|
@@ -6,7 +6,7 @@ import sys
|
|
import os
|
|
import os
|
|
from pymongo import MongoClient
|
|
from pymongo import MongoClient
|
|
#mongodb assumes database at default path
|
|
#mongodb assumes database at default path
|
|
-import logging, sys
|
|
|
|
|
|
+import logging
|
|
import configparser
|
|
import configparser
|
|
import json
|
|
import json
|
|
import csv
|
|
import csv
|
|
@@ -19,7 +19,7 @@ import numpy as np
|
|
from dateutil import parser
|
|
from dateutil import parser
|
|
import plotly.plotly as py
|
|
import plotly.plotly as py
|
|
import plotly.graph_objs as go
|
|
import plotly.graph_objs as go
|
|
-import lstm_reg as lstm
|
|
|
|
|
|
+#import lstm_reg as lstm
|
|
import metadata as meta
|
|
import metadata as meta
|
|
import deps
|
|
import deps
|
|
import psycopg2
|
|
import psycopg2
|
|
@@ -27,7 +27,10 @@ import powerlaw as pl
|
|
import DLAmine as dla
|
|
import DLAmine as dla
|
|
import pickle
|
|
import pickle
|
|
import paper_plots as carlosplt
|
|
import paper_plots as carlosplt
|
|
|
|
+import stat_tests as stats
|
|
from matplotlib2tikz import save as tikz_save
|
|
from matplotlib2tikz import save as tikz_save
|
|
|
|
+import prediction as pred
|
|
|
|
+import scipy.stats as stats
|
|
|
|
|
|
logging.basicConfig(stream=sys.stderr, level=logging.DEBUG)
|
|
logging.basicConfig(stream=sys.stderr, level=logging.DEBUG)
|
|
## Increase the recursion limit by much to allow bs to parse large files
|
|
## Increase the recursion limit by much to allow bs to parse large files
|
|
@@ -119,6 +122,7 @@ def load_DBs():
|
|
src2sloccount = dict()
|
|
src2sloccount = dict()
|
|
src2pop = dict()
|
|
src2pop = dict()
|
|
src2deps = dict()
|
|
src2deps = dict()
|
|
|
|
+ pkg_with_cvss = dict()
|
|
|
|
|
|
cache = config['DIR']['cache_dir']
|
|
cache = config['DIR']['cache_dir']
|
|
|
|
|
|
@@ -166,6 +170,13 @@ def load_DBs():
|
|
except (IOError, ValueError):
|
|
except (IOError, ValueError):
|
|
print('read cache src2month failed!! Maybe first run of the system?')
|
|
print('read cache src2month failed!! Maybe first run of the system?')
|
|
|
|
|
|
|
|
+ cache_pkg_with_cvss = cache + 'pkg_with_cvss'
|
|
|
|
+ try:
|
|
|
|
+ with open(cache_pkg_with_cvss) as fp:
|
|
|
|
+ pkg_with_cvss = json.load(fp)
|
|
|
|
+ except (IOError, ValueError):
|
|
|
|
+ print('read cache pkg_with_cvss failed!! Maybe first run of the system?')
|
|
|
|
+
|
|
cache_src2sloccount = cache + 'src2sloccount'
|
|
cache_src2sloccount = cache + 'src2sloccount'
|
|
try:
|
|
try:
|
|
with open(cache_src2sloccount) as fp:
|
|
with open(cache_src2sloccount) as fp:
|
|
@@ -180,7 +191,7 @@ def load_DBs():
|
|
except (IOError, ValueError):
|
|
except (IOError, ValueError):
|
|
print('read cache src2pop failed!! Maybe first run of the system?')
|
|
print('read cache src2pop failed!! Maybe first run of the system?')
|
|
|
|
|
|
- return(dsatable, src2dsa, dsa2cve, cvetable, src2month, src2sloccount, src2pop, src2deps)
|
|
|
|
|
|
+ return(dsatable, src2dsa, dsa2cve, cvetable, src2month, src2sloccount, src2pop, src2deps, pkg_with_cvss)
|
|
|
|
|
|
|
|
|
|
###############################################################################
|
|
###############################################################################
|
|
@@ -192,7 +203,7 @@ def myconverter(o):
|
|
return o.astype(int)
|
|
return o.astype(int)
|
|
###############################################################################
|
|
###############################################################################
|
|
## save to files
|
|
## save to files
|
|
-def save_DBs(dsatable, src2dsa, dsa2cve, cvetable, src2month, src2sloccount, src2pop, src2deps, src2sum):
|
|
|
|
|
|
+def save_DBs(dsatable, src2dsa, dsa2cve, cvetable, src2month, src2sloccount, src2pop, src2deps, src2sum, pkg_with_cvss):
|
|
cache = config['DIR']['cache_dir']
|
|
cache = config['DIR']['cache_dir']
|
|
|
|
|
|
cache_dsatable = cache + 'dsatable'
|
|
cache_dsatable = cache + 'dsatable'
|
|
@@ -276,6 +287,24 @@ def save_DBs(dsatable, src2dsa, dsa2cve, cvetable, src2month, src2sloccount, src
|
|
print('write cache src2month failed!! Fatal error')
|
|
print('write cache src2month failed!! Fatal error')
|
|
sys.exit(1)
|
|
sys.exit(1)
|
|
|
|
|
|
|
|
+ cache_pkg_with_cvss = cache + 'pkg_with_cvss'
|
|
|
|
+ int_list = dict()
|
|
|
|
+
|
|
|
|
+ for element in pkg_with_cvss:
|
|
|
|
