Measuring and enhancing prediction capabilities of vulnerability discovery models for apache and IIS HTTP servers

Proceedings - International Symposium on Software Reliability Engineering, ISSRE

Volumn , Issue , 2006, Pages 343-352

  Alhazmi, Omar H ^a   Malaiya, Yashwant K ^a  

^a Department of Environmental and Radiological Health Sciences   (United States)

Author keywords

[No Author keywords available]

Indexed keywords

AML MODEL; POTENTIAL SECURITY RISKS; VULNERABILITY DISCOVERY MODELS;

DATA STRUCTURES; MATHEMATICAL MODELS; PARAMETER ESTIMATION; SERVERS;

HTTP;

EID: 34547666862     PISSN: 10719458     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/ISSRE.2006.26     Document Type: Conference Paper

References (26)

1. R. Ford, H. Thompson, and F. Casteran, F. Role comparison report-web server role. Technical Report, Security Innovation, 2005.
2. E. E. Schultz, D.S. Brown, and T. A. Longstaff, Responding to computer security incidents. Lawrence Livermore National Laboratory (July 1990).
3. National Vulnerability Database, http://nvd.nist.gov/.
4. Mitre Corp, Common Vulnerabilities and Exposures, http://www.cve. mitre.org/.
5. Apache Software Foundation Bug System, http://issues.apache.org/bugzilla/ .
6. Security focus, http://www.securityfocus.com/.
7. D. Moore, C. Shannon, and K. C. Claffy, Code-red: a case study on the spread and victims of an internet worm. In Internet Measurement Workshop (2002), pp. 273-284.
8. R. Anderson, Security in open versus closed systems - the dance of Boltzmann, Coase and Moore. In Conf. on Open Source Software: Economics, Law and Policy (2002), 1-15.
9. th Annual IEEE Conference on Computer Assurance (1994), 257-266.
10. J. Hallberg, A. Hanstad, and M. Peterson, A framework for system security assessment. Proc. 2001 IEEE Symposium on Security and Privacy (May 2001), 214-229.
11. H. K. Browne, W. A. Arbaugh, J. McHugh, and W. L. Fithen, A trend analysis of exploitations. In IEEE Symposium on Security and Privacy (2001), 214-229.
12. E. Rescorla, Security holes... who cares? Proc. 12th USENIX Security Symposium (2003), 75-90.
13. E. Rescorla, Is finding security holes a good idea? IEEE Security and Privacy 03, 1 (2005), 14-19.
14. O. H. Alhazmi and Y. K. Malaiya, Quantitative vulnerability assessment of system software. Proc. Annual Reliability and Maintainability Symposium (Jan. 2005), 615-620.
15. O. H. Alhazmi, Y. K. Malaiya, and I. Ray, Security vulnerabilities in software systems: A quantitative perspective. Proc. Ann. IFIP WG11.3 Working Conference on Data and Information Security (Aug. 2005), 281-294.
16. th International Symposium on Software Reliability Engineering (Nov. 2005), 129-138.
17. J. Musa, Software Reliability Engineering. McGraw-Hill, 1999.
18. M. R. Lyu, Handbook of Software Reliability. McGraw-Hill, 1995.
19. A. Ozment and S. E. Schechter, Milk or Wine: Does Software Security Improve with Age? Pro. 15th USENIX Security Symposium (July-August 2006) pp. 93-104
20. O. H. Alhazmi and Y. K. Malaiya, Prediction capability of vulnerability discovery process. Proc. Reliability and Maintainability Symposium (Jan. 2006), 86-91.
21. Netcraft, http://news.netcraft.com/.
22. Y. K. Malaiya, N. Karunanithi, and P. Verma. "Predictability of software reliability models," IEEE Transactions on Reliability, Vol. 41, No. 4, December 1992, 539-546.
23. th International Symposium on Software Reliability Engineering (Nov. 1993), 71-79.
24. R. Seacord, Secure Coding in C and C++. Addison Wisely, 2005.
25. M. Sahinoglu, Quantitative risk assessment for dependent vulnerabilities. Proc. Reliability and Maintainability Symposium (Jan. 2006), 82-85.
26. W. Sung-Whan, O. H. Alhazmi, and Y. K. Malaiya, Assessing Vulnerabilities in Apache and IIS HTTP Servers, Proc. IEEE International Symposium on Dependable Autonomic and Secure Computing (DASC06), (Sept.-Oct. 2006).