Vulnerability discovery in multi-version software systems

Proceedings of IEEE International Symposium on High Assurance Systems Engineering

Volumn , Issue , 2007, Pages 141-148

  Kim, Jinyoo ^a   Malaiya, Yashwant K ^a   Ray, Indrakshi ^a  

^a Colorado State University   (United States)

Author keywords

[No Author keywords available]

Indexed keywords

BEFORE AND AFTER; CODE SIZE; DISCOVERY PROCESS; HIGH ASSURANCE SYSTEMS; INTERNATIONAL SYMPOSIUM; MODELING APPROACHES; MULTI-VERSION; MYSQL DATABASE; NEW APPROACHES; OPEN SOURCE SOFTWARE SYSTEMS; SECURITY RISKS; SECURITY VULNERABILITIES; SOFTWARE SYSTEMS; SOURCE CODING; TIME FRAMES; VULNERABILITY DISCOVERY; WEB SERVERS;

ADMINISTRATIVE DATA PROCESSING; CODES (STANDARDS); CODES (SYMBOLS); COMPUTER SOFTWARE; DATABASE SYSTEMS; DYNAMIC PROGRAMMING; HTTP; INDUSTRIAL ENGINEERING; INFORMATION DISSEMINATION; MANAGEMENT INFORMATION SYSTEMS; OPEN SYSTEMS; PLANNING; RESOURCE ALLOCATION; RISK ASSESSMENT; RISK MANAGEMENT; RISK PERCEPTION; SYSTEMS ENGINEERING; TECHNICAL PRESENTATIONS; TECHNOLOGY; WEB SERVICES; WORLD WIDE WEB;

SECURITY OF DATA;

EID: 48349133535     PISSN: 15302059     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/HASE.2007.78     Document Type: Conference Paper

References (22)

1. National Vulnerabilities Database, http://nvd.nist.gov, 2006
2. Y. K. Malaiya, J. Denton, "What Do the Software Reliability Growth Model Parameters Represent?" Int. Symp. on Software Reliability Engineering, 1997. pp. 124-135.
3. ReliaSoft Publishing, "Reliability Growth and Repairable System Data Analysis Reference", http://www.weibull.com/relgrowthwebcontents.htm
4. J. D. Musa, A. Ianino, K. Okumuto, "Software Reliability Measurement Prediction Application", McGraw-Hill, 1987.
5. R. Anderson, "Why information security is hard - An Economical Prospective", Proceedings of the 17th annual Computer Security applications conference, 2001, pp. 358-365.
6. E. Rescorla, "Is finding security holes a good idea?", In Workshop on Economics and Information Security, 2004. Minneapolis, Minnesota, pp. 14-19.
7. O. H. Alhazmi and Y. K. Malaiya, "Modeling the Vulnerability Discovery Process," Proc. Int. Symp. Software Reliability Eng, Nov. 2005, pp. 129-138.
8. O. H. Alhazmi, Y. K. Malaiya, I. Ray, "Measuring, Analyzing and Predicting Security Vulnerabilities in Software Systems," Computers and Security Journal, Volume 26, Issue 3, May 2007, pp. 219-228
9. O. H. Alhazmi, Y. K. Malaiya, "Application of Vulnerability Discovery Models to Major Operating Systems," to appear in IEEE Trans. Reliability, Dec 2007.
10. S. G Eick, T. L. Graves, A. F. Karr, J. S. Marron, A. Mockus, "Does Code Decay? Assessing the Evidence from Change Management Data," IEEE Transactions on Software Engineering, 2001, 27(1), pp. 1-12.
11. C. Izurieta, J. Bieman, "The Evolution of FreeBSD and Linux", ISESE'06, September 21-22, 2006, Rio de Janeiro, Brazil, pp. 204-211.
12. A. Ozment, "Software security growth modeling: Examining vulnerabilities with reliability growth models." In Proceedings of the First Workshop on Quality of Protection, September 2005, Milan, Italy, pp. 223-233.
13. Netcraft, "April 2007 Web Server Survey", http://news.netcraft. com/archives/Web_server_survey.html
14. The Mysql Product achieve, http://downloads.mysql.com/archives.php (2006)
15. The Apache Software Foundation achieve, http://archive.apache.org/dist/ httpd (2006)
16. A. Mockus, R. T. Fielding, J. D. Herbsleb, "A case study of open source software development: the apache server", In ICSE (2000), pp. 263-272.
17. M. W. Godfrey, Q. Tu, "Evolution in open source software: A case study", In ICSM(2000), pp. 131-142.
18. Counting Source Lines of Code (SLOC), http://www.dwheeler.com/sloc/
19. MITRE, http://www.mitre.org
20. A. Ozment, S. E. Schechter. "Milk or Wine: Does Software Security Improve with Age?", Proceedings of The Fifteenth Usenix Security Symposium. July 31 - August 4 2006, Vancouver, BC, Canada, pp. 31-39.
21. S.W. Woo, O. H. Alhazmi, Y. K. Malaiya, "Assessing Vulnerabilities in Apache and IIS HTTP Servers", (DASC'06), September 29-October, 2006, Indianapolis, USA, pp. 103-110.
22. S-W. Woo, "An Analysis of Vulnerabilities in Webservers and Browsers Using Time based and Effort-based Models," Thesis, CS Dept, Colorado State University, 2006.