+ for i in range(len(pkg_with_cvss[element])):
|
|
|
|
+ if element in int_list:
|
|
|
|
+ int_list[element].append(pkg_with_cvss[element][i])
|
|
|
|
+ else:
|
|
|
|
+ int_list[element] = []
|
|
|
|
+ int_list[element].append(pkg_with_cvss[element][i])
|
|
|
|
+ try:
|
|
|
|
+ with open(cache_pkg_with_cvss, 'w') as fp:
|
|
|
|
+ json.dump(int_list, fp, default = myconverter)
|
|
|
|
+ except IOError:
|
|
|
|
+ print('write cache pkg_with_cvss failed!! Fatal error')
|
|
|
|
+ sys.exit(1)
|
|
|
|
+
|
|
|
|
+
|
|
###############################################################################
|
|
###############################################################################
|
|
## Fetch current Packages, Sources and sha1sums files
|
|
## Fetch current Packages, Sources and sha1sums files
|
|
## These are needed to find CVE stats by sha1sums/pkg-names
|
|
## These are needed to find CVE stats by sha1sums/pkg-names
|
|
@@ -518,13 +547,14 @@ def resolvePkg2Src(pkglist, pkg2src):
|
|
## (srcpkg=> ())
|
|
## (srcpkg=> ())
|
|
def processCVEs(pkg, now, src2dsa, dsa2cve, src2month, cvetable, pkg_with_cvss, config):
|
|
def processCVEs(pkg, now, src2dsa, dsa2cve, src2month, cvetable, pkg_with_cvss, config):
|
|
stats = [now, 0, 0, 0, 0, 0, 0]
|
|
stats = [now, 0, 0, 0, 0, 0, 0]
|
|
- mylambda = config['TRUST']['lambda']
|
|
|
|
|
|
+ #mylambda = config['TRUST']['lambda']
|
|
|
|
+ mylambda = 0
|
|
cvestats = dict()
|
|
cvestats = dict()
|
|
logging.info('Processing package: ' + pkg + '.\n')
|
|
logging.info('Processing package: ' + pkg + '.\n')
|
|
|
|
|
|
## keep track of the number of low-medium-high severity vulnerabilities
|
|
## keep track of the number of low-medium-high severity vulnerabilities
|
|
## TODO see how cvss affects vulnerability prediction - if some packages show patterns
|
|
## TODO see how cvss affects vulnerability prediction - if some packages show patterns
|
|
- temp_cvss = 0.0
|
|
|
|
|
|
+ temp_cvss = 10.0
|
|
with_cvss = dict()
|
|
with_cvss = dict()
|
|
|
|
|
|
## To eliminate duplicate cves
|
|
## To eliminate duplicate cves
|
|
@@ -536,7 +566,7 @@ def processCVEs(pkg, now, src2dsa, dsa2cve, src2month, cvetable, pkg_with_cvss,
|
|
if cve_id in haveseen:
|
|
if cve_id in haveseen:
|
|
continue
|
|
continue
|
|
else:
|
|
else:
|
|
- haveseen[cve_id]=1
|
|
|
|
|
|
+ haveseen[cve_id] = 1
|
|
tt = cvetable[cve_id][0]
|
|
tt = cvetable[cve_id][0]
|
|
if tt in cvestats:
|
|
if tt in cvestats:
|
|
cvestats[tt] += 1
|
|
cvestats[tt] += 1
|
|
@@ -547,29 +577,39 @@ def processCVEs(pkg, now, src2dsa, dsa2cve, src2month, cvetable, pkg_with_cvss,
|
|
## Date at the moment taken from CVE? - not sure.
|
|
## Date at the moment taken from CVE? - not sure.
|
|
|
|
|
|
## with_cvss = (date: number low, number med, number high)
|
|
## with_cvss = (date: number low, number med, number high)
|
|
|
|
+ haveseen = dict()
|
|
for dsa_id in src2dsa[pkg]:
|
|
for dsa_id in src2dsa[pkg]:
|
|
for cve_id in dsa2cve[str(dsa_id)]:
|
|
for cve_id in dsa2cve[str(dsa_id)]:
|
|
- tt = cvetable[cve_id][0]
|
|
|
|
- try: temp_cvss = float(cvetable[cve_id][2])
|
|
|
|
- except TypeError:
|
|
|
|
- print(cve_id)
|
|
|
|
|
|
+ if cve_id in haveseen:
|
|
continue
|
|
continue
|
|
-
|
|
|
|
- if tt in with_cvss:
|
|
|
|
- if (temp_cvss<4.0):
|
|
|
|
- with_cvss[tt][0] += 1
|
|
|
|
- elif (temp_cvss<7.0):
|
|
|
|
- with_cvss[tt][1] += 1
|
|
|
|
- else:
|
|
|
|
- with_cvss[tt][2] += 1
|
|
|
|
else:
|
|
else:
|
|
- with_cvss[tt] = [0, 0, 0]
|
|
|
|
- if (temp_cvss<4.0):
|
|
|
|
- with_cvss[tt][0] += 1
|
|
|
|
- elif (temp_cvss<7.0):
|
|
|
|
- with_cvss[tt][1] += 1
|
|
|
|
|
|
+ haveseen[cve_id] = 1
|
|
|
|
+ tt = cvetable[cve_id][0]
|
|
|
|
+ try: temp_cvss = float(cvetable[cve_id][2])
|
|
|
|
+ except TypeError:
|
|
|
|
+ print(cve_id)
|
|
|
|
+ continue
|
|
|
|
+ if pkg=='linux':
|
|
|
|
+ print(tt, temp_cvss)
|
|
|
|
+
|
|
|
|
+ if tt in with_cvss:
|
|
|
|
+ if (temp_cvss<4.0):
|
|
|
|
+ with_cvss[tt][0] += 1
|
|
|
|
+ elif (temp_cvss<7.0):
|
|
|
|
+ with_cvss[tt][1] += 1
|
|
|
|
+ else:
|
|
|
|
+ with_cvss[tt][2] += 1
|
|
else:
|
|
else:
|
|
- with_cvss[tt][2] += 1
|
|
|
|
|
|
+ with_cvss[tt] = [0, 0, 0]
|
|
|
|
+ if (temp_cvss<4.0):
|
|
|
|
+ with_cvss[tt][0] += 1
|
|
|
|
+ elif (temp_cvss<7.0):
|
|
|
|
+ with_cvss[tt][1] += 1
|
|
|
|
+ else:
|
|
|
|
+ with_cvss[tt][2] += 1
|
|
|
|
+
|
|
|
|
+ if pkg=='linux':
|
|
|
|
+ print(with_cvss)
