Vulnerability Discovery Models Research Articles

To report or not to report? Extending Protection Motivation Theory to Vulnerability Discovery and Disclosure

Vulnerability researchers face difficult choices when considering whether to reporting a finding to an organization with which they are unaffiliated. We used components of Protection Motivation Theory (PMT) to create the Vulnerability Discovery and Disclosure (VDD) model to understand the decision-making processes of vulnerability researchers. PMT uses high fear appeals, threat appraisals, and coping appraisals to encourage employee prosocial behaviors while VDD proposes low fear and threat with high coping, to encourage reporting. In this exploratory study, we surveyed active vulnerability researchers to gain insight into their concerns when deciding to report to an organization. Using principal components analysis, we developed and refined the VDD survey, which may be tested by future researchers. We also discovered a higher-order efficacy construct, comprised of response and self-efficacy. We theorize that well-developed vulnerability disclosure policies, in line with a low-fear, low-threat appraisal and high efficacy may establish a culture of trust between organizations and vulnerability researchers, encouraging more reports.

Software security evaluation using multilevel vulnerability discovery modeling

In this work, we propose a new vulnerability discovery model by predicting the number and probability of occurrence of vulnerabilities of different severity levels in software. The severity prediction assumes that the vulnerability score is a continuous variable distributed over a range of 0–10 as per the widely accepted common vulnerability scoring system. We have further developed a risk assessment model which can be used to define the security level of software and is helpful in risk assessment and patch management. A numerical illustration is done on real-life dataset to validate the proposed model.

Modeling Vulnerability Discovery Process in Major Cryptocurrencies

These days, businesses, in both online and offline, have started accepting cryptocurrencies as payment methods. Even in countries like <italic>El Salvador</italic>, cryptocurrencies are recognized as fiat currencies. Meanwhile, publicly known, but not patched software vulnerabilities are security threats to not only software users but also to our society in general. As the status of cryptocurrencies has gradually increased, the impact of security vulnerabilities related to cryptocurrencies on our society has increased as well. In this paper, we first analyze vulnerabilities from the two major cryptocurrency vendors of Bitcoin and Ethereum in a quantitative manner with the respect to the CVSS, to see how the vulnerabilities are roughly structured in those systems. Then we introduce a modified AML vulnerability discovery model for the vulnerability datasets from the two vendors, after showing the original AML dose not accurately represent the vulnerability discovery trends on the datasets. The analysis shows that the modified model performs better than the original AML model for the vulnerability datasets from the major cryptocurrencies.

Empirical Risk Assessment in Major Graphical Design Software Systems

Security vulnerabilities have been reported in major design software systems such as Adobe Photoshop and Illustrator, which are recognized as <italic>de facto</italic> standard design tools in most of the design industries. Companies need to evaluate and manage their risk levels posed by those vulnerabilities, so that they could mitigate the potential security bridges in advance. In general, security vulnerabilities are discovered throughout their life cycles repeatedly if software systems are continually used. Hence, in this study, we empirically analyze risk levels for the three major graphical design software systems, namely Photoshop, Illustrator and GIMP with respect to a software vulnerability discovery model. The analysis reveals that the Alhazmi-Malaiya Logistic model tends to describe the vulnerability discovery patterns significantly. This indicates that the vulnerability discovery model makes it possible to predict vulnerability discovery in advance for the software systems. Also, we found that none of the examined vulnerabilities requires even a single authentication step for successful attacks, which suggests that adding an authentication process in software systems dramatically reduce the probability of exploitations. The analysis also discloses that, for all the three software systems, the predictions with evenly distributed and daily based datasets perform better than the estimations with the datasets of vulnerability reporting dates only. The observed outcome from the analysis allows software development managers to prepare proactively for a hostile environment by deploying necessary resources before the expected time of vulnerability discovery. In addition, it can periodically remind designers who use the software systems to be aware of security risk, related to their digital work environments.

Predicting the Discovery Pattern of Publically Known Exploited Vulnerabilities

Vulnerabilities with publically known exploits typically form 2-7% of all vulnerabilities reported for a given software version. With a smaller number of known exploited vulnerabilities compared with the total number of vulnerabilities, it is more difficult to model and predict when a vulnerability with a known exploit will be reported. In this paper, we introduce an approach for predicting the discovery pattern of publically known exploited vulnerabilities using all publically known vulnerabilities reported for a given software. Eight commonly used vulnerability discovery models (VDMs) and one neural network model (NNM) were utilized to evaluate the prediction capability of our approach. We compared their predictions results with the scenario when only exploited vulnerabilities were used for prediction. Our results show that, in terms of prediction accuracy, out of eight software we analyzed, our approach led to more accurate results in seven cases. Only in one case, the accuracy of our approach was worse by 1.6%.

