Quantitative Security Evaluation for Software System from Vulnerability Database

• 作者: Hiroyuki Okamura Masataka Tokuzane Tadashi Dohi
• 来源期刊: 软件工程与应用(英文)
• 学科: 工学
• 关键词: QUANTITATIVE Security Evaluation VULNERABILITY DATABASE NON-HOMOGENEOUS POISSON Process CONTENTS Management System
• 年，卷（期）: 2013,（4）
• 页码范围: 15-23
• 页数: 9页
• 分类号: TP39

摘要

This paper proposes a quantitative security evaluation for software system from the vulnerability data consisting of discovery date, solution date and exploit publish date based on a stochastic model. More precisely, our model considers a vulnerability life-cycle model and represents the vulnerability discovery process as a non-homogeneous Poisson process. In a numerical example, we show the quantitative measures for contents management system of an open source project.