|
|
|
|
|
|
|
|
|
|
# Ignore pkgs with less than one incident, should not happen..
|
|
# Ignore pkgs with less than one incident, should not happen..
|
|
@@ -591,7 +631,7 @@ def processCVEs(pkg, now, src2dsa, dsa2cve, src2month, cvetable, pkg_with_cvss,
|
|
|
|
|
|
print(pkg + ' ' + str(count))
|
|
print(pkg + ' ' + str(count))
|
|
|
|
|
|
-# pkg_with_cvss[pkg] = with_cvss
|
|
|
|
|
|
+ #pkg_with_cvss[pkg] = with_cvss
|
|
format_data(pkg, with_cvss, pkg_with_cvss, True)
|
|
format_data(pkg, with_cvss, pkg_with_cvss, True)
|
|
|
|
|
|
format_data(pkg, cvestats, src2month, False)
|
|
format_data(pkg, cvestats, src2month, False)
|
|
@@ -624,7 +664,7 @@ def format_data(pkg, cvestats, src2month, cvss):
|
|
|
|
|
|
items.sort(key=lambda tup: tup[0])
|
|
items.sort(key=lambda tup: tup[0])
|
|
|
|
|
|
- for i in range(2000, 2018):
|
|
|
|
|
|
+ for i in range(2000, 2019):
|
|
temp = []
|
|
temp = []
|
|
for j in range(12):
|
|
for j in range(12):
|
|
if cvss:
|
|
if cvss:
|
|
@@ -748,32 +788,45 @@ def pkg_plot(pkg, cvestats):
|
|
###############################################################################
|
|
###############################################################################
|
|
## populate src2sloccount dictionary with number of source lines of code in
|
|
## populate src2sloccount dictionary with number of source lines of code in
|
|
## format (total, [ansic, cpp, asm, java, python, perl, sh])
|
|
## format (total, [ansic, cpp, asm, java, python, perl, sh])
|
|
-def getslocs(src2dsa, src2sloccount):
|
|
|
|
|
|
+def getslocs(src2month, src2sloccount):
|
|
|
|
+ with open('./sloc_report.txt') as f:
|
|
|
|
+ content = f.readlines()
|
|
|
|
+ for i in content:
|
|
|
|
+ (total, ansic, cpp, asm, java, python, perl, sh) = (0, 0, 0, 0, 0, 0, 0, 0)
|
|
|
|
+ words=i.split()
|
|
|
|
+ total = int(words[0])
|
|
|
|
+ pkg = words[1]
|
|
|
|
+ for w in words[2:]:
|
|
|
|
+ ww = w.split('=')
|
|
|
|
+ if ww[0] == 'ansic':
|
|
|
|
+ ansic = int(ww[1])
|
|
|
|
+ if ww[0] == 'cpp':
|
|
|
|
+ cpp = int(ww[1])
|
|
|
|
+ if ww[0] == 'asm':
|
|
|
|
+ asm = int(ww[1])
|
|
|
|
+ if ww[0] == 'java':
|
|
|
|
+ java = int(ww[1])
|
|
|
|
+ if ww[0] == 'python':
|
|
|
|
+ python = int(ww[1])
|
|
|
|
+ if ww[0] == 'perl':
|
|
|
|
+ perl = int(ww[1])
|
|
|
|
+ if ww[0] == 'sh':
|
|
|
|
+ sh = int(ww[1])
|
|
|
|
+ src2sloccount[pkg] = (total, [ansic, cpp, asm, java, python, perl, sh])
|
|
|
|
|
|
- try:
|
|
|
|
- conn = psycopg2.connect("dbname = 'debsources' user = 'postgres' host = 'localhost' password = 'nik'")
|
|
|
|
- except:
|
|
|
|
- print('I am unable to connect to the database')
|
|
|
|
-
|
|
|
|
- cur = conn.cursor()
|
|
|
|
|
|
|
|
- for pkg in src2dsa:
|
|
|
|
- if pkg not in src2sloccount:
|
|
|
|
- print(pkg)
|
|
|
|
- src2sloccount[pkg] = meta.getsloccount(cur, pkg)
|
|
|
|
|
|
|
|
- return
|
|
|
|
|
|
|
|
###############################################################################
|
|
###############################################################################
|
|
## get popularity contest data in format src_pkg -> (installed, vote, old, recent)
|
|
## get popularity contest data in format src_pkg -> (installed, vote, old, recent)
|
|
def getpop(src2dsa, src2pop):
|
|
def getpop(src2dsa, src2pop):
|
|
|
|
|
|
- with open('Debian_pop.csv', newline = '') as csvfile:
|
|
|
|
|
|
+ with open('by_vote.csv', newline = '') as csvfile:
|
|
reader = csv.reader(csvfile, delimiter = ',', quotechar = '|')
|
|
reader = csv.reader(csvfile, delimiter = ',', quotechar = '|')
|
|
for row in reader:
|
|
for row in reader:
|
|
try:
|
|
try:
|
|
- if row[1] in src2dsa and not (row[1] in src2pop):
|
|
|
|
- src2pop[row[1]] = row[2:6]
|
|
|
|
|
|
+ if row[1] in src2dsa:
|
|
|
|
+ src2pop[row[1]] = row[3]
|
|
except IndexError:
|
|
except IndexError:
|
|
print(row)
|
|
print(row)
|
|
continue
|
|
continue
|
|
@@ -822,27 +875,87 @@ def simulate_stats(pkg, year):
|
|
|
|
|
|
###############################################################################
|
|
