What is it about?
Software security tools often identify more potential vulnerabilities than available resources allow teams to investigate. This study examines how to prioritize suspicious code candidates under a fixed investigation budget. We compare heuristic and machine-learning scoring methods, combined with a selection policy that distributes candidates across programs. Experiments on Java security benchmarks show that prioritization can improve coverage of known vulnerable cases compared with random selection. Selected candidates remain targets for further investigation rather than confirmed vulnerabilities.
Featured Image
Photo by Julio Lopez on Unsplash
Why is it important?
Effective security analysis requires not only identifying potential problems but also deciding where to allocate limited investigation effort. Selecting candidates solely by score can concentrate attention on a small number of programs. Our results demonstrate the value of considering both candidate scores and program diversity, while highlighting trade-offs between coverage and precision. These findings inform the design of resource-constrained security analysis workflows.
Perspectives
This work examines an often-overlooked decision in vulnerability analysis: which preliminary candidates should receive further investigation? We separate candidate scoring from budgeted selection to study how each influences the resulting worklist. The findings suggest that allocation decisions deserve attention alongside scoring accuracy. Further research is needed to establish whether these improvements in benchmark coverage translate into more confirmed vulnerability discoveries in practice.
Xinye Zhao
University of Notre Dame
Read the Original
This page is a summary of: Towards Budget-Aware Early Candidate Selection for Vulnerability Analysis, October 2026, ACM (Association for Computing Machinery),
DOI: 10.1145/3842650.3843175.
You can read the full text:
Contributors
The following have contributed to this page
