<![CDATA[Software vulnerabilities in open-source components can directly affect the confidentiality, integrity, and availability of digital business services. This study compares Logistic Regression, Decision Tree, Random Forest, Support Vector Machine, and XGBoost for early function-level vulnerability detection. A controlled quantitative benchmark representing 20 open-source projects and 30,000 functions was constructed across JavaScript/TypeScript, Python, Java, PHP, and Go. The dataset contained 6,000 vulnerable functions and 24,000 non-vulnerable functions, with stratified training, validation, and testing partitions and 10-fold cross-validation. Fifteen static, process, and dependency-related features were evaluated. XGBoost achieved the strongest test performance with 94.80% accuracy, 84.91% precision, 90.00% recall, 87.38% F1-score, 96.00% specificity, and 96.20% ROC-AUC. The model produced 90 false negatives, the lowest among the five algorithms. Cross-validation showed stable results with 94.50% mean accuracy and 0.40% standard deviation. Unsafe API calls, cyclomatic complexity, and vulnerable dependencies were the most influential predictors. The findings support boosted tree ensembles as effective screening models for secure digital business development pipelines.]]>
Copyrights © 2026
