This paper reports an analysis of the software (SW) safety testing techniques, as well as the models and methods for identifying vulnerabilities. An issue has been revealed related to the reasoned selection of modeling approaches at different stages of the software safety testing process and the identification of its vulnerabilities, which reduces the accuracy of the modeling results obtained. Two steps in the process of identifying software vulnerabilities have been identified. A mathematical model has been built for the process of preparing security testing, which differs from the known ones by a theoretically sound choice of the moment-generating functions when describing transitions from state to state. In addition, the mathematical model takes into consideration the capabilities and risks of the source code verification phase for cryptographic and other ways to protect data. These features generally improve the accuracy of modeling results and reduce input uncertainty in the second phase of software safety testing. An advanced security compliance algorithm has been developed, with a distinctive feature of the selection of laws and distribution parameters that describe individual state-to-state transitions for individual branches of Graphical Evaluation and Review Technique networks (GERT-networks). A GERT-network has been developed to prepare for security testing. A GERT-network for the process of checking the source code for cryptographic and other data protection methods has been developed. A graphic-analytical GERT model for the first phase of software safety testing has been developed. The expressions reported in this paper could be used to devise preliminary recommendations and possible ways to improve the effectiveness of software safety testing algorithms
This paper has determined the relevance of the issue related to improving the accuracy of the results of mathematical modeling of the software security testing process. The fuzzy GERT-modeling methods have been analyzed. The necessity and possibility of improving the accuracy of the results of mathematical formalization of the process of studying software vulnerabilities under the conditions of fuzziness of input and intermediate data have been determined. To this end, based on the mathematical apparatus of fuzzy network modeling, a fuzzy GERT model has been built for investigating software vulnerabilities. A distinctive feature of this model is to take into consideration the probabilistic characteristics of transitions from state to state along with time characteristics. As part of the simulation, the following stages of the study were performed. To schematically describe the procedures for studying software vulnerabilities, a structural model of this process has been constructed. A "reference GERT model" has been developed for investigating software vulnerabilities. The process was described in the form of a standard GERT network. The algorithm of equivalent transformations of the GERT network has been improved, which differs from known ones by considering the capabilities of the extended range of typical structures of parallel branches between neighboring nodes. Analytical expressions are presented to calculate the average time spent in the branches and the probability of successful completion of studies in each node. The calculation of these probabilistic-temporal characteristics has been carried out in accordance with data on the simplified equivalent fuzzy GERT network for the process of investigating software vulnerabilities. Comparative studies were conducted to confirm the accuracy and reliability of the results obtained. The results of the experiment showed that in comparison with the reference model, the fuzziness of the input characteristic of the time of conducting studies of software vulnerabilities was reduced, which made it possible to improve the accuracy of the simulation results.
The subject of research in the article is a way for evaluating the effectiveness of the software security improving method. The aim of the article – study of the effectiveness of the software security improving method and substantiation of practical recommendations for its use. Tasks to be solved: analysis of methods for describing the software security testing process and evaluating its effectiveness, developing a scheme and method for evaluating the effectiveness of a method for improving software security, developing a simulation model for the software security testing process, studying the effectiveness of a method for improving software security, researching and substantiating the reliability of the results obtained, developing practical recommendations for using the method. Applied methods: system analysis, project approach, heuristic methods of decision making, process models. The results obtained: The analysis of the features of the ways for describing the software security testing process and evaluating its effectiveness showed the possibility of taking into account many factors by using the method of dynamics of averages. A way for evaluating the effectiveness of a method for improving software security has been developed, which differs from the known ones by taking into account the scaling factor of the software development process by introducing security testing specialists. With the help of an improved method, the hypothesis of increasing the efficiency of the security process using the developed method by reducing the relative damage indicator at all stages of the software life cycle, depending on the possible duration of a cyber-intrusion, was proved. The substantiation of the reliability of the results of mathematical modeling has been carried out. A number of practical recommendations on the use of the method of improving software security are given and some shortcomings are highlighted, which allow the conclusion that further research is possible.
scite is a Brooklyn-based organization that helps researchers better discover and understand research articles through Smart Citations–citations that display the context of the citation and describe whether the article provides supporting or contrasting evidence. scite is used by students and researchers from around the world and is funded in part by the National Science Foundation and the National Institute on Drug Abuse of the National Institutes of Health.
hi@scite.ai
10624 S. Eastern Ave., Ste. A-614
Henderson, NV 89052, USA
Copyright © 2024 scite LLC. All rights reserved.
Made with 💙 for researchers
Part of the Research Solutions Family.