Seasonal variation in the vulnerability discovery process

Proceedings - 2nd International Conference on Software Testing, Verification, and Validation, ICST 2009

Volumn , Issue , 2009, Pages 191-200

  Joh, HyunChul ^a   Malaiya, Yashwant K ^a  

^a Colorado State University   (United States)

Author keywords

[No Author keywords available]

Indexed keywords

AUTOCORRELATION FUNCTIONS; DATA SETS; FIREFOX; INTERNET EXPLORERS; MAC OS X; MICROSOFT; OPERATING SYSTEMS; RED HATS; SEASONAL PATTERNS; SEASONAL VARIATION; SEASONALITY; SECURITY RISKS; SOFTWARE PRODUCTS; SOFTWARE SYSTEMS; SOLARIS; STATISTICAL SIGNIFICANCE; VULNERABILITY DISCOVERY; WEB SERVERS; WINDOWS NT;

COMPUTER SOFTWARE SELECTION AND EVALUATION; MATHEMATICAL MODELS; REGRESSION ANALYSIS; RISK PERCEPTION; SECURITY OF DATA; SERVERS; SOFTWARE TESTING; TIME SERIES; TIME SERIES ANALYSIS; VERIFICATION; WINDOWS OPERATING SYSTEM; WORLD WIDE WEB;

WEB BROWSERS;

EID: 67650114104     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/ICST.2009.9     Document Type: Conference Paper

References (34)

