Vulnerability Discovery in Multi-Version Software Systems

Shiibashi, Akio; Nakaniwa, T.; Yamana, M.; Möri, K.

doi:10.1109/hase.2007.55

Cited by 29 publications

(17 citation statements)

References 10 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…A study on diversity across software versions is presented in . The authors propose a new discovery model that takes into account the software versions and therefore the importance of shared code on vulnerability discovery.…”

Section: Related Workmentioning

confidence: 99%

Analysis of operating system diversity for intrusion tolerance

Garcia

Bessani

Gashi

et al. 2013

Softw. Pract. Exper.

View full text Add to dashboard Cite

One of the key benefits of using intrusion-tolerant systems is the possibility of ensuring correct behavior in the presence of attacks and intrusions. These security gains are directly dependent on the components exhibiting failure diversity. To what extent failure diversity is observed in practical deployment depends on how diverse are the components that constitute the system. In this paper, we present a study with operating system's (OS's) vulnerability data from the NIST National Vulnerability Database (NVD). We have analyzed the vulnerabilities of 11 different OSs over a period of 18 years, to check how many of these vulnerabilities occur in more than one OS. We found this number to be low for several combinations of OSs. Hence, although there are a few caveats on the use of NVD data to support definitive conclusions, our analysis shows that by selecting appropriate OSs, one can preclude (or reduce substantially) common vulnerabilities from occurring in the replicas of the intrusion-tolerant system. ‡ A specific type of bug, regarding security, is usually called a vulnerability. Once a vulnerability is discovered, it can be maliciously exploited. If the exploited vulnerability leads to the software system deviating from its intended requirements or security policy, then the system is deemed to have failed. The system can fail on a single or combination of the following security properties: confidentiality, availability, and integrity. In the rest of this paper, we will use the terms fault and vulnerability interchangeably. 736 M. GARCIA ET AL.faulty. To satisfy this provision, system components need to exhibit failure diversity, that is, the probability that a majority of components fail at the same time should be negligible (or else the system as a whole will fail). This failure diversity assumption is easier to justify when one is concerned with accidental faults, such as power outages, disk crashes, or message corruption due to noise in communication lines. However, for design faults of any kind, including security vulnerabilities, the assumption is difficult to guarantee. If multiple components contain the same vulnerabilities, then a single attack can compromise all of them, therefore defeating the aim of intrusion tolerance system in providing improved security.To reduce the probability of vulnerabilities existing in more than one component, design diversity [3] can be employed: each component uses diverse software to perform the same functions, with the expectation that the differences will reduce the occurrence of common vulnerabilities, that is, vulnerabilities that exist in more than one system. Byzantine fault-tolerant replication often suggest the use of replica diversity (e.g., [4][5][6][7][8][9][10][11][12][13][14]), under the (sometimes implicit) assumption that they exhibit failure diversity. In this work, we want to empirically assess to what extent failure diversity is exhibited in a complex category of OTS software, namely operating systems (OSs).We focus our study on OS because they are a...

show abstract

Section: Related Workmentioning

confidence: 99%

Analysis of operating system diversity for intrusion tolerance

Garcia

Bessani

Gashi

et al. 2013

Softw. Pract. Exper.

View full text Add to dashboard Cite

show abstract

“…Another approach for vulnerability assessment is Quantitative modeling of vulnerability discovery process based on shared source code measurements among multi-version software systems. Such a modeling approach can be used for assessing security risk both before and after the release of a version [17].…”

Section: Methodsmentioning

confidence: 99%

Security assessment framework for educational ERP systems

Ashraf

Alenezi

Nadeem

et al. 2019

IJECE

View full text Add to dashboard Cite

The educational ERP systems have vulnerabilities at the different layers such as version-specific vulnerabilities, configuration level vulnerabilities and vulnerabilities of the underlying infrastructure. This research has identified security vulnerabilities in an educational ERP system with the help of automated tools; penetration testing tool and public vulnerability repositories (CVE, CCE) at all layers. The identified vulnerabilities are analyzed for any false positives and then clustered with mitigation techniques, available publicly in security vulnerability solution repository like CCE and CWE. These mitigation techniques are mapped over reported vulnerabilities using mapping algorithms. Security vulnerabilities are then prioritized based on the Common Vulnerability Scoring System (CVSS). Finally, open standards-based vulnerability mitigation recommendations are discussed.

show abstract

“…Their proposed AML model assumes a symmetrical shape around the peak discovery rate value [6]. A Weibull distribution-based VDM was proposed by Kim in 2007 [18]. Li et al [19] empirically showed that, in comparison to other reliability models, a Weibull model is better for defect occurrence across a wide range of software systems.…”

Section: Related Workmentioning

confidence: 99%

Predicting the Discovery Pattern of Publically Known Exploited Vulnerabilities

Movahedi

Cukier

Gashi

2021

IEEE Trans. Dependable and Secure Comput.

View full text Add to dashboard Cite

Vulnerabilities with publically known exploits typically form 2-7% of all vulnerabilities reported for a given software version. With a smaller number of known exploited vulnerabilities compared with the total number of vulnerabilities, it is more difficult to model and predict when a vulnerability with a known exploit will be reported. In this paper, we introduce an approach for predicting the discovery pattern of publically known exploited vulnerabilities using all publically known vulnerabilities reported for a given software. Eight commonly used vulnerability discovery models (VDMs) and one neural network model (NNM) were utilized to evaluate the prediction capability of our approach. We compared their predictions results with the scenario when only exploited vulnerabilities were used for prediction. Our results show that, in terms of prediction accuracy, out of eight software we analyzed, our approach led to more accurate results in seven cases. Only in one case, the accuracy of our approach was worse by 1.6%.

show abstract

Vulnerability Discovery in Multi-Version Software Systems

Cited by 29 publications

References 10 publications

Analysis of operating system diversity for intrusion tolerance

Analysis of operating system diversity for intrusion tolerance

Security assessment framework for educational ERP systems

Predicting the Discovery Pattern of Publically Known Exploited Vulnerabilities

Contact Info

Product

Resources

About