A quantitative analysis into the economics of correcting software bugs

Craig Wright, Tanveer Zia

Research output: Book chapter/Published conference paperConference paperpeer-review

11 Citations (Scopus)
6 Downloads (Pure)


Using a quantitative study of in-house coding practices, we demonstrate the notion that programming needs to move from "Lines of Code per day" as a productivity measure to a measure that takes debugging and documentation into account. This could be something such as "Lines of clean, simple, correct, well-documented code per day", but with bugs propagating into the 6th iteration of patches, a new paradigm needs to be developed. Finding flaws in software, whether these have a security related cost or not, is an essential component of software development. When these bugs result in security vulnerabilities, the importance of testing becomes even more critical. Many studies have been conducted using the practices of large software vendors as a basis, but few studies have looked at in-house development practices. This paper uses an empirical study of in-house software coding practices in Australian companies to both demonstrate that there is an economic limit to how far testing should proceed as well as noting the deficiencies in the existing approaches.
Original languageEnglish
Title of host publicationComputational Intelligence in Security for Information Systems
Subtitle of host publicationProceedings of the 4th International Conference, CISIS 2011
EditorsÁlvaro Herrero, Emilio Corchado
Place of PublicationGermany
Number of pages8
ISBN (Electronic)9783642213236
ISBN (Print)9783642213229
Publication statusPublished - 2011
Event4th International Conference on Computational Intelligence in Security for Information Systems: CISIS 2011 - Hotel Melia Costa del Sol, Torremolinos, Málaga, Spain
Duration: 08 Jun 201110 Jun 2011
http://www.springer.com/gp/book/9783642213229 (Conference proceedings )
https://web.archive.org/web/20110720145129/http://gicap.ubu.es/cisis2011/home/home.shtml (Conference website)

Publication series

NameSecurity and Cryptology
ISSN (Print)0302-9743


Conference4th International Conference on Computational Intelligence in Security for Information Systems
CityTorremolinos, Málaga
OtherCISIS aims to offer a meeting opportunity for academic and industry-related researchers belonging to the various, vast communities of Computational Intelligence, Information Security, and Data Mining. The need for intelligent, flexible behaviour by large, complex systems, especially in mission-critical domains, is intended to be the catalyst and the aggregation stimulus for the overall event.
Internet address


Dive into the research topics of 'A quantitative analysis into the economics of correcting software bugs'. Together they form a unique fingerprint.

Cite this