1. Symantec. Symantec Global Internet Security Threat Report: Trends for July-December 07. Volume XIII, Published April 2008.
2. S. Heston and R. Sadka, "Seasonality in the crosssection of stock returns," Journal of Financial Economics, Vol. 87 Issue 2, Feb 2008, pp. 418-445.
3. N. Tran and D. A. Reed, "Automatic ARIMA Time Series Modeling for Adaptive I/O Prefetching," IEEE Transactions on Parallel and Distributed Systems, Vol. 15, No. 2, Feb 2004, pp. 362-377.
4. M. Rios, J. M. Garcia, J. A. Sanchez, and D. Perez, "A Statistical Analysis of the Seasonality in Pulmonary Tuberculosis," European Journal of Epidemiology, Vol. 16, No. 5, May 2000, pp. 483-488. (Pubitemid 30680649)
5. A. Salehian, "ARIMA time series modeling for forecasting thermal rating of transmission lines," Transmission and Distribution Conference and Exposition, 2003 IEEE PES.
6. J. Maes, S. Van Damme, P. Meire and F. Ollevier, "Statistical modeling of seasonal and environmental influences on the population dynamics of an estuarine fish community," Marine Biology, Vol. 145, No. 5, Oct 2004, pp. 1033-1042. (Pubitemid 39415346)
7. J . Carrión-Baralt , C . Smith , E . Rossy-Fullana , R . Lewis-Fernández , K . Davis , and J . Silverman, "Seasonality effects on schizophrenic births in multiplex families in a tropical island," Psychiatry Research, Vol. 142 , Issue 1, 2006, pp 93 - 97. (Pubitemid 43775795)
8. B. Jacobsen and N. Visaltanachoti, "The Halloween Effect in US Sectors," May 8, 2006. Available: http://ssrn.com/abstract=901088, Dec 28, 2008.
9. N. Jegadeesh, "Evidence of Predictable Behavior of Security Returns," The Journal of Finance, Vol. 45, No. 3, Papers and Proceedings, Forty-ninth Annual Meeting, American Finance Association, Atlanta, Georgia, Dec 28-30, 1989 (Jul., 1990), pp. 881-898.
10. H. Joh and Y. K. Malaiya, "Seasonality in Vulnerability Discovery in Major Software Systems," Fast Abstract, Proc. Int. Symp. Software Reliability Eng., Nov 2008, pp. 297-298.
11. C. P. Pfleeger and S. L. Pfleeger, Security in Computing, Third Edition, Prentice Hall PTR, 2003.
12. O. H. Alhazmi and Y. K. Malaiya, "Modeling the Vulnerability Discovery Process," Proc. Int. Symp. Software Reliability Eng, Nov 2005, pp. 129-138. (Pubitemid 44733896)
13. A. Ozment and S. E. Schechter "Milk or Wine: Does Software Security Improve with Age?", The 15th USENIX Security Symposium, Jul 31-Aug 4, 2006, pp. 93-104.
14. A. Ozment, "Improving vulnerability discovery models," In Proceedings of the 2007 ACM Workshop on Quality of Protection (Alexandria, Virginia, USA, Oct 29 - 29, 2007). ACM, New York, NY, pp. 6-11.
15. O. H. Alhazmi and Y. K. Malaiya, "Application of Vulnerability Discovery Models to Major Operating Systems," IEEE Trans. Reliability, Mar 2008, pp. 14-22.
16. H. Joh, J. Kim and Y. K. Malaiya, "Vulnerability Discovery Modeling using Weibull Distribution," Fast Abstract, Proc. Int. Symp. Software Reliability Eng., Nov 2008, pp. 299-300.
17. S-W. Woo, O. H. Alhazmi and Y. K. Malaiya, "An Analysis of the Vulnerability Discovery Process in Web Browsers", Proc. 10th IASTED Int. Conf. on Software Engineering and Applications, Nov 2006.
18. S-W. Woo, O. H. Alhazmi and Y. K. Malaiya, "Assessing Vulnerabilities in Apache and IIS HTTP Servers", Proc. IEEE Int. Symp. on Dependable, Autonomic and Secure Computing (DASC'06), Sep-Oct 2006, pp. 103-110. (Pubitemid 350237449)
19. J. Kim, Y. K. Malaiya and I. Ray, "Vulnerability Discovery in Multi-Version Software Systems," Proc. 10th IEEE Int. Symp. on High Assurance System Engineering (HASE), Dallas, Nov 2007, pp. 141-148.
20. E. Condon, A. He and M. Cukier, "Analysis of Computer Security Incident Data Using Time Series Models," Proc. Int. Symp. Software Reliability Eng., Nov 2008, pp. 77-86.
21. Forum of Incident Response and Security Teams (FIRST). Common Vulnerability Scoring System (CVSS). Available: http://www. first.org/cvss/ cvssguide. html, Apr 10, 2008.
22. National Institute of Standards and Technology. National Vulnerability Database. Available: http://nvd. nist.gov/download.cfm, Mar 31, 2008.
23. Open Source Vulnerability Database (OSVDB). Available: http://osvdb.org, Apr 10, 2008.
24. Department of Homeland Security. US-CERT Vulnerability Notes Database. Available: http://www.kb.cert.org/vuls, Apr 10, 2008.
25. Secunia. Available: http://secunia.com, May 3, 2008.
26. Common Vulnerability Scoring System, Available: http://cve.mitre.org , Dec 20, 2008.
27. H. Arsham. Time-Critical Decision Making for Business Administration. Available: http:// home.ubalt. edu/ntsbarsh/Business-stat/stat-data/Forecast. htm#rseas onindx, Mar 31, 2008.
28. B. L. Bowerman and R. T. O'connell, Time Series Forecsting: Unified concepts and computer implementation, 2nd Ed., Boston: Duxbury Press, 1987.
29. A. Jaquith, Security Metrics: Replacing Fear, Uncertainty, and Doubt, Addison-Wesley Professional, 2007.
30. A. Senter. A Summary of Forecasting Methods. Available:http://userwww. sfsu.edu/~efc/classes/biol710/timeseries/timeseries1.htm, Mar 31, 2008.
31. E. Rescorla, "Is Finding Security Holes a Good Idea?" IEEE Security and Privacy, Vol. 3, No. 1. Jan-Feb 2005, pp. 14-19. (Pubitemid 40325577)
32. DEFCON. DEF CON Communications, Inc. Available: https://www.defcon.org/ main.html, Mar 31, 2008.
33. A. Arora and R. Telang, "Economics of Software Vulnerability Disclosure," IEEE Security and Privacy, Jan 2005, pp. 20-25.
34. Black Hat. Black Hat ". Available: http://www. blackhat.com, Mar 31, 2008.