IEEE Security & Privacy · 2011 · 57 citations · 7 references
ComputingComputer ScienceSystems EngineeringComputer SecuritySafety EngineeringVulnerability AnalysisSecure System DesignSecurity ControlsSecurity ManagementSecurity MetricsSystem SecurityThreat ModelingMetricsRisk-based Security MeasurementSecurity Assurance MetricsSecurity MeasurementSecurity Operations MetricsSecurity Performance IndicatorsSecurity Performance Measurement
The field of computer and communications security begs for a foundational science to guide system design and to reveal the safety, security, and possible fragility of the complex systems we depend on today. To achieve this goal, we must devise suitable metrics for objectively comparing and evaluating the security of system designs and organizations.
7
On the effectiveness of address-space randomization
Hovav Shacham, Matthew J. Page, Ben Pfaff et al. · 2004 · 861 citations
Toward cost-sensitive modeling for intrusion detection and response
Wenke Lee, Wei Fan, Matthew L. Miller et al. · Journal of Computer Security · 2002 · 284 citations
On the infeasibility of modeling polymorphic shellcode
Yingbo Song, Michael E. Locasto, Angelos Stavrou et al. · 2007 · 120 citations