CT-ER: On the Use of Security Metrics to Identify and Rank the Risk of Vulnerability- and Exploit-Prone Components

CT-ER：关于使用安全度量来识别易受攻击和易被利用的组件的风险并对其进行排序几十年的软件工程研究已经表明，使用软件度量来识别易出错和易失败的组件，并在软件开发生命周期的早期预测系统的整体质量是有效的。软件开发组织使用这些知识来确定重新设计、确认和验证工作的优先级。在这项研究中，我们扩展了这项工作，以检查软件安全度量的相应能力，从而在软件开发生命周期的早期有效地识别易受攻击和易被利用的组件。这项研究的技术目标是创建并验证一个预测模型，该模型使用安全度量来识别软件产品中容易出现漏洞和容易被利用的组件的风险，并对其进行排序。该模型的结果可用于通知风险管理，并在生命周期的后期阶段优先考虑重新设计、确认和验证工作。通过预测模型指导软件开发工作的预期结果是生产出更安全的软件。教育目标是将这些研究结果纳入教育学生设计安全软件产品的资源中。

CT-ER: On the Use of Security Metrics to Identify and Rank the Risk of Vulnerability- and Exploit-Prone ComponentsDecades of software engineering research has shown the effectiveness of the use software metrics to identify fault- and failure-prone components and to predict the overall quality of a system early in the software development lifecycle. Software development organizations use this knowledge to prioritize their redesign and validation and verification efforts. In this research, we extend this work to examine the corresponding power of software security metrics to effectively identify vulnerability-prone and exploit-prone components early in the software development lifecycle. The technical objective of this research is to create and validate a predictive model that uses security metrics to identify and rank the risk of vulnerability-prone and exploit-prone components in a software product. The results of this model can be used to inform risk management and to prioritize re-design and validation and verification efforts in the later phases of the life cycle. The expected result from guiding software development efforts via the predictive model is the production of more secure software. The educational objective is to incorporate these research results into resources for educating students to engineer secure software products.