Empirical Research for Software Security