Cluster-based vulnerability assessment of operating systems and web browsers

Abstract

Organizations face the issue of how to best allocate their security resources. Thus, they need an accurate method for assessing how many new vulnerabilities will be reported for the operating systems (OSs) and web browsers they use in a given time period. Our approach consists of clustering vulnerabilities by leveraging the text information within vulnerability records, and then simulating the mean value function of vulnerabilities by relaxing the monotonic intensity function assumption, which is prevalent among the studies that use software reliability models (SRMs) and nonhomogeneous Poisson process in modeling. We applied our approach to the vulnerabilities of four OSs (Windows, Mac, IOS, and Linux) and four web browsers (Internet Explorer, Safari, Firefox, and Chrome). Out of the total eight OSs and web browsers we analyzed using a power-law model issued from a family of SRMs, the model was statistically adequate for modeling in six cases. For these cases, in terms of estimation and forecasting capability, our results, compared to a power-law model without clustering, are more accurate in all cases but one.

Predicting the Discovery Pattern of Publically Known Exploited Vulnerabilities

“…While a number of studies utilize vulnerability data associated with separate version of software (e.g. Windows 7) on which to apply VDMs [20], [28], there are papers that consider all versions of a software together [23], [32]. The first group expects that each version of a given software is an independent and all around characterized item, yet distinguishing the sources of reliance in vulnerability data is not a simple task.…”

“…Allodi [31] demonstrated that discovered vulnerabilities may pursue a Power-law distribution. The model utilized in this paper was applied on vulnerability data as a VDM in [32], [33]. The main assumption of this model is that the number of discovered vulnerabilities pursues a nonhomogeneous Poisson process.…”

“…We leveraged the vulnerability CVE IDs to compare the reporting date of each vulnerability in NVD with the dates in other public repositories on vulnerabilities 1 . We updated the reporting dates to the earliest date that a given vulnerability was publically known in any of the vulnerability databases used [33]. To obtain exploited vulnerability data, we used Exploit Database (EDB) 2 .…”

Vulnerability prediction capability: A comparison between vulnerability discovery models and neural network models

“…Several studies applied existing VDMs or a modified versions of them to different types of software packages, such as OSs and web servers, to simulate the vulnerability discovery rate and predict the number of vulnerabilities that may potentially be present but not yet found [14]- [17]. Other studies tried to increase the accuracy of vulnerability discovery modeling by taking the skewness of the vulnerability data into consideration [8] or using the clustering techniques [18], [19], commonly used in social media studies [20] .…”

The Effectiveness of the Squared Error and Higgins-Tsokos Loss Functions on the Bayesian Reliability Analysis of Software Failure Times under the Power Law Process

“…The NHPP has been used for analyzing software's failure times, and prediction of the next failure time. The subject model has been shown to be effective and useful not only in software reliability assessment [2]- [11], but also in cybersecurity; the attack detection in cloud systems [12] [13], breast and skin cancer treatments' effectiveness, [14] [15] [16], respectively, finance; modeling of financial markets at the ultra-high frequency level [17], trnasportation; modeling passengers' arrivals [18] [19] [20] [21] [22], and in the formulation of a software cost model [23].…”