A Systematic Mapping Study of the Advancement in Software Vulnerability Forecasting

Developing software securely remains a challenge even with great advancements made in AI, vulnerability databases, dynamic and static code analysis. Research into aspects of detecting, identifying, and refactoring vulnerabilities has shown promise, but further work is needed throughout all stages of the software development lifecycle. We will show that current research suffers from a lack of focus on forecasting where vulnerabilities will occur. Investigations into predicting vulnerabilities in a reliable, scalable way provide developers with insights that could prevent security failures in the future. Increasing software security is an initiative which can aid efforts from national security to saving lives affected by hospital ransomware attacks. Through our first questions, we seek to provide an overview of the vulnerabilities that current researchers are targeting and the methods they use to uncover them. Subsequently, we investigated the fields of impact that the research is contributing to and look for unique contributions. As this paper shows, wide distribution coupled with poor security practices has increased the attack angles available to malicious actors and is statistically linked with increased vulnerabilities. We argue that combinations of automated and manual techniques are necessary to achieve more impactful and adaptable methods to increase security in software development.