A quantitative analysis into the economics of correcting software bugs

Craig Wright; Tanveer Zia

doi:10.1007/978-3-642-21323-6

A quantitative analysis into the economics of correcting software bugs

Craig Wright, Tanveer Zia

Research output: Book chapter/Published conference paper › Conference paper › peer-review

14 Citations (Scopus)

6 Downloads (Pure)

Abstract

Using a quantitative study of in-house coding practices, we demonstrate the notion that programming needs to move from "Lines of Code per day" as a productivity measure to a measure that takes debugging and documentation into account. This could be something such as "Lines of clean, simple, correct, well-documented code per day", but with bugs propagating into the 6th iteration of patches, a new paradigm needs to be developed. Finding flaws in software, whether these have a security related cost or not, is an essential component of software development. When these bugs result in security vulnerabilities, the importance of testing becomes even more critical. Many studies have been conducted using the practices of large software vendors as a basis, but few studies have looked at in-house development practices. This paper uses an empirical study of in-house software coding practices in Australian companies to both demonstrate that there is an economic limit to how far testing should proceed as well as noting the deficiencies in the existing approaches.

Original language	English
Title of host publication	Computational Intelligence in Security for Information Systems
Subtitle of host publication	Proceedings of the 4th International Conference, CISIS 2011
Editors	Ãlvaro Herrero, Emilio Corchado
Place of Publication	Germany
Publisher	Springer
Pages	199-206
Number of pages	8
Volume	6694
ISBN (Electronic)	9783642213236
ISBN (Print)	9783642213229
DOIs	https://doi.org/10.1007/978-3-642-21323-6
Publication status	Published - 2011
Event	4th International Conference on Computational Intelligence in Security for Information Systems: CISIS 2011 - Hotel Melia Costa del Sol, Torremolinos, Málaga, Spain Duration: 08 Jun 2011 → 10 Jun 2011 http://www.springer.com/gp/book/9783642213229 (Conference proceedings ) https://web.archive.org/web/20110720145129/http://gicap.ubu.es/cisis2011/home/home.shtml (Conference website)

Publication series

Name	Security and Cryptology
Publisher	Springer
ISSN (Print)	0302-9743

Conference

Conference	4th International Conference on Computational Intelligence in Security for Information Systems
Country/Territory	Spain
City	Torremolinos, Málaga
Period	08/06/11 → 10/06/11
Other	CISIS aims to offer a meeting opportunity for academic and industry-related researchers belonging to the various, vast communities of Computational Intelligence, Information Security, and Data Mining. The need for intelligent, flexible behaviour by large, complex systems, especially in mission-critical domains, is intended to be the catalyst and the aggregation stimulus for the overall event.
Internet address	http://www.springer.com/gp/book/9783642213229 (Conference proceedings ) https://web.archive.org/web/20110720145129/http://gicap.ubu.es/cisis2011/home/home.shtml (Conference website)

Access to Document

10.1007/978-3-642-21323-6

Cite this

@inproceedings{3f6d64afc3ab456fb7a9b7920a34eb74,

title = "A quantitative analysis into the economics of correcting software bugs",

abstract = "Using a quantitative study of in-house coding practices, we demonstrate the notion that programming needs to move from {"}Lines of Code per day{"} as a productivity measure to a measure that takes debugging and documentation into account. This could be something such as {"}Lines of clean, simple, correct, well-documented code per day{"}, but with bugs propagating into the 6th iteration of patches, a new paradigm needs to be developed. Finding flaws in software, whether these have a security related cost or not, is an essential component of software development. When these bugs result in security vulnerabilities, the importance of testing becomes even more critical. Many studies have been conducted using the practices of large software vendors as a basis, but few studies have looked at in-house development practices. This paper uses an empirical study of in-house software coding practices in Australian companies to both demonstrate that there is an economic limit to how far testing should proceed as well as noting the deficiencies in the existing approaches.",

keywords = "Empirical studies, Model Checking, Software Development Life Cycle, Software Verification",

