Shifting Left for Machine Learning: An Empirical Study of Security Weaknesses in Supervised Learning-based Projects

Farzana Ahamed Bhuiyan; Stacy Prowell; Hossain Shahriar; Fan Wu; Akond Rahman

doi:10.1109/COMPSAC54236.2022.00130

Shifting Left for Machine Learning: An Empirical Study of Security Weaknesses in Supervised Learning-based Projects

Farzana Ahamed Bhuiyan, Stacy Prowell, Hossain Shahriar, Fan Wu, Akond Rahman

Energy and Control Systems Security

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › peer-review

1 Scopus citations

Abstract

Context: Supervised learning-based projects (SLPs), i.e., software projects that use supervised learning algorithms, such as decision trees are useful for performing classification-related tasks. Yet, security weaknesses, such as the use of hard-coded passwords in SLPs, can make SLPs susceptible to security attacks. A characterization of security weaknesses in SLPs can help practitioners understand the security weaknesses that are frequent in SLPs and adopt adequate mitigation strategies. Objective: The goal of this paper is to help practitioners se-curely develop supervised learning-based projects by conducting an empirical study of security weaknesses in supervised learning-based projects. Methodology: We conduct an empirical study by quantifying the frequency of security weaknesses in 278 open source SLPs. Results: We identify 22 types of security weaknesses that occur in SLPs. We observe 'use of potentially dangerous function' to be the most frequently occurring security weakness in SLPs. Of the identified 3,964 security weaknesses, 23.79 % and 40.49 % respectively, appear for source code files used to train and test models. We also observe evidence of co-location, e.g., instances of command injection co-locates with instances of potentially dangerous function. Conclusion: Based on our findings, we advocate for a shift left approach for SLP development with security-focused code reviews, and application of security static analysis.

Original language	English
Title of host publication	Proceedings - 2022 IEEE 46th Annual Computers, Software, and Applications Conference, COMPSAC 2022
Editors	Hong Va Leong, Sahra Sedigh Sarvestani, Yuuichi Teranishi, Alfredo Cuzzocrea, Hiroki Kashiwazaki, Dave Towey, Ji-Jiang Yang, Hossain Shahriar
Publisher	Institute of Electrical and Electronics Engineers Inc.
Pages	798-808
Number of pages	11
ISBN (Electronic)	9781665488105
DOIs	https://doi.org/10.1109/COMPSAC54236.2022.00130
State	Published - 2022
Event	46th IEEE Annual Computers, Software, and Applications Conference, COMPSAC 2022 - Virtual, Online, United States Duration: Jun 27 2022 → Jul 1 2022

Publication series

Name	Proceedings - 2022 IEEE 46th Annual Computers, Software, and Applications Conference, COMPSAC 2022

Conference

Conference	46th IEEE Annual Computers, Software, and Applications Conference, COMPSAC 2022
Country/Territory	United States
City	Virtual, Online
Period	06/27/22 → 07/1/22

Funding

We thank the PASER group at Tennessee Tech University for their valuable feedback. The research was partially funded by the U.S. National Science Foundation (NSF) award # 2026869. This manuscript has been partially authored by UTBattelle, LLC, under contract DE-AC05-00OR22725 with the US Department of Energy (DOE). The US government retains and the publisher, by accepting the article for publication, acknowledges that the US government retains a nonexclusive, paid-up, irrevocable, worldwide license to publish or reproduce the published form of this manuscript, or allow others to do so, for US government purposes. DOE will provide public access to these results of federally sponsored research in accordance with the DOE Public Access Plan. We thank the PASER group at Tennessee Tech University for their valuable feedback. The research was partially funded by the U.S. National Science Foundation (NSF) award # 2026869. This manuscript has been partially authored by UT-Battelle, LLC, under contract DE-AC05-00OR22725 with the US Department of Energy (DOE). The US government retains and the publisher, by accepting the article for publication, acknowledges that the US government retains a nonexclusive, paid-up, irrevocable, worldwide license to publish or reproduce the published form of this manuscript, or allow others to do so, for US government purposes. DOE will provide public access to these results of federally sponsored research in accordance with the DOE Public Access Plan.

Keywords

security weakness
supervised machine learning

Access to Document

10.1109/COMPSAC54236.2022.00130

Cite this

Bhuiyan, F. A., Prowell, S., Shahriar, H., Wu, F., & Rahman, A. (2022). Shifting Left for Machine Learning: An Empirical Study of Security Weaknesses in Supervised Learning-based Projects. In H. Va Leong, S. S. Sarvestani, Y. Teranishi, A. Cuzzocrea, H. Kashiwazaki, D. Towey, J.-J. Yang, & H. Shahriar (Eds.), Proceedings - 2022 IEEE 46th Annual Computers, Software, and Applications Conference, COMPSAC 2022 (pp. 798-808). (Proceedings - 2022 IEEE 46th Annual Computers, Software, and Applications Conference, COMPSAC 2022). Institute of Electrical and Electronics Engineers Inc.. https://doi.org/10.1109/COMPSAC54236.2022.00130

