2012/03/26 by Viet Hung Nguyen, Nguyen, Viet Hung, Fabio Massacci +1
Computer Science · #Cryptography and Security (cs.CR) #FOS: Computer and information sciences #Information and Cyber Security #Software Engineering Research #Software Reliability and Analysis Research #cs.CR
paper · pdf · doi:10.48550/arxiv.1203.5830
This paper is to appear in ASIACCS'12
arxiv created 2012/03/26 · openalex publication_date 2012/03/26 · arxiv updated 2012/03/28 · openalex created_date 2025/10/10 · openalex updated_date 2026/07/28
Having a precise vulnerability discovery model (VDM) would provide a useful quantitative insight to assess software security. Thus far, several models have been proposed with some evidence supporting their goodness-of-fit. In this work we describe an independent validation of the applicability of six existing VDMs in seventeen releases of the three popular browsers Firefox, Google Chrome and Internet Explorer. We have collected five different kinds of data sets based on different definitions of a vulnerability. We introduce two quantitative metrics, goodness-of-fit entropy and goodness-of-fit quality, to analyze the impact of vulnerability data sets to the stability as well as quality of VDMs in the software life cycles. The experiment result shows that the "confirmed-by-vendors' advisories" data sets apparently yields more stable and better results for VDMs. And the performance of the s-shape logistic model (AML) seems to be superior performance in overall. Meanwhile, Anderson thermodynamic model (AT) is indeed not suitable for modeling the vulnerability discovery process. This means that the discovery process of vulnerabilities and normal bugs are different because the interests of people in finding security vulnerabilities are more than finding normal programming bugs.