USENIX Association LASER 2013 • Learning from Authoritative Security Experiment Result 37 Dismal Code: Studying the Evolution of Security Bugs

Background. Security bugs are critical programming er-rors that can lead to serious vulnerabilities in software. Such bugs may allow an attacker to take over an applica-tion, steal data or prevent the application from working at all. Aim. We used the projects stored in the Maven reposi-tory to study the characteristics of security bugs individ-ually and in relation to other software bugs. Specifically, we studied the evolution of security bugs through time. In addition, we examined their persistence and their re-lationship with a) the size of the corresponding version, and b) other bug categories. Method. We analyzed every project version of the Maven repository by using FindBugs, a popular stati