Vulnerability Scrying Method for Software Vulnerability Discovery Prediction without a Vulnerability Database
Document Type
Article
Publication Date
6-2013
Publication Source
IEEE Transactions on Reliability
Abstract
Predicting software vulnerability discovery trends can help improve secure deployment of software applications and facilitate backup provisioning, disaster recovery, diversity planning, and maintenance scheduling. Vulnerability discovery models (VDMs) have been studied in the literature as a means to capture the underlying stochastic process. Based on the VDMs, a few vulnerability prediction schemes have been proposed. Unfortunately, all these schemes suffer from the same weaknesses: they require a large amount of historical vulnerability data from a database (hence they are not applicable to a newly released software application), their precision depends on the amount of training data, and they have significant amount of error in their estimates. In this work, we propose vulnerability scrying, a new paradigm for vulnerability discovery prediction based on code properties. Using compiler-based static analysis of a codebase, we extract code properties such as code complexity (cyclomatic complexity), and more importantly code quality (compliance with secure coding rules), from the source code of a software application. Then we propose a stochastic model which uses code properties as its parameters to predict vulnerability discovery. We have studied the impact of code properties on the vulnerability discovery trends by performing static analysis on the source code of four real-world software applications. We have used our scheme to predict vulnerability discovery in three other software applications. The results show that even though we use no historical data in our prediction, vulnerability scrying can predict vulnerability discovery with better precision and less divergence over time.
Inclusive pages
395-407
ISBN/ISSN
0018-9529
Copyright
Copyright © 2013, IEEE. Personal use of this material is permitted. Permission from IEEE must be obtained for all other uses, in any current or future media, including reprinting/republishing this material for advertising or promotional purposes, creating new collective works, for resale or redistribution to servers or lists, or reuse of any copyrighted component of this work in other works.
Publisher
Institute of Electrical and Electronics Engineers
Volume
62
Peer Reviewed
yes
Issue
2
eCommons Citation
Rahimi, Sanaz and Zargham, Mehdi, "Vulnerability Scrying Method for Software Vulnerability Discovery Prediction without a Vulnerability Database" (2013). Computer Science Faculty Publications. 160.
https://ecommons.udayton.edu/cps_fac_pub/160
COinS
Comments
Permission documentation on file.