###############################################################################
|
|
##TODO Printing functions
|
|
##TODO Printing functions
|
|
-def plot_all(src2month):
|
|
|
|
|
|
+def plot_all(src2month, src2sloccount, pkg_with_cvss):
|
|
## Sum of vulnerabilities by package
|
|
## Sum of vulnerabilities by package
|
|
src2sum = dict()
|
|
src2sum = dict()
|
|
src2year = dict()
|
|
src2year = dict()
|
|
- years = 16 # 2001 - 2000 + years
|
|
|
|
|
|
+ src2month_loc=dict()
|
|
|
|
+ src2lastyears = dict()
|
|
|
|
+ src2dens = dict()
|
|
|
|
+
|
|
|
|
+ src2month_temp = dict()
|
|
|
|
+
|
|
|
|
+ for i in pkg_with_cvss:
|
|
|
|
+ src2month_temp[i]=[]
|
|
|
|
+ for j in range(len(src2month[i])):
|
|
|
|
+ #src2month_temp[i].append(pkg_with_cvss[i][j][1]+pkg_with_cvss[i][j][2])
|
|
|
|
+ src2month_temp[i].append(pkg_with_cvss[i][j][2])
|
|
|
|
+
|
|
|
|
+ for i in src2month:
|
|
|
|
+ src2month_loc[i]=src2month_temp[i][:-12] #cut data for 2018
|
|
|
|
+
|
|
|
|
+ years = 17 # 2001 - 2000 + years
|
|
year_sum = [0] * years
|
|
year_sum = [0] * years
|
|
year_num = [0] * years
|
|
year_num = [0] * years
|
|
- for pkg in src2month:
|
|
|
|
|
|
+ for pkg in src2month_loc:
|
|
for j in range(years):
|
|
for j in range(years):
|
|
- temp = sum(src2month[pkg][12*(1+j):12*(2+j)])
|
|
|
|
|
|
+ temp = sum(src2month_loc[pkg][12*(1+j):12*(2+j)])
|
|
if (temp>0):
|
|
if (temp>0):
|
|
year_num[j] += 1
|
|
year_num[j] += 1
|
|
year_sum[j] += temp
|
|
year_sum[j] += temp
|
|
- total = sum(src2month[pkg][12:])
|
|
|
|
- last_year = sum(src2month[pkg][-12:])
|
|
|
|
- print(pkg + '; ' + str(last_year))
|
|
|
|
|
|
+ ## For last 2 years
|
|
|
|
+ total = sum(src2month_loc[pkg][:])
|
|
|
|
+ last_years = sum(src2month_loc[pkg][-24:])
|
|
|
|
+ print(pkg + '; ' + str(last_years))
|
|
if (total>1):
|
|
if (total>1):
|
|
src2sum[pkg] = total
|
|
src2sum[pkg] = total
|
|
|
|
+ src2lastyears[pkg] = last_years
|
|
|
|
|
|
|
|
+ #calc total
|
|
|
|
+ sum_total = 0
|
|
|
|
+ one_only=0
|
|
|
|
+ one_plus=0
|
|
|
|
+ for p in src2month:
|
|
|
|
+ sum_part = sum(src2month_loc[p][:])
|
|
|
|
+ sum_total += sum_part
|
|
|
|
+ if (sum_part == 1):
|
|
|
|
+ one_only += 1
|
|
|
|
+ elif (sum_part>1):
|
|
|
|
+ one_plus += 1
|
|
|
|
+
|
|
|
|
+ print('Total last 2 years = ', sum_total)
|
|
|
|
+ print('one_only = ', one_only)
|
|
|
|
+ print('one_plus = ', one_plus)
|
|
|
|
+
|
|
values = sorted(src2sum.values(),reverse=True)
|
|
values = sorted(src2sum.values(),reverse=True)
|
|
|
|
+ #print(values)
|
|
keys = list(sorted(src2sum, key=src2sum.__getitem__, reverse=True))
|
|
keys = list(sorted(src2sum, key=src2sum.__getitem__, reverse=True))
|
|
|
|
+
|
|
|
|
+ density = []
|
|
|
|
+ density_keys=[]
|
|
|
|
+ size = []
|
|
|
|
+ size_dens = []
|
|
|
|
+
|
|
|
|
+ for pkg in keys:
|
|
|
|
+ try:
|
|
|
|
+ size.append(src2sloccount[pkg][0]/1000)
|
|
|
|
+ except (KeyError):
|
|
|
|
+ size.append(0)
|
|
|
|
+
|
|
|
|
+
|
|
|
|
+ j=0
|
|
|
|
+
|
|
|
|
+ for pkg in keys:
|
|
|
|
+ try:
|
|
|
|
+ if (src2sloccount[pkg][0])>0:
|
|
|
|
+ density.append((values[j]/src2sloccount[pkg][0])*1000)
|
|
|
|
+ density_keys.append(pkg)
|
|
|
|
+ src2dens[pkg] = (values[j]/src2sloccount[pkg][0])*1000
|
|
|
|
+ size_dens.append(src2sloccount[pkg][0])
|
|
|
|
+ except(KeyError):
|
|
|
|
+ pass
|
|
|
|
+ j += 1
|
|
|
|
+
|
|
i = 0
|
|
i = 0
|
|
few_keys = []
|
|
few_keys = []
|
|
#print(keys)
|
|
#print(keys)
|
|
@@ -857,19 +970,85 @@ def plot_all(src2month):
|
|
carlosplt.pre_paper_plot(True)
|
|
carlosplt.pre_paper_plot(True)
|
|
#plt.style.use('ggplot')
|
|
#plt.style.use('ggplot')
|
|
|
|
|
|
|
|
+ print('Spearman correlation: ',stats.spearmanr(values,size))
|
|
|
|
+ with open('sizes.txt', 'w') as thefile:
|
|
|
|
+ for item in size:
|
|
|
|
+ thefile.write("%.3f\n" % item)
|
|
|
|
+
|
|
plt.figure(figsize=(10,5))
|
|
plt.figure(figsize=(10,5))
|
|
- plt.plot([1000] + values, color='darkblue', lw = 2)
|
|
|
|
- plt.xticks(np.arange(1,len(src2sum),10.0)+1,few_keys, rotation="vertical")
|
|
|
|
|