author = "Craig Wright and Tanveer Zia",

year = "2011",

doi = "10.1007/978-3-642-21323-6",

language = "English",

isbn = "9783642213229",

volume = "6694",

series = "Security and Cryptology",

publisher = "Springer",

pages = "199--206",

editor = "{\~A}lvaro Herrero and Emilio Corchado",

booktitle = "Computational Intelligence in Security for Information Systems",

address = "United States",

note = "4th International Conference on Computational Intelligence in Security for Information Systems : CISIS 2011 ; Conference date: 08-06-2011 Through 10-06-2011",

url = "http://www.springer.com/gp/book/9783642213229, https://web.archive.org/web/20110720145129/http://gicap.ubu.es/cisis2011/home/home.shtml",

}

Wright, C & Zia, T 2011, A quantitative analysis into the economics of correcting software bugs. in Ã Herrero & E Corchado (eds), Computational Intelligence in Security for Information Systems: Proceedings of the 4th International Conference, CISIS 2011. vol. 6694, Security and Cryptology, Springer, Germany, pp. 199-206, 4th International Conference on Computational Intelligence in Security for Information Systems, Torremolinos, Málaga, Spain, 08/06/11. https://doi.org/10.1007/978-3-642-21323-6

A quantitative analysis into the economics of correcting software bugs. / Wright, Craig; Zia, Tanveer.
Computational Intelligence in Security for Information Systems: Proceedings of the 4th International Conference, CISIS 2011. ed. / Ãlvaro Herrero; Emilio Corchado. Vol. 6694 Germany: Springer, 2011. p. 199-206 (Security and Cryptology).

Research output: Book chapter/Published conference paper › Conference paper › peer-review

TY - GEN

T1 - A quantitative analysis into the economics of correcting software bugs

AU - Wright, Craig

AU - Zia, Tanveer

PY - 2011

Y1 - 2011

N2 - Using a quantitative study of in-house coding practices, we demonstrate the notion that programming needs to move from "Lines of Code per day" as a productivity measure to a measure that takes debugging and documentation into account. This could be something such as "Lines of clean, simple, correct, well-documented code per day", but with bugs propagating into the 6th iteration of patches, a new paradigm needs to be developed. Finding flaws in software, whether these have a security related cost or not, is an essential component of software development. When these bugs result in security vulnerabilities, the importance of testing becomes even more critical. Many studies have been conducted using the practices of large software vendors as a basis, but few studies have looked at in-house development practices. This paper uses an empirical study of in-house software coding practices in Australian companies to both demonstrate that there is an economic limit to how far testing should proceed as well as noting the deficiencies in the existing approaches.

AB - Using a quantitative study of in-house coding practices, we demonstrate the notion that programming needs to move from "Lines of Code per day" as a productivity measure to a measure that takes debugging and documentation into account. This could be something such as "Lines of clean, simple, correct, well-documented code per day", but with bugs propagating into the 6th iteration of patches, a new paradigm needs to be developed. Finding flaws in software, whether these have a security related cost or not, is an essential component of software development. When these bugs result in security vulnerabilities, the importance of testing becomes even more critical. Many studies have been conducted using the practices of large software vendors as a basis, but few studies have looked at in-house development practices. This paper uses an empirical study of in-house software coding practices in Australian companies to both demonstrate that there is an economic limit to how far testing should proceed as well as noting the deficiencies in the existing approaches.

KW - Empirical studies

KW - Model Checking

KW - Software Development Life Cycle

KW - Software Verification

U2 - 10.1007/978-3-642-21323-6

DO - 10.1007/978-3-642-21323-6

M3 - Conference paper

SN - 9783642213229

VL - 6694

T3 - Security and Cryptology

SP - 199

EP - 206

BT - Computational Intelligence in Security for Information Systems

A2 - Herrero, Ãlvaro

A2 - Corchado, Emilio

PB - Springer

CY - Germany

T2 - 4th International Conference on Computational Intelligence in Security for Information Systems

Y2 - 8 June 2011 through 10 June 2011

ER -

A quantitative analysis into the economics of correcting software bugs

Abstract

Publication series

Conference

Access to Document

Fingerprint

Cite this