BugSecure: Secure Crowdsourced Bug Bounty Platform for Vulnerability Managemen

We proposed BugSecure, a framework that enables the inte- gration of bug bounty programs with automated vulnerability management and secure development practices. Our evaluation showed promising improvements in the rate of vulnerabil- ity discoveries (40% increase in critical/high vulnerabilities discovered), time-to-triage (35% reduction in time-to-triage), time-to-validate (28% reduction in time-to-validate), and time- to-remediate (20% reduction in time-to-remediate) while keep- ing the FPR in automated triage below 15%. We strongly recommend the use of vulnerability disclosure policies [66], the integration of security in the development lifecycle [35], [51], and the use of both automated and human-driven testing approaches [28], [42]. The design and evaluation methodology of BugSecure are now available for the community, allowing researchers to build upon our work in the future, including reward program design [22], diversity in the researcher popu- lation [39], and the development of the legal framework [52] in the ongoing development of bug bounty programs

[1]     R. Karachiwalla and F. Pinkow, “A systematic literature review of crowdsourcing-based research in information security,” in Proc. Crowd- sourcing in Information Security, 2021. [2]     A. Sukumar, “Cyber risk assessment in small and medium-sized enter- prises (SMEs),” J. Cybersecurity SME, 2022. [3]     I. Dobák, “Crowdsourcing for security in the age of hybrid threats,” Security & Crowdsourcing, 2023. [4]     F. Igini, “The MTNK platform for making cybersecurity accessible to SMEs,” in Proc. Collaborative Security, 2022. [5]     J. Arshad, “A survey of bug bounty programs in strengthening cyberse- curity,” J. Cybersecurity Res., vol. 2, no. 3, pp. 10–25, 2024. [6]     M. Allamanis, E. T. Barr, P. Devanbu, and C. Sutton, “A survey of machine learning for big code and naturalness,” ACM Comput. Surv., vol. 51, no. 4, pp. 1–37, 2018. [7]     P. Anderson and R. Taylor, “Market for vulnerabilities: A reassessment,” J. Cybersecurity, vol. 5, no. 1, 2019. [8]     R. Anderson, Security Engineering: A Guide to Building Dependable Distributed Systems, 3rd ed. Wiley, 2020. [9]     A. Anton, J. Earp, and J. Young, “Measuring the effectiveness of privacy and security practices,” IEEE Secur. Privacy, vol. 11, no. 2, pp. 50–55, 2013. [10]    HackerOne, “HackerOne API documentation,” 2020. [Online]. Avail- able: https://api.hackerone.com