|
+ plt.plot(values, color='darkblue', lw = 2)
|
|
|
|
+ #plt.plot(size, 'ro', color='darkred', lw = 2, label='Size in KSLoC')
|
|
|
|
+ plt.xticks(np.arange(0,len(src2sum),10.0),few_keys, rotation="vertical")
|
|
plt.ylabel('Vulnerabilities')
|
|
plt.ylabel('Vulnerabilities')
|
|
plt.yscale('log')
|
|
plt.yscale('log')
|
|
|
|
+ plt.grid()
|
|
#plt.xscale('log')
|
|
#plt.xscale('log')
|
|
plt.tight_layout()
|
|
plt.tight_layout()
|
|
|
|
+ plt.legend()
|
|
carlosplt.post_paper_plot(True,True,True)
|
|
carlosplt.post_paper_plot(True,True,True)
|
|
- tikz_save('line.tex', figureheight='\\figureheight', figurewidth='\\figurewidth')
|
|
|
|
plt.show()
|
|
plt.show()
|
|
|
|
|
|
print('Yearly vulnerabilites in total' + str(year_sum))
|
|
print('Yearly vulnerabilites in total' + str(year_sum))
|
|
|
|
|
|
|
|
+ src2sloc = dict()
|
|
|
|
+ for pkg in src2sloccount:
|
|
|
|
+ src2sloc[pkg] = src2sloccount[pkg][0]
|
|
|
|
+
|
|
|
|
+ ## Density
|
|
|
|
+ density = sorted(src2dens.values(),reverse=True)
|
|
|
|
+ with open('densities.txt', 'w') as thefile:
|
|
|
|
+ for item in density:
|
|
|
|
+ thefile.write("%.3f\n" % item)
|
|
|
|
+ density_keys = list(sorted(src2dens, key=src2dens.__getitem__, reverse=True))
|
|
|
|
+ density_few_keys =[]
|
|
|
|
+ for k in density_keys:
|
|
|
|
+ if (i==0):
|
|
|
|
+ density_few_keys.append(k)
|
|
|
|
+ i+=1
|
|
|
|
+ if (i==10):
|
|
|
|
+ i = 0
|
|
|
|
+
|
|
|
|
+ plt.figure(figsize=(10,5))
|
|
|
|
+ plt.plot(size_dens, density, 'ro', color='darkblue', lw = 2)
|
|
|
|
+ plt.xticks(np.arange(0,len(density),10.0),density_few_keys, rotation="vertical")
|
|
|
|
+ plt.ylabel('Vulnerability density')
|
|
|
|
+ plt.yscale('log')
|
|
|
|
+ plt.xscale('log')
|
|
|
|
+ plt.tight_layout()
|
|
|
|
+ carlosplt.post_paper_plot(True,True,True)
|
|
|
|
+ plt.show()
|
|
|
|
+
|
|
|
|
+ ## Spearman density size
|
|
|
|
+ print('Spearman correlation: ',stats.spearmanr(density,size_dens))
|
|
|
|
+
|
|
|
|
+
|
|
|
|
+ ## SLoCs
|
|
|
|
+ values = sorted(src2sloc.values(),reverse=True)
|
|
|
|
+ #print(values)
|
|
|
|
+ keys = list(sorted(src2sloc, key=src2sloc.__getitem__, reverse=True))
|
|
|
|
+
|
|
|
|
+ i = 0
|
|
|
|
+ few_keys = []
|
|
|
|
+ for k in keys:
|
|
|
|
+ if (i==0):
|
|
|
|
+ few_keys.append(k)
|
|
|
|
+ i+=1
|
|
|
|
+ if (i==10):
|
|
|
|
+ i = 0
|
|
|
|
+
|
|
|
|
+ carlosplt.pre_paper_plot(True)
|
|
|
|
+
|
|
|
|
+ plt.figure(figsize=(10,5))
|
|
|
|
+ plt.plot(values, color='darkblue', lw = 2)
|
|
|
|
+ plt.xticks(np.arange(0,len(src2sloc),10.0),few_keys, rotation="vertical")
|
|
|
|
+ plt.ylabel('SLoC')
|
|
|
|
+ plt.yscale('log')
|
|
|
|
+ plt.xscale('log')
|
|
|
|
+ plt.tight_layout()
|
|
|
|
+ carlosplt.post_paper_plot(True,True,True)
|
|
|
|
+ plt.show()
|
|
|
|
+
|
|
|
|
+
|
|
## Number of affected packages
|
|
## Number of affected packages
|
|
n = len(year_sum)
|
|
n = len(year_sum)
|
|
yearsx = []
|
|
yearsx = []
|
|
@@ -892,9 +1071,9 @@ def plot_all(src2month):
|
|
|
|
|
|
|
|
|
|
|
|
|
|
- print(average_per_year)
|
|
|
|
|
|
+ #print(average_per_year)
|
|
x_values = list(range(1,years+1))
|
|
x_values = list(range(1,years+1))
|
|
- print(x_values)
|
|
|
|
|
|
+ #print(x_values)
|
|
slope = np.polyfit(x_values,average_per_year,1)
|
|
slope = np.polyfit(x_values,average_per_year,1)
|
|
|
|
|
|
#slope = np.polyval(slope,x_values)
|
|
#slope = np.polyval(slope,x_values)
|
|
@@ -918,15 +1097,17 @@ def plot_all(src2month):
|
|
|
|
|
|
quarter_num = years*4
|
|
quarter_num = years*4
|
|
|
|
|
|
- pkg = 'php5'
|
|
|
|
- quarter_sum = [0] * quarter_num
|
|
|
|
- for j in range(quarter_num):
|
|
|
|
- temp = sum(src2month[pkg][12+3*j:12+3*(j+1)])
|
|
|
|
- quarter_sum[j] = temp
|
|
|
|
- src2quarter[pkg] = quarter_sum
|
|
|
|
-
|
|
|
|
- for pkg in src2quarter:
|
|
|
|
- n = len(src2quarter[pkg])
|
|
|
|
|
|
+ # Here for only up to 2016 - let's change that
|
|
|
|
+ #return(src2sum)
|
|
|
|
+# pkg = 'php5'
|
|
|
|
+# quarter_sum = [0] * quarter_num
|
|
|
|
+# for j in range(quarter_num):
|
|
|
|
