應用加強型單一變動點模型於軟體弱點分佈之分析與評估

Analysis and Evaluation of Enhanced Single Change-Point Model for Software Vulnerability Distribution

石欣恩(Shih, Shin En)

指導教授 ： 黃慶育

國立清華大學/電機資訊學院/資訊工程學系/碩士(2015年)

https://doi.org/10.6843/NTHU.2015.00634

摘要

軟體安全性在現今軟體開發過程中被視為一個相當重要的課題。而軟體安全性評估之度量標準則普遍以軟體弱點數目作為主要的準則。軟體弱點預測模型作為描述和預測未來的軟體弱點數目扮演著重要的角色，適切的軟體弱點預測模型可以幫助專案管理人員決定軟體的釋出時間及降低軟體內部的可能風險。過去的研究顯示Alhazmi-Malaiya Logistic 模型及Weibull distribution模型分別在描述S型曲線和指數型態的軟體弱點分佈有良好的表現。有鑑於軟體弱點模型多有在短時間內快速躍昇的特性，因而將弱點模型與變動點之概念作結合。
本研究就軟體弱點分佈的常態提出具有單一變動點的Alhazmi-Malaiya Logistic 模型及Weibull distribution模型，並提出變動點之選擇方式。基於Android 3.0與Windows XP sp3作為實驗資料之研究分析結果，增加單一變動點之軟體弱點模型在適合度檢定中的表現皆優於未加變動點之原始模型，且與其他軟體弱點預測模型的比較中，顯示出較優異的預測能力。由此可顯示此研究提出之具有單一變動點的Alhazmi-Malaiya Logistic 模型及Weibull distribution模型可以良好的預測軟體弱點分佈型態。

關鍵字

軟體安全性 ； 軟體弱點分佈 ； 軟體弱點預測模型

並列摘要

Software security is a crucial issue in software implementation processes. There is a general agreement in literature that software vulnerability metrics are major measures within software product security assessments. A vulnerability discovery model (VDM) describes and predicts software vulnerability occurrence rates and tendencies. Proper VDMs could help to determine the estimated release date while mitigating risk in delivering software products to market. Software reliability growth models (SRGMs) applied to software vulnerability discovery processes exists. However, there have been an increased number of VDMs proposed with increased software security concerns. Among the various models, the Alhazmi-Malaiya logistic model (AML) within the inflection s-shaped model family and Weibull distribution model (WB) within the exponential family show high performance in vulnerability predictions. In this work, we provide an analysis of enhanced VDMs with a single change-point, based on WB and AML. We utilize the model by making the change-point selection adhere to the vulnerability explosion characteristic of the software security-related defects. Our research focuses on seven experimental models’ performance on fitness of vulnerability data in a vast range of software types. The vulnerability data in this work is collected from the National Vulnerability Database (NVD). With the vulnerability data, the capability for a model to fit is demonstrated via diversified fitness tests and criteria. Comparisons are drawn on the data results utilizing seven various models. Models with a change-point perform relatively well due to software vulnerability data curves having similar characteristics. The data curves with rapid jumps show the Weibull distribution model with single change-point (WBCP) and the Alhazmi-Malaiya logistic model with single change-point (AMLCP) better fitting models. Our results have positive implications for analyzing vulnerability distribution.

並列關鍵字

Software vulnerability ； Vulnerability discovery model ； Software security ； Weibull distribution model ； Alhazmi-Malaiya logistic Model ； change point

參考文獻

[3] O. H. Alhazmi, and Y. K. Malaiya, "Modeling the Vulnerability Discovery Process." Proceedings of 16th International Symposium on Software Reliability Engineering (ISSRE 2005), Nov. 2005.

[5] O. H. Alhazmi, and Y. K. Malaiya, "Measuring and Enhancing Prediction Capabilities of Vulnerability Discovery Models for Apache and IIS HTTP Servers," Proceedings of 17th International Symposium on Software Reliability Engineering (ISSRE 2006), Nov. 2006.

[6] O. H. Alhazmi,, Y. K. Malaiya, and I. Ray, "Measuring, Analyzing and Predicting Security Vulnerabilities in Software Systems," Computers & Security, Vol. 26, No. 3, pp. 219-228, 2007.

[7] E. Rescola, “Is Finding Security Holes a Good Idea?,” IEEE Security and Privacy, Vol. 3, Issue 1, pp.14–19, Feb. 2005.

[8] J. D. Musa, and K. Okumoto, "A Logarithmic Poisson Execution Time Model for Software Reliability Measurement," Proceedings of the 7th international conference on Software engineering, pp. 230–238, Sep. 1984.