Examining programming language impact on CVEs
• Investigating project features affecting vulnerability resolution