+# temp = sum(src2month_loc[pkg][12+3*j:12+3*(j+1)])
|
|
|
|
+# quarter_sum[j] = temp
|
|
|
|
+# src2quarter[pkg] = quarter_sum
|
|
|
|
+
|
|
|
|
+# for pkg in src2quarter:
|
|
|
|
+# n = len(src2quarter[pkg])
|
|
quartersx = []
|
|
quartersx = []
|
|
for i in range(1,years+1):
|
|
for i in range(1,years+1):
|
|
for j in range(1,5):
|
|
for j in range(1,5):
|
|
@@ -937,55 +1118,56 @@ def plot_all(src2month):
|
|
|
|
|
|
|
|
|
|
|
|
|
|
- x = range(quarter_num)
|
|
|
|
- width = 1/2
|
|
|
|
|
|
+# x = range(quarter_num)
|
|
|
|
+# width = 1/2
|
|
## Plot different colors for php
|
|
## Plot different colors for php
|
|
- before = src2quarter[pkg][:-8] + ([0] * 8)
|
|
|
|
- after = ([0] * (len(before)-8)) + src2quarter[pkg][-8:]
|
|
|
|
- print(len(src2quarter[pkg]))
|
|
|
|
|
|
+# before = src2quarter[pkg][:-8] + ([0] * 8)
|
|
|
|
+# after = ([0] * (len(before)-8)) + src2quarter[pkg][-8:]
|
|
|
|
+# print(len(src2quarter[pkg]))
|
|
#
|
|
#
|
|
- bar1 = plt.bar(x[:-26], before[24:-2], width, color='darkblue', label='before php7', edgecolor='black')
|
|
|
|
- bar2 = plt.bar(x[:-26], after[24:-2], width, color='darkred', label='after php7', edgecolor='black')
|
|
|
|
- plt.legend(handles=[bar1, bar2])
|
|
|
|
|
|
+# bar1 = plt.bar(x[:-26], before[24:-2], width, color='darkblue', label='before php7', edgecolor='black')
|
|
|
|
+# bar2 = plt.bar(x[:-26], after[24:-2], width, color='darkred', label='after php7', edgecolor='black')
|
|
|
|
+# plt.legend(handles=[bar1, bar2])
|
|
#
|
|
#
|
|
- print('PHP Sum before: ' + str(sum(before)))
|
|
|
|
- print('PHP Sum after: ' + str(sum(after)))
|
|
|
|
|
|
+# print('PHP Sum before: ' + str(sum(before)))
|
|
|
|
+# print('PHP Sum after: ' + str(sum(after)))
|
|
|
|
|
|
- plt.xticks(np.arange(0,n-26),quartersx[24:-2], rotation="vertical")
|
|
|
|
- plt.ylabel('Vulnerabilities per quarter of package ' + pkg)
|
|
|
|
- plt.xlabel('Quarter')
|
|
|
|
- carlosplt.post_paper_plot(True,True,True)
|
|
|
|
- plt.show()
|
|
|
|
|
|
+# plt.xticks(np.arange(0,n-26),quartersx[24:-2], rotation="vertical")
|
|
|
|
+# plt.ylabel('Vulnerabilities per quarter of package ' + pkg)
|
|
|
|
+# plt.xlabel('Quarter')
|
|
|
|
+# carlosplt.post_paper_plot(True,True,True)
|
|
|
|
+# plt.show()
|
|
|
|
|
|
# ## Plot for openjdk-7
|
|
# ## Plot for openjdk-7
|
|
- pkg = 'openjdk-7'
|
|
|
|
- quarter_sum = [0] * quarter_num
|
|
|
|
- for j in range(quarter_num):
|
|
|
|
- temp = sum(src2month[pkg][12+3*j:12+3*(j+1)])
|
|
|
|
- quarter_sum[j] = temp
|
|
|
|
- src2quarter[pkg] = quarter_sum
|
|
|
|
-
|
|
|
|
- n = len(src2quarter[pkg])
|
|
|
|
- x = range(quarter_num)
|
|
|
|
- width = 1/2
|
|
|
|
|
|
+ #pkg = 'openjdk-8'
|
|
|
|
+ #pkg = 'openjdk-7'
|
|
|
|
+ #quarter_sum = [0] * quarter_num
|
|
|
|
+ #for j in range(quarter_num):
|
|
|
|
+ # temp = sum(src2month_loc[pkg][12+3*j:12+3*(j+1)])
|
|
|
|
+ # quarter_sum[j] = temp
|
|
|
|
+ #src2quarter[pkg] = quarter_sum
|
|
|
|
+
|
|
|
|
+ #n = len(src2quarter[pkg])
|
|
|
|
+ #x = range(quarter_num)
|
|
|
|
+ #width = 1/2
|
|
# ## Plot different colors for openjdk
|
|
# ## Plot different colors for openjdk
|
|
- before = src2quarter[pkg][:-10] + ([0] * 10)
|
|
|
|
- after = ([0] * (len(before)-10)) + src2quarter[pkg][-10:]
|
|
|
|
- print(len(src2quarter[pkg]))
|
|
|
|
|
|
+ #before = src2quarter[pkg][:-10] + ([0] * 10)
|
|
|
|
+ #after = ([0] * (len(before)-10)) + src2quarter[pkg][-10:]
|
|
|
|
+ #print(len(src2quarter[pkg]))
|
|
|
|
|
|
- bar1 = plt.bar(x[:-48], before[48:], width, color='darkblue', label='before openjdk-8', edgecolor='black')
|
|
|
|
- bar2 = plt.bar(x[:-48], after[48:], width, color='darkred', label='after openjdk-8', edgecolor='black')
|
|
|
|
- plt.legend(handles=[bar1, bar2])
|
|
|
|
|
|
+ #bar1 = plt.bar(x[:-48], before[48:], width, color='darkblue', label='before openjdk-8', edgecolor='black')
|
|
|
|
+ #bar2 = plt.bar(x[:-48], after[48:], width, color='darkred', label='after openjdk-8', edgecolor='black')
|
|
|
|
+ #plt.legend(handles=[bar1, bar2])
|
|
|
|
|
|