Bhuiyan, Farzana Ahamed ; Prowell, Stacy ; Shahriar, Hossain et al. / Shifting Left for Machine Learning : An Empirical Study of Security Weaknesses in Supervised Learning-based Projects. Proceedings - 2022 IEEE 46th Annual Computers, Software, and Applications Conference, COMPSAC 2022. editor / Hong Va Leong ; Sahra Sedigh Sarvestani ; Yuuichi Teranishi ; Alfredo Cuzzocrea ; Hiroki Kashiwazaki ; Dave Towey ; Ji-Jiang Yang ; Hossain Shahriar. Institute of Electrical and Electronics Engineers Inc., 2022. pp. 798-808 (Proceedings - 2022 IEEE 46th Annual Computers, Software, and Applications Conference, COMPSAC 2022).

@inproceedings{292dcbd2fd2e40e8aa9ad55322b9f7ba,

title = "Shifting Left for Machine Learning: An Empirical Study of Security Weaknesses in Supervised Learning-based Projects",

abstract = "Context: Supervised learning-based projects (SLPs), i.e., software projects that use supervised learning algorithms, such as decision trees are useful for performing classification-related tasks. Yet, security weaknesses, such as the use of hard-coded passwords in SLPs, can make SLPs susceptible to security attacks. A characterization of security weaknesses in SLPs can help practitioners understand the security weaknesses that are frequent in SLPs and adopt adequate mitigation strategies. Objective: The goal of this paper is to help practitioners se-curely develop supervised learning-based projects by conducting an empirical study of security weaknesses in supervised learning-based projects. Methodology: We conduct an empirical study by quantifying the frequency of security weaknesses in 278 open source SLPs. Results: We identify 22 types of security weaknesses that occur in SLPs. We observe 'use of potentially dangerous function' to be the most frequently occurring security weakness in SLPs. Of the identified 3,964 security weaknesses, 23.79 % and 40.49 % respectively, appear for source code files used to train and test models. We also observe evidence of co-location, e.g., instances of command injection co-locates with instances of potentially dangerous function. Conclusion: Based on our findings, we advocate for a shift left approach for SLP development with security-focused code reviews, and application of security static analysis.",

keywords = "security weakness, supervised machine learning",

author = "Bhuiyan, {Farzana Ahamed} and Stacy Prowell and Hossain Shahriar and Fan Wu and Akond Rahman",

note = "Publisher Copyright: {\textcopyright} 2022 IEEE.; 46th IEEE Annual Computers, Software, and Applications Conference, COMPSAC 2022 ; Conference date: 27-06-2022 Through 01-07-2022",

year = "2022",

doi = "10.1109/COMPSAC54236.2022.00130",

language = "English",

series = "Proceedings - 2022 IEEE 46th Annual Computers, Software, and Applications Conference, COMPSAC 2022",

publisher = "Institute of Electrical and Electronics Engineers Inc.",

pages = "798--808",

editor = "{Va Leong}, Hong and Sarvestani, {Sahra Sedigh} and Yuuichi Teranishi and Alfredo Cuzzocrea and Hiroki Kashiwazaki and Dave Towey and Ji-Jiang Yang and Hossain Shahriar",

booktitle = "Proceedings - 2022 IEEE 46th Annual Computers, Software, and Applications Conference, COMPSAC 2022",

}

Bhuiyan, FA, Prowell, S, Shahriar, H, Wu, F & Rahman, A 2022, Shifting Left for Machine Learning: An Empirical Study of Security Weaknesses in Supervised Learning-based Projects. in H Va Leong, SS Sarvestani, Y Teranishi, A Cuzzocrea, H Kashiwazaki, D Towey, J-J Yang & H Shahriar (eds), Proceedings - 2022 IEEE 46th Annual Computers, Software, and Applications Conference, COMPSAC 2022. Proceedings - 2022 IEEE 46th Annual Computers, Software, and Applications Conference, COMPSAC 2022, Institute of Electrical and Electronics Engineers Inc., pp. 798-808, 46th IEEE Annual Computers, Software, and Applications Conference, COMPSAC 2022, Virtual, Online, United States, 06/27/22. https://doi.org/10.1109/COMPSAC54236.2022.00130

Shifting Left for Machine Learning: An Empirical Study of Security Weaknesses in Supervised Learning-based Projects. / Bhuiyan, Farzana Ahamed; Prowell, Stacy; Shahriar, Hossain et al.
Proceedings - 2022 IEEE 46th Annual Computers, Software, and Applications Conference, COMPSAC 2022. ed. / Hong Va Leong; Sahra Sedigh Sarvestani; Yuuichi Teranishi; Alfredo Cuzzocrea; Hiroki Kashiwazaki; Dave Towey; Ji-Jiang Yang; Hossain Shahriar. Institute of Electrical and Electronics Engineers Inc., 2022. p. 798-808 (Proceedings - 2022 IEEE 46th Annual Computers, Software, and Applications Conference, COMPSAC 2022).