On interdisciplinarity between product adoption and vulnerability discovery modeling

In the last three decades, Interdisciplinary research has attracted researchers, academicians, and practitioners from the varied field to collaborate and come up with the solution to a problem. This increase in interdisciplinary research is due to its ability to solve complex problems with the help of tools from various disciplines. Interdisciplinary research is based on some of the most important methods that were built through interdisciplinary study to examine and solve a wide variety of business and engineering related problems. Six applications of interdisciplinary research work done in the area of marketing and software security engineering have been discussed in this paper. Specifically, we have discussed the similarity of the modeling framework developed for product adoption using innovation diffusion modeling and vulnerability discovery process. From this work, we aim to provide an understanding to the readers about the importance of interdisciplinary research and its contribution to solving real-life complex decision problems by utilizing the knowledge of various disciplines together.

Modeling Software Vulnerability Discovery Process Inculcating the Impact of Reporters

Vulnerability Discovery Models (VDMs) attempt to estimate the potential vulnerabilities present in a software that will be discovered after a software is released. A general framework is required to encompass all the attributes such as number of detectors, their skill, market share, etc. that impact the discovery of vulnerability. VDMs have been developed by various industry and researchers to assess the vulnerability trend over time. In this proposal, we try to formulate the discovery process based on the software reporters that are the legitimately working to fetch-out the vulnerabilities in a software. The available reporters present in the market impact the discovery process significantly as a vulnerability is more likely to be discovered if a greater number of users are working simultaneously. The interdisciplinary approach highlights the association of vulnerability discovery process and the number of reporters. To empirically validate the preposition, we consider three datasets and the proposed methodology perform significantly better as compared to the traditional VDMs.

Software Risk Assessment for Windows Operating Systems with respect to CVSS

CVSS is recognized as a de facto standard for categorizing and measuring software vulnerabilities in both how easy for exploitation for the given security bug and how much impact on a system having the vulnerability in a sense of the three security factors. Meanwhile, since the early 2000s, quantitative risk assessments of software systems had been able to be examined thanks to the accumulated enough datasets for a scientific investigation. However, there are still a lot of research attempts not to be taken in a quantitative examination of software risk assessments. In this paper, we are quantitatively analyzing CVSS scores in vulnerabilities from the three most recent Windows products, namely, Windows 7, Windows 8.1 and Windows 10. The result shows that AML vulnerability discovery model represents Windows vulnerability discovery trend reasonably. Furthermore, we found explicitly that, most of the time, security bugs are compromised with no authentication required systems. This result is corresponding with the output from the previous research based on Web browsers.

Software Risk Assessment for Windows Operating Systems with respect to CVSS

CVSS is recognized as a de facto standard for categorizing and measuring software vulnerabilities in both how easy for exploitation for the given security bug and how much impact on a system having the vulnerability in a sense of the three security factors. Meanwhile, since the early 2000s, quantitative risk assessments of software systems had been able to be examined thanks to the accumulated enough datasets for a scientific investigation. However, there are still a lot of research attempts not to be taken in a quantitative examination of software risk assessments. In this paper, we are quantitatively analyzing CVSS scores in vulnerabilities from the three most recent Windows products, namely, Windows 7, Windows 8.1 and Windows 10. The result shows that AML vulnerability discovery model represents Windows vulnerability discovery trend reasonably. Furthermore, we found explicitly that, most of the time, security bugs are compromised with no authentication required systems. This result is corresponding with the output from the previous research based on Web browsers.

Improving system reliability by optimal allocation of resources for discovering software vulnerabilities

PurposeThe purpose of this paper is to provide a mathematical framework to optimally allocate resources required for the discovery of vulnerabilities pertaining to different severity risk levels.Design/methodology/approachDifferent sets of optimization problems have been formulated and using the concept of dynamic programming approach, sequence of recursive functions has been constructed for the optimal allocation of resources used for discovering vulnerabilities of different severity scores. Mozilla Thunderbird web browser data set has been considered for giving the empirical evaluation by working with vulnerabilities of different severities.FindingsAs per the impact associated with a vulnerability, critical and high severity level are required to be patched promptly, and hence, a larger amount of funds have to be allocated for vulnerability discovery. Nevertheless, a low or medium risk vulnerability might also get exploited and thereby their discovery is also crucial for higher severity vulnerabilities. The current framework provides a diversified allocation of funds as per the requirement of a software manager and also aims at improving the discovery of vulnerability significantly.Practical implicationsThe finding of this research may enable software managers to adequately assign resources in managing the discovery of vulnerabilities. It may also help in acknowledging the funds required for various bug bounty programs to cater security reporters based on the potential number of vulnerabilities present in software.Originality/valueMuch of the attention has been focused on the vulnerability discovery modeling and the risk associated with the security flaws. But, as far as the authors’ knowledge is concern, there is no such study that incorporates optimal allocation of resources with respect to the vulnerabilities of different severity scores. Hence, the building block of this paper contributes to future research.

