Modeling the Vulnerability Discovery Process

TLDR

Security vulnerabilities in servers and operating systems are software defects that pose significant risks, and both developers and users struggle to contain them, with discovery occurring throughout a system’s life‑span, and only a few models of the vulnerability discovery process have been published recently. The study examines recently published vulnerability discovery models to enable effective patch resource allocation and risk evaluation of exploitation. We analyze the models analytically and empirically using vulnerability data from three widely‑used systems. We discuss the models’ applicability and parameter significance, identify their limitations, and outline major research challenges.

Abstract

Security vulnerabilities in servers and operating systems are software defects that represent great risks. Both software developers and users are struggling to contain the risk posed by these vulnerabilities. The vulnerabilities are discovered by both developers and external testers throughout the life-span of a software system. A few models for the vulnerability discovery process have just been published recently. Such models will allow effective resource allocation for patch development and are also needed for evaluating the risk of vulnerability exploitation. Here we examine these models for the vulnerability discovery process. The models are examined both analytically and using actual data on vulnerabilities discovered in three widely-used systems. The applicability of the proposed models and significance of the parameters involved are discussed. The limitations of the proposed models are examined and major research challenges are identified