We evaluate two approaches namely, text feature-based approach and regular expression-based approach to automatically identify bug reports that include vulnerability dis-covery strategies. We observe the Gentoo, LibreOffice, and Mozilla bug reports to include vulnerability discovery strategies. Using text feature-based prediction models, we observe the highest prediction per-formance for the Mozilla dataset with a recall of 0.78. Using the regular expression-based approach we observe recall to be 0.83 for the same dataset. Findings from our paper provide the ground-work for cybersecurity researchers to use OSS bug reports as a data source for advancing the science of vulnerabilities.

Raunak Shakya is a graduate student at the Department of Computer Science, Tennessee Technological University, currently working towards a MS in Computer Science. He graduated with a Bachelor's degree in Engineering from Institute of Engineering, Tribhuvan University, Nepal in 2013. Then he worked as a software developer for more than three and a half years in various software companies based in my hometown Kathmandu, Nepal. His areas of interest include (but not limited to) software engineering, machine learning, data analysis, web application development and business and finance.