Modeling Software Patch Management Based on Vulnerabilities Discovered

A software system deals with various security implications after its release in the market. Correspondingly, firm releases security patches to counter those flaws discovered in the software system. A vendor releases a patch only if a vulnerability has been discovered in a software. It is an important aspect that encompasses the prediction of potential number of patches to be released to maintain the stability of a software. Vulnerability Discovery Models (VDMs) help a software vendor to acknowledge the security trends, forecast security investments and to plan patches, but very few attempts have been made to model the Vulnerability Patch Modeling (VPM) based on the impact of vulnerabilities discovered over the time period. In this proposal, we deduce a novel approach that addresses trend in the sequential development of patches based on the vendor or reporters fetching out the vulnerabilities in a software. The vulnerability trends in a software significantly affect the discovery process and later trigger a patch deployment to suppress the possible likelihood of a breach. The integrative approach underlines the association of vulnerability patch modeling with the vulnerability discovery phenomenon. To exemplify the proposed systematic structure, a statistical analysis has been conducted using real life vulnerability and patch datasets.

Large-Scale Empirical Study of Important Features Indicative of Discovered Vulnerabilities to Assess Application Security

Existing research on vulnerability discovery models shows that the existence of vulnerabilities inside an application may be linked to certain features, e.g., size or complexity, of that application. However, the applicability of such features to demonstrate the relative security between two applications is not well studied, which may depend on multiple factors in a complex way. In this paper, we perform the first large-scale empirical study of the correlation between various features of applications and the abundance of vulnerabilities. Unlike existing work, which typically focuses on one particular application, resulting in limited successes, we focus on the more realistic issue of assessing the relative security level among different applications. To the best of our knowledge, this is the most comprehensive study of 780 real-world applications involving 6498 vulnerabilities. We apply seven feature selection methods to nine feature subsets selected among 34 collected features, which are then fed into six types of machine learning models, producing 523 estimations. The predictive power of important features is evaluated using four different performance measures. This paper reflects that the complexity of applications is not the only factor in vulnerability discovery and the human-related factors contribute to explaining the number of discovered vulnerabilities in an application.

Vulnerability prediction capability: A comparison between vulnerability discovery models and neural network models

In this paper, we introduce an approach for predicting the cumulative number of software vulnerabilities that is in most cases more accurate than vulnerability discovery models (VDMs). Our approach uses a neural network model (NNM) to model the nonlinearities associated with vulnerability disclosure. Nine common VDMs were used to compare their prediction capability with our approach. The different models were applied to vulnerabilities associated with eight well-known software (four operating systems and four web browsers). The models were assessed in terms of prediction accuracy and prediction bias. Out of eight software we analyzed, the NNM outperformed the VDMs in all the cases in terms of prediction accuracy, and provided smaller values of absolute average bias in seven cases. This study shows that NNMs are promising for accurate predictions of software vulnerabilities disclosures.

E-WBM: An Effort-Based Vulnerability Discovery Model

Vulnerability discovery models (VDMs) have recently been proposed to estimate the cumulative number of vulnerabilities that will be disclosed after software is released. A precise VDM would offer an available quantitative insight to assess software security. Even though VDM has demonstrated its effectiveness in multiple software, it remains limited in accuracy, especially with weak versatility. We propose a novel effort-based VDMs, named E-WBM, to improve critical vulnerability discovery rate algorithm using Weibull probability distribution function towards efficient vulnerability discovery models. E-WBM accurately portrays the trend of software security vulnerabilities disclosure. We evaluate E-WBM on eight popular real-world operating systems and show the feasibility of the proposed model. We further compare E-WBM with a state-of-the-art effort-based model AME and time-based model JW on the above eight operating systems. Our comparison also demonstrates that E-WBM consistently outperforms AME and JW both at reducing the deviations and fitting curve trends. In addition to the model fitting, predictive capabilities of two effort-based models E-WBM and AME are also examined. The results show that the E-WBM model yields a more stable prediction with a significantly less error than AME.

Bayesian-model averaging using MCMCBayes for web-browser vulnerability discovery

ABSTRACT Most software vulnerabilities are preventable, but they continue to be present in software releases. When Blackhats, or malicious researchers, discover vulnerabilities, they often release corresponding exploit software and malware. Therefore, customer confidence could be reduced if vulnerabilities—or discoveries of them—are not prevented, mitigated, or addressed. In addressing this, managers must choose which alternatives will provide maximal impact and could use vulnerability discovery modeling techniques to support their decision-making process. Applications of these techniques have used traditional approaches to analysis and, despite the dearth of data, have not included information from experts. This article takes an alternative approach, applying Bayesian methods to modeling the vulnerability-discovery phenomenon. Relevant data was obtained from security experts in structured workshops and from public databases. The open-source framework, MCMCBayes, was developed to automate performing Bayesian model averaging via power-posteriors. It combines predictions of interval-grouped discoveries by performance-weighting results from six variants of the non-homogeneous Poisson process (NHPP), two regression models, and two growth-curve models. The methodology is applicable to software-makers and persons interested in applications of expert-judgment elicitation or in using Bayesian analysis techniques with phenomena having non-decreasing counts over time.

