Application of Vulnerability Discovery Models to Major Operating Systems

Alhazmi, Omar H.; Malaiya, Yashwant K.

doi:10.1109/tr.2008.916872

Cited by 118 publications

(94 citation statements)

References 12 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Operating system verifies users, identifying by using authentication mechanism [13][14][15] [18]. By default, Linux stores the passwords in either the etc/passwd.…”

Section: Linux Authenticationmentioning

confidence: 99%

Rapid and Proactive Approach on Exploration of Vulnerabilities in Cloud based Operating Systems

Ramachandran¹,

Ramachandran²

2012

IJCA

View full text Add to dashboard Cite

Clouds are a large pool of easily usable and accessible virtualized resources (such as hardware, development platforms and/or services). These assets can be dynamically reconfigured to adjust to a variable scale, allowing also for optimum resource utilization. This pool of resources is typically exploited by a pay-per-use model in which guarantees are offered by the infrastructure provider by means of customized service level agreement (SLA). Cloud computing was originally designed for dealing with problems involving large amounts of data and/or compute-intensive applications. The vulnerabilities inherent in the Cloud systems should be addressed so they can be eliminated before exploited by malicious software or hackers. Our approach plays a major role in detecting and managing vulnerabilities present in the Cloud infrastructure. Implementation of this methodology proves to be cost effective and saves analyzing time .

show abstract

“…Operating system verifies users, identifying by using authentication mechanism [13][14][15] [18]. By default, Linux stores the passwords in either the etc/passwd.…”

Section: Linux Authenticationmentioning

confidence: 99%

Rapid and Proactive Approach on Exploration of Vulnerabilities in Cloud based Operating Systems

Ramachandran¹,

Ramachandran²

2012

IJCA

View full text Add to dashboard Cite

show abstract

“…The model is based on the assumption that the vulnerability discovery process is controlled by the market share of the software and the number of vulnerabilities remaining undiscovered [8]. This model has been found to yield a significant goodness-of-fit for many widely used software systems [7,8,9,21]. However the plots of actual data sometimes show a departure from the model following the release of a new version [8].…”

Section: A Aml Vulnerability Discovery Modelmentioning

confidence: 99%

“…Recently, researchers have started investigating how the vulnerability discovery process can be described using some Vulnerability Discovery Model (VDM). Examples of VDMs include the work by Anderson, Rescorla, Alhazmi and Malaiya [5,6,7,8,9]. Each model uses a different approach and has several parameters.…”

Section: Introductionmentioning

confidence: 99%

“…We have compared source codes of 26 versions of Apache HTTP Web server (1.3.x) [15] and all the versions (75 versions) of Mysql DBMS (4.x and 5.x) [14] and collected their vulnerability data from NVD to find out relationship between evolution of the software and vulnerability detection. The model proposed for the single version [7,8,9] uses the hypothesis that the market share influences the vulnerability discovery rates. As the market share increases, so does the rate of vulnerability discovery.…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Vulnerability Discovery in Multi-Version Software Systems

Kim

Malaiya

Ray

2007

10th IEEE High Assurance Systems Engineering Symposium (HASE'07)

View full text Add to dashboard Cite

-The vulnerability discovery process for a program describes the rate at which the security vulnerabilities are discovered. Being able to predict the vulnerability discovery process allows developers to adequately plan for resource allocation needed to develop patches for them. It also enables the users to assess the security risks. Thus there is a need to develop a model of the discovery process that can predict the number of vulnerabilities that are likely to be discovered in a given time frame. Recent studies have produced vulnerability discovery process models that are suitable for a specific version of a software. However, these models may not accurately estimate the vulnerability discovery rates for a software when we consider successive versions. In this paper, we propose a new approach for quantitatively modeling the vulnerability discovery process, based on shared source code measurements among multiversion software systems. Such a modeling approach can be used for assessing security risk both before and after the release of a version. The applicability of the approach is examined using two open source software systems, viz., Apache HTTP Web server and Mysql DataBase Management System (DBMS). We have examined the relationship between shared code size and shared vulnerabilities between two successive versions. We observe that vulnerabilities continue to be discovered for an older version because part of its code is shared by the newer and more popular later version. Thus, even when the installed base of an older version has declined, vulnerabilities applicable to it are still discovered. Our results are validated using the source code and vulnerability data for two major versions of Apache HTTP Web server and two major versions of Mysql DBMS.

show abstract

“…12), E can be calculated for the windows operating systems (Ref. 12). Now let us use another model that uses effort as a factor to model vulnerability discovery.…”

Section: An Effort-based Known-vulnerability Discovery Modelmentioning

confidence: 99%

Quantitative vulnerability assessment of systems software

Alhazmi

Malaiya

Annual Reliability and Maintainability Symposium, 2005. Proceedings.

Self Cite

View full text Add to dashboard Cite

Operating systems represent complex interactive software systems that control access to information. Vulnerabilities present in such software represent significant security risks. In this paper, we examine the feasibility of quantitatively characterization of vulnerabilities. For Windows 98 and Windows NT 4.0, we present plots for cumulative numbers of vulnerabilities found. A time-based model for the total vulnerabilities discovered is proposed and is fitted to the data for two operating systems. We introduce a measure termed equivalent effort and propose an alternative model which is analogous to the software reliability growth models. We have shown that both models fit well and the fit is significant. We discuss the feasibility of using a new measure termed vulnerability density. We present the data on known defect densities for the two operating systems and discuss the relation between densities of vulnerabilities and the general defects. This relationship could lead us to potential ways of estimating the number of vulnerabilities in future.

show abstract

Application of Vulnerability Discovery Models to Major Operating Systems

Cited by 118 publications

References 12 publications

Rapid and Proactive Approach on Exploration of Vulnerabilities in Cloud based Operating Systems

Rapid and Proactive Approach on Exploration of Vulnerabilities in Cloud based Operating Systems

Vulnerability Discovery in Multi-Version Software Systems

Quantitative vulnerability assessment of systems software

Contact Info

Product

Resources

About