Analysis and Modeling of Android Software Vulnerabilities: A Numerical Approach

Abstract

A software security vulnerability is a mistake or violation of the security policy that occurs during the creation or development of the software. A vulnerability discovery model is a structure enabling the prediction of software security vulnerabilities that might occur after the software is released. In a more general sense, modeling is the method that allows us to analyze a phenomenon in detail and make accurate predictions for the future. The model must be able to explain the target environment in the best way possible and make the best predictions possible. Recently, there have been many studies on the subject of modeling security vulnerabilities. Most of these studies are concerned with desktop operating systems and internet browsers. Although there are studies based on the most popular mobile operating system, Android, there has never been a study that investigates different statistical distributions to find the most suitable one. The most popular model for vulnerability prediction is the Alhazmi-Malaiya Logistic (AML) model. This model has been observed to achieve better performance than other models in modeling security vulnerabilities. The AML model is similar to a logistic distribution, which has a symmetrical structure. In this study, certain aspects of Android security vulnerabilities were investigated using some symmetric and asymmetric distributions that are close to the AML distribution. The data used in this study was obtained from the National Vulnerability Database (NVD) by filtering Android vulnerabilities from 2016 to 2018, a time interval in which monthly information was continuously available. Furthermore, with the 0 to 10 scoring data obtained from the Common Vulnerability Scoring System (CVSS), the average monthly impact values of vulnerabilities have also been modeled. Logistic, Weibull, Normal, Nakagami, Gamma, and Log-logistic distributions were used to model the average monthly impact values of vulnerabilities, and the Logistic, Weibull, Nakagami, Gamma, and Log-logistic distributions were used to model the monthly vulnerability count. From the goodness-of-fit tests, which are methods to establish how well sample data matches the expected distribution values, Kolmogorov-Smirnov, Anderson-Darling, and Cramer-von Mises tests were applied. Akaike and Bayesian Information Criteria and Log-likelihood were used to see how robust the models were. As a result, the average monthly impact value and the monthly vulnerability count were observed to be best modeled by the Logistic and Nakagami distributions, respectively. Vulnerability detection models help us forecast software vulnerabilities and enable the necessary precautions to be taken, such as planning the generation of a patch. With suitable distributions, it has been shown that Android vulnerabilities can be modeled and forecasts can be made.