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › peer-review

TY - GEN

T1 - Shifting Left for Machine Learning

T2 - 46th IEEE Annual Computers, Software, and Applications Conference, COMPSAC 2022

AU - Bhuiyan, Farzana Ahamed

AU - Prowell, Stacy

AU - Shahriar, Hossain

AU - Wu, Fan

AU - Rahman, Akond

PY - 2022

Y1 - 2022

N2 - Context: Supervised learning-based projects (SLPs), i.e., software projects that use supervised learning algorithms, such as decision trees are useful for performing classification-related tasks. Yet, security weaknesses, such as the use of hard-coded passwords in SLPs, can make SLPs susceptible to security attacks. A characterization of security weaknesses in SLPs can help practitioners understand the security weaknesses that are frequent in SLPs and adopt adequate mitigation strategies. Objective: The goal of this paper is to help practitioners se-curely develop supervised learning-based projects by conducting an empirical study of security weaknesses in supervised learning-based projects. Methodology: We conduct an empirical study by quantifying the frequency of security weaknesses in 278 open source SLPs. Results: We identify 22 types of security weaknesses that occur in SLPs. We observe 'use of potentially dangerous function' to be the most frequently occurring security weakness in SLPs. Of the identified 3,964 security weaknesses, 23.79 % and 40.49 % respectively, appear for source code files used to train and test models. We also observe evidence of co-location, e.g., instances of command injection co-locates with instances of potentially dangerous function. Conclusion: Based on our findings, we advocate for a shift left approach for SLP development with security-focused code reviews, and application of security static analysis.

AB - Context: Supervised learning-based projects (SLPs), i.e., software projects that use supervised learning algorithms, such as decision trees are useful for performing classification-related tasks. Yet, security weaknesses, such as the use of hard-coded passwords in SLPs, can make SLPs susceptible to security attacks. A characterization of security weaknesses in SLPs can help practitioners understand the security weaknesses that are frequent in SLPs and adopt adequate mitigation strategies. Objective: The goal of this paper is to help practitioners se-curely develop supervised learning-based projects by conducting an empirical study of security weaknesses in supervised learning-based projects. Methodology: We conduct an empirical study by quantifying the frequency of security weaknesses in 278 open source SLPs. Results: We identify 22 types of security weaknesses that occur in SLPs. We observe 'use of potentially dangerous function' to be the most frequently occurring security weakness in SLPs. Of the identified 3,964 security weaknesses, 23.79 % and 40.49 % respectively, appear for source code files used to train and test models. We also observe evidence of co-location, e.g., instances of command injection co-locates with instances of potentially dangerous function. Conclusion: Based on our findings, we advocate for a shift left approach for SLP development with security-focused code reviews, and application of security static analysis.

KW - security weakness

KW - supervised machine learning

UR - http://www.scopus.com/inward/record.url?scp=85136993161&partnerID=8YFLogxK

U2 - 10.1109/COMPSAC54236.2022.00130

DO - 10.1109/COMPSAC54236.2022.00130

M3 - Conference contribution

AN - SCOPUS:85136993161

T3 - Proceedings - 2022 IEEE 46th Annual Computers, Software, and Applications Conference, COMPSAC 2022

SP - 798

EP - 808

BT - Proceedings - 2022 IEEE 46th Annual Computers, Software, and Applications Conference, COMPSAC 2022

A2 - Va Leong, Hong

A2 - Sarvestani, Sahra Sedigh

A2 - Teranishi, Yuuichi

A2 - Cuzzocrea, Alfredo

A2 - Kashiwazaki, Hiroki

A2 - Towey, Dave

A2 - Yang, Ji-Jiang

A2 - Shahriar, Hossain

PB - Institute of Electrical and Electronics Engineers Inc.

Y2 - 27 June 2022 through 1 July 2022

ER -

Bhuiyan FA, Prowell S, Shahriar H, Wu F, Rahman A. Shifting Left for Machine Learning: An Empirical Study of Security Weaknesses in Supervised Learning-based Projects. In Va Leong H, Sarvestani SS, Teranishi Y, Cuzzocrea A, Kashiwazaki H, Towey D, Yang JJ, Shahriar H, editors, Proceedings - 2022 IEEE 46th Annual Computers, Software, and Applications Conference, COMPSAC 2022. Institute of Electrical and Electronics Engineers Inc. 2022. p. 798-808. (Proceedings - 2022 IEEE 46th Annual Computers, Software, and Applications Conference, COMPSAC 2022). doi: 10.1109/COMPSAC54236.2022.00130

Shifting Left for Machine Learning: An Empirical Study of Security Weaknesses in Supervised Learning-based Projects

Abstract

Publication series

Conference

Funding

Keywords

Access to Document

Other files and links

Fingerprint

Cite this