- print('OpenJDK Sum before: ' + str(sum(before)))
|
|
|
|
- print('OpenJDK Sum after: ' + str(sum(after)))
|
|
|
|
|
|
+ #print('OpenJDK Sum before: ' + str(sum(before)))
|
|
|
|
+ #print('OpenJDK Sum after: ' + str(sum(after)))
|
|
|
|
|
|
#plt.bar(x, src2quarter[pkg], width, color='red')
|
|
#plt.bar(x, src2quarter[pkg], width, color='red')
|
|
- plt.xticks(np.arange(0,n-48),quartersx[48:], rotation="vertical")
|
|
|
|
- plt.ylabel('Vulnerabilities per quarter of package ' + pkg)
|
|
|
|
- plt.xlabel('Quarter')
|
|
|
|
- carlosplt.post_paper_plot(True,True,True)
|
|
|
|
- plt.show()
|
|
|
|
|
|
+ #plt.xticks(np.arange(0,n-48),quartersx[48:], rotation="vertical")
|
|
|
|
+ #plt.ylabel('Vulnerabilities per quarter of package ' + pkg)
|
|
|
|
+ #plt.xlabel('Quarter')
|
|
|
|
+ #carlosplt.post_paper_plot(True,True,True)
|
|
|
|
+ #plt.show()
|
|
|
|
|
|
|
|
|
|
|
|
|
|
@@ -1002,8 +1184,8 @@ def plot_all(src2month):
|
|
carlosplt.post_paper_plot(True,True,True)
|
|
carlosplt.post_paper_plot(True,True,True)
|
|
plt.show()
|
|
plt.show()
|
|
|
|
|
|
- sumall = sum(values)
|
|
|
|
- print(sumall)
|
|
|
|
|
|
+ sum_all = sum(values)
|
|
|
|
+ print("Total: ", sum_all)
|
|
###############################################################################################
|
|
###############################################################################################
|
|
|
|
|
|
# Get LTS and plot
|
|
# Get LTS and plot
|
|
@@ -1013,14 +1195,15 @@ def plot_all(src2month):
|
|
except IOError:
|
|
except IOError:
|
|
ltslist = dla.getDLAs()
|
|
ltslist = dla.getDLAs()
|
|
|
|
|
|
|
|
+ print(ltslist)
|
|
## Plot for wheezy
|
|
## Plot for wheezy
|
|
-
|
|
|
|
|
|
+ quarter_num += 1
|
|
quarter_sum = [0] * quarter_num
|
|
quarter_sum = [0] * quarter_num
|
|
totalLTS = [0] * (14 * 12) + ltslist
|
|
totalLTS = [0] * (14 * 12) + ltslist
|
|
|
|
|
|
- for pkg in src2month:
|
|
|
|
|
|
+ for pkg in src2month_loc:
|
|
for j in range(quarter_num):
|
|
for j in range(quarter_num):
|
|
- temp = sum(src2month[pkg][12+(3*j):12+3*(j+1)])
|
|
|
|
|
|
+ temp = sum(src2month_loc[pkg][12+(3*j):12+3*(j+1)])
|
|
quarter_sum[j] += temp
|
|
quarter_sum[j] += temp
|
|
|
|
|
|
LTS_quarter = []
|
|
LTS_quarter = []
|
|
@@ -1029,6 +1212,8 @@ def plot_all(src2month):
|
|
temp = sum(totalLTS[12+(3*j):12+3*(j+1)])
|
|
temp = sum(totalLTS[12+(3*j):12+3*(j+1)])
|
|
LTS_quarter.append(temp)
|
|
LTS_quarter.append(temp)
|
|
|
|
|
|
|
|
+ quartersx.append("Q1'18")
|
|
|
|
+
|
|
## Print all LTS
|
|
## Print all LTS
|
|
cut = 12*4+1
|
|
cut = 12*4+1
|
|
n = len(quarter_sum)
|
|
n = len(quarter_sum)
|
|
@@ -1047,25 +1232,23 @@ def plot_all(src2month):
|
|
|
|
|
|
|
|
|
|
## Filter only wheezy:
|
|
## Filter only wheezy:
|
|
- quarter_sum_regular = [0] * (12*4+1) + quarter_sum[12*4+1:12*4+9] + [0] * 11
|
|
|
|
- quarter_sum_errors = [0] * (12*4 + 9) + quarter_sum[12*4+9:12*4+9+5] + [0] * 6
|
|
|
|
|
|
+ quarter_sum_regular = [0] * (12*4+1) + quarter_sum[12*4+1:12*4+9] + [0] * 12
|
|
|
|
+ quarter_sum_errors = [0] * (12*4 + 9) + quarter_sum[12*4+9:12*4+9+5] + [0] * 7
|
|
LTS_quarter = [0] * (15*4+2) + LTS_quarter[15*4+2:]
|
|
LTS_quarter = [0] * (15*4+2) + LTS_quarter[15*4+2:]
|
|
|
|
|
|
- print(quarter_sum_errors)
|
|
|
|
|
|
+ #print(quarter_sum_errors)
|
|
|
|
|
|
cut = 12*4+1
|
|
cut = 12*4+1
|
|
n = len(quarter_sum) - cut
|
|
n = len(quarter_sum) - cut
|
|
x = range(quarter_num-cut)
|
|
x = range(quarter_num-cut)
|
|
width = 1/2
|
|
width = 1/2
|
|
|
|
|
|
- print(len(LTS_quarter))
|
|
|
|
|
|
+ #print(len(LTS_quarter))
|
|
|
|
|
|
bar1 = plt.bar(x, quarter_sum_regular[cut:], width, color='darkblue', label='regular', edgecolor='black')
|
|
bar1 = plt.bar(x, quarter_sum_regular[cut:], width, color='darkblue', label='regular', edgecolor='black')
|
|
bar12 = plt.bar(x, quarter_sum_errors[cut:], width, color='darkorange', label='regular*', edgecolor='black')
|
|
bar12 = plt.bar(x, quarter_sum_errors[cut:], width, color='darkorange', label='regular*', edgecolor='black')
|
|
