Vulnerability analysis for a quantitative security evaluation

2009 3rd International Symposium on Empirical Software Engineering and Measurement, ESEM 2009

Volumn , Issue , 2009, Pages 526-534

  Vache, Géraldine ^a,b  

^a UNIVERSITÉ DE TOULOUSE   (France)

^b INSA   (France)

Author keywords

[No Author keywords available]

Indexed keywords

ENVIRONMENTAL FACTORS; MODEL PARAMETERS; OPEN SOURCES; QUANTITATIVE CHARACTERIZATION; QUANTITATIVE MEASURES; QUANTITATIVE SECURITY EVALUATION; SYSTEM ENVIRONMENT; VULNERABILITY ANALYSIS; VULNERABILITY LIFE CYCLE;

COMPUTER SOFTWARE; LIFE CYCLE; NETWORK SECURITY;

PROBABILITY DISTRIBUTIONS;

EID: 72449180342     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/ESEM.2009.5315969     Document Type: Conference Paper

References (23)

1. ISO 27000 website: http://www.27000.org
2. th IFIP Information System Security Conference, Samos, Greece, May 21-24, 1996.
3. Balrazotti, D. and Monga, M. and Sicari, S. Assesising the risk of using vulnerable components. Quality of Protection - Security measurements and metrics, 2006, pp 65-77.
4. McQueen, M. A. and Boyer, W. F. and Flynn, M. A. and Beitel, G. A. Time-To-Compromise Model for cyber risk reduction estimation. Quality of Protection - Security measurements and metrics, 2006, pp 49-64.
5. Alata, E. Observation, caractérisation et modélisation de processus d'attaques sur Internet. PhD Thesis, LAAS-CNRS, INSA de Toulouse, 7 Dec. 2007.
6. Clark, G., Courtney, T., Daly, D., Deavours, D., Derisavi, S., Doyle, J. M., Sanders, W. H., and Webster, P. 2001. The Möbius Modeling Tool. In Proceedings of the 9th international Workshop on Petri Nets and Performance Models (Pnpm'01) (September 11 - 14, 2001). PNPM. IEEE Computer Society, Washington, DC, 241.
7. Vache, G. Environment characterization and system modeling approach for the quantitative evaluation of security. To be published in SAFECOMP 2009, The 28th International Conference on Computer Safety, Reliability and Security 15 - 18 September 2009, Hamburg, Germany.
8. Arora, A. and Krishnan, R. and Telang, R. and Yang, Y. "Impact of Vulnerability Disclosure and Patch Availability - An Empirical Analysis", Third Workshop on the Economics of Information Security, 2004.
9. Frei, S., May, M., Fiedler, U., and Plattner, B. 2006. Large-scale vulnerability analysis. In Proceedings of the 2006 SIGCOMM Workshop on Large-Scale Attack Defense (Pisa, Italy, September 11 - 15, 2006).
10. th National Information Systems Security Conference, October 22-25, 1996, Baltimore, Maryland, US.
11. Alhazmi, O. H., Woo, S-W., Malaiya, Y. K., Security Vulnerability Categories in Major Software Systems, Security Vulnerability Categories in Major Software Systems, Proceedings of the Third IASTED International Conference Proceedings Communication, Network, and Information Security. 2006
12. Gegick, M. and Williams, L. 2005. Matching attack patterns to security vulnerabilities in software-intensive system designs. In Proceedings of the 2005 Workshop on Software Engineering For Secure Systemsa Building Trustworthy Applications (St. Louis, Missouri, May 15-16, 2005).
13. Hansman, S. and Hunt, R., Ataxonomyofnetworkand computerattacks, Computers & Security, Volume 24, Issue 1, February 2005, Pages 31-43.
14. th Usenix Security Symposium, Vancouver, B.C., Canada, July 31-August 4, 2006, pp 93-104.
15. Rescola, E. Is Fiding Security Holes a Good Idea?, IEEE Security and Privacy, vol. 3, no. 1, pp. 14-19, Jan. 2005.
16. Symantec Enterprise Security. "Symantec Global Internet Security Threat Report - Trends for 2008", vol. XIV, April 2009. http://www.symantec.com
17. IBM Global Technology Services. "IBM Internet Security Systems X-Force 2008 Trend & Risk Report". January 2009, http://www-935.ibm.com
18. National Vulnerability Database: http://nvd.nist.gov
19. Security Focus Vulnerability Database: http://www.securityfocus.com
20. Open Source Vulnerability DataBase: http://osvdb.org
21. Secunia web site: http://secunia.com
22. H.A. Sturges, "The choice of a class interval", Journal of the American Statistical Association, 1926.
23. EasyFit tool website: http://www.mathwave.com