CT-ER: On the Use of Security Metrics to Identify and Rank the Risk of Vulnerability- and Exploit-Prone Components

CT-ER：在使用安全度量来识别和排名的脆弱性和易受攻击的威胁的风险几十年的软件工程研究已经表明，使用软件度量来识别故障和故障倾向的组件，并在软件开发生命周期的早期预测系统的整体质量的有效性。软件开发组织使用这些知识来优先考虑他们的重新设计和验证工作。 在这项研究中，我们将这项工作扩展到检查软件安全度量的相应功能，以便在软件开发生命周期的早期有效地识别易受攻击和易受攻击的组件。 本研究的技术目标是创建和验证一个预测模型，该模型使用安全指标来识别和排名软件产品中易受攻击和易受攻击组件的风险。 该模型的结果可用于通知风险管理，并在生命周期的后期阶段优先考虑重新设计和确认与验证工作。 通过预测模型指导软件开发工作的预期结果是生产出更安全的软件。 教育目标是将这些研究成果纳入教育学生设计安全软件产品的资源。

CT-ER: On the Use of Security Metrics to Identify and Rank the Risk of Vulnerability- and Exploit-Prone ComponentsDecades of software engineering research has shown the effectiveness of the use software metrics to identify fault- and failure-prone components and to predict the overall quality of a system early in the software development lifecycle. Software development organizations use this knowledge to prioritize their redesign and validation and verification efforts. In this research, we extend this work to examine the corresponding power of software security metrics to effectively identify vulnerability-prone and exploit-prone components early in the software development lifecycle. The technical objective of this research is to create and validate a predictive model that uses security metrics to identify and rank the risk of vulnerability-prone and exploit-prone components in a software product. The results of this model can be used to inform risk management and to prioritize re-design and validation and verification efforts in the later phases of the life cycle. The expected result from guiding software development efforts via the predictive model is the production of more secure software. The educational objective is to incorporate these research results into resources for educating students to engineer secure software products.