Predicting Vulnerabilities in the Free Open Source Software Ecosystem

Due to the interdependent nature of Free Open Source Software projects, a vulnerability in just\ud one highly used project can have significant and sweeping consequences across many projects,\ud and can inflict hundreds of millions of dollars in damage. This paper proposes a model for\ud predicting software vulnerabilities in highly used FOSS projects using measures of effort and\ud complexity. We used several measures of complexity and effort to look at the top 150 projects\ud listed on the Debian Popularity Contest. We determined that total development effort was the\ud best measure of effort and lines of code was the best measure of complexity for predicting\ud software vulnerabilities in these projects