Modeling the Vulnerability Discovery Process

Abstract

Security vulnerabilities in servers and operating systems are software defects that represent great risks.Both software developers and users are struggling to contain the risk posed by these vulnerabilities. The vulnerabilities are discovered by both developers and external testers throughout the life-span of a software system. A few models for the vulnerability discovery process have just been published recently.Such models will allow effective resource allocation for patch development and are also needed for evaluating the risk of vulnerability exploitation. Here we examine these models for the vulnerability discovery process. The models are examined both analytically and using actual data on vulnerabilities discovered in three widely-used systems. The applicability of the proposed models and significance of the parameters involved are discussed. The limitations of the proposed models are examined and major research challenges are identified.

Vulnerability Discovery in Multi-Version Software Systems

“…where B represents the estimated total number of vulnerabilities and the parameters A and C determine the shape of the curve [7]. The model is based on the assumption that the vulnerability discovery process is controlled by the market share of the software and the number of vulnerabilities remaining undiscovered [8].…”

“…The model is based on the assumption that the vulnerability discovery process is controlled by the market share of the software and the number of vulnerabilities remaining undiscovered [8]. This model has been found to yield a significant goodness-of-fit for many widely used software systems [7,8,9,21]. However the plots of actual data sometimes show a departure from the model following the release of a new version [8].…”

“…Recently, researchers have started investigating how the vulnerability discovery process can be described using some Vulnerability Discovery Model (VDM). Examples of VDMs include the work by Anderson, Rescorla, Alhazmi and Malaiya [5,6,7,8,9]. Each model uses a different approach and has several parameters.…”

“…We have compared source codes of 26 versions of Apache HTTP Web server (1.3.x) [15] and all the versions (75 versions) of Mysql DBMS (4.x and 5.x) [14] and collected their vulnerability data from NVD to find out relationship between evolution of the software and vulnerability detection. The model proposed for the single version [7,8,9] uses the hypothesis that the market share influences the vulnerability discovery rates. As the market share increases, so does the rate of vulnerability discovery.…”

Assessing Vulnerabilities in Apache and IIS HTTP Servers

“…In [12], Rescorla has studied vulnerabilities in open source servers. The vulnerabilities discovery process in operating systems has just recently been examined by Rescorla [13] and by Alhazmi and Malaiya [14,15,16].…”