bar2 = plt.bar(x, LTS_quarter[cut:], width, color='darkred', label ='long-term', edgecolor='black')
|
|
bar2 = plt.bar(x, LTS_quarter[cut:], width, color='darkred', label ='long-term', edgecolor='black')
|
|
|
|
|
|
- #bar1 = plt.bar(x[:-48], before[48:], width, color='blue', label='regular support')
|
|
|
|
- #bar2 = plt.bar(x[:-48], after[48:], width, color='red', label='long-term support')
|
|
|
|
plt.legend(handles=[bar1, bar12, bar2])
|
|
plt.legend(handles=[bar1, bar12, bar2])
|
|
|
|
|
|
plt.xticks(np.arange(0,n),quartersx[cut:], rotation="vertical")
|
|
plt.xticks(np.arange(0,n),quartersx[cut:], rotation="vertical")
|
|
@@ -1132,9 +1315,10 @@ try:
|
|
action = sys.argv[1]
|
|
action = sys.argv[1]
|
|
except IndexError:
|
|
except IndexError:
|
|
print('No argument given')
|
|
print('No argument given')
|
|
- aptsec_help()
|
|
|
|
- sys.exit(0)
|
|
|
|
- action = ''
|
|
|
|
|
|
+ action='update'
|
|
|
|
+ #aptsec_help()
|
|
|
|
+ #sys.exit(0)
|
|
|
|
+ #action = ''
|
|
|
|
|
|
|
|
|
|
client = MongoClient()
|
|
client = MongoClient()
|
|
@@ -1160,41 +1344,34 @@ state['vendor'] = 'debian'
|
|
# os.makedirs(d)
|
|
# os.makedirs(d)
|
|
|
|
|
|
if action == 'update':
|
|
if action == 'update':
|
|
- (dsatable, src2dsa, dsa2cve, cvetable, src2month, src2sloccount, src2pop, src2deps) = load_DBs()
|
|
|
|
|
|
+ (dsatable, src2dsa, dsa2cve, cvetable, src2month, src2sloccount, src2pop, src2deps, pkg_with_cvss) = load_DBs()
|
|
# loadsha1lists()
|
|
# loadsha1lists()
|
|
aptsec_update(state,config, dsatable, client, src2dsa, dsa2cve, src2month, cvetable, pkg_with_cvss)
|
|
aptsec_update(state,config, dsatable, client, src2dsa, dsa2cve, src2month, cvetable, pkg_with_cvss)
|
|
# save_sha1lists()
|
|
# save_sha1lists()
|
|
-# getslocs(src2dsa, src2sloccount)
|
|
|
|
|
|
+# getslocs(src2month, src2sloccount)
|
|
# getpop(src2dsa, src2pop)
|
|
# getpop(src2dsa, src2pop)
|
|
# getdeps(src2dsa, src2deps)
|
|
# getdeps(src2dsa, src2deps)
|
|
- save_DBs(dsatable, src2dsa, dsa2cve, cvetable, src2month, src2sloccount, src2pop, src2deps, src2sum)
|
|
|
|
|
|
+ save_DBs(dsatable, src2dsa, dsa2cve, cvetable, src2month, src2sloccount, src2pop, src2deps, src2sum, pkg_with_cvss)
|
|
save_state(state)
|
|
save_state(state)
|
|
|
|
+# stats.test(src2month, src2pop, src2sloccount)
|
|
# lstm.predict(src2month, src2sloccount, src2pop, src2deps)
|
|
# lstm.predict(src2month, src2sloccount, src2pop, src2deps)
|
|
|
|
+ pred.predict(src2month, 0)
|
|
# print(pkg_with_cvss['linux'])
|
|
# print(pkg_with_cvss['linux'])
|
|
|
|
|
|
low = []
|
|
low = []
|
|
med = []
|
|
med = []
|
|
high = []
|
|
high = []
|
|
|
|
|
|
- for item in pkg_with_cvss['firefox-esr']:
|
|
|
|
- low.append(item[0])
|
|
|
|
- med.append(item[1])
|
|
|
|
- high.append(item[2])
|
|
|
|
-
|
|
|
|
-# plt.plot(low, color = 'green')
|
|
|
|
-# plt.plot(med, color = 'orange')
|
|
|
|
-# plt.plot(high, color = 'red')
|
|
|
|
-# plt.show()
|
|
|
|
-
|
|
|
|
elif action == 'status':
|
|
elif action == 'status':
|
|
- (dsatable, src2dsa, dsa2cve, cvetable, src2month, src2sloccount, src2pop, src2deps) = load_DBs()
|
|
|
|
|
|
+ (dsatable, src2dsa, dsa2cve, cvetable, src2month, src2sloccount, src2pop, src2deps, pkg_with_cvss) = load_DBs()
|
|
aptsec_status(sys.argv[2])
|
|
aptsec_status(sys.argv[2])
|
|
elif action == 'show':
|
|
elif action == 'show':
|
|
- (dsatable, src2dsa, dsa2cve, cvetable, src2month, src2sloccount, src2pop, src2deps) = load_DBs()
|
|
|
|
- src2sum = plot_all(src2month)
|
|
|
|
- save_DBs(dsatable, src2dsa, dsa2cve, cvetable, src2month, src2sloccount, src2pop, src2deps, src2sum)
|
|
|
|
|
|
+ (dsatable, src2dsa, dsa2cve, cvetable, src2month, src2sloccount, src2pop, src2deps, pkg_with_cvss) = load_DBs()
|
|
|
|
+ src2sum = plot_all(src2month, src2sloccount, pkg_with_cvss)
|
|
|
|
+ save_DBs(dsatable, src2dsa, dsa2cve, cvetable, src2month, src2sloccount, src2pop, src2deps, src2sum, pkg_with_cvss)
|
|
else:
|
|
else:
|
|
aptsec_help()
|
|
aptsec_help()
|
|
|
|
|
|
|
|
|
|
|
|
+
|
|
save_state(state)
|
|
save_state(state)
|