Coverage‐based vulnerability discovery modeling to optimize disclosure time using multiattribute approach

AbstractSoftware vulnerabilities trend over time has been proposed by various researchers and academicians in recent years. But none of them have considered operational coverage function in vulnerability discovery modeling. In this research paper, we have proposed a generalized statistical model that determines the relationship between operational coverage function and the number of expected vulnerabilities. During the operational phase, possible vulnerable sites are covered and vulnerabilities present at a particular site are discovered with some probability. We have assumed that the proposed model follows the nonhomogeneous Poisson process properties; thus, different distributions are used to formulate the model. The numerical illustration shows that the proposed model performs better and has the good fitness to the Google Chrome data. The second focus of this research paper is to evaluate the total cost incurred by the developer after software release and to identify the optimal vulnerability disclosure time through multiobjective utility function. The proposed vulnerability discovery helps in optimization. The optimal time problem depends on the combined effect of cost, risk, and effort.

Multivariate models using MCMCBayes for web-browser vulnerability discovery

Vulnerabilities that enable well-known exploit techniques are preventable, but their public discovery continues in software. Vulnerability discovery modeling (VDM) techniques were proposed to assist managers with decisions, but do not include influential variables describing the software release (SR) (e.g., code size and complexity characteristics) and security assessment profile (SAP) (e.g., security team size or skill). Consequently, they have been limited to modeling discoveries over time for SR and SAP scenarios of unique products, whose results are not readily comparable without making assumptions that equate all SR and SAP combinations under study. This article introduces a groundbreaking capability that allows forecasting expected discoveries over time for arbitrary SR and SAP combinations, thus enabling managers to better understand the effects of influential variables they control on the phenomenon. To do this, we use variables that describe arbitrary SR and SAP combinations and construct VDM extensions that parametrically scale results from a defined baseline SR and SAP to the arbitrary SR and SAP of interest. Scaling parameters are estimated using expert judgment data gathered with a novel pairwise comparison approach. These data are then used to demonstrate predictions and how multivariate VDM techniques could be used by software-makers.

Modeling and Characterizing Software Vulnerabilities

With the association of software security assurance in the development of code based systems; software developers are relying on the Vulnerability discovery models to mitigate the breaches by estimating the total number of vulnerabilities, before they’re exploited by the intruders. Vulnerability Discovery Models (VDMs) provide the quantitative classification of the flaws that exists in a software that will be discovered after a software is released. In this paper, we develop a vulnerability discovery model that accumulate the vulnerabilities due to the influence of previously discovered vulnerabilities. We further evaluate the proportion of previously discovered vulnerabilities along with the fraction additional vulnerabilities detected. The quantification methodology presented in this article has been accompanied with an empirical illustration on popular operating systems’ vulnerability data.

User-dependent vulnerability discovery model and its interdisciplinary nature

Software Vulnerability is a broad discipline that cannot be controlled only by the technologies. The holistic framework is required that statistically encompasses the entire security issues of IT organizations regardless of individual projects. Earlier researchers have developed several mathematical models that determined the vulnerabilities trend over time. Besides that, the most common victims of the vulnerabilities i.e., the software buyers or users were addressed theoretically without considering their impact on vulnerability discovery modeling. In this research paper, we examined the vulnerability discovery rate on the basis of potential users of commercial software. Here we propose an interdisciplinary model that highlights the relationship between the vulnerability intensity and the number of users of the software. The numerical illustration based on several real data sets is provided to validate the proposed user-dependent vulnerability discovery model.

Vulnerability Discovery Modeling for Open and Closed Source Software

With growing concern for security, the researchers began with the quantitative modeling of vulnerabilities termed as vulnerability discovery models (VDM). These models aim at finding the trend of vulnerability discovery with time and facilitate the developers in patch management, optimal resource allocation and assessing associated security risks. Among the existing models for vulnerability discovery, Alhazmi-Malaiya Logistic Model (AML) is considered the best fitted model on all kinds of datasets. But, each of the existing models has a predefined basic shape and can only fit datasets following their basic shapes. Thus, shape of the dataset forms the decisive parameter for model selection. In this paper, the authors have proposed a new model to capture a wide variety of datasets irrespective of their shape accounting for better goodness of fit. The proposed model has been evaluated on three real life datasets each for open and closed source software and the models are ranked based on their suitability to discover vulnerabilities using normalized criteria distance (NCD) technique.