CT-ER: On the Use of Security Metrics to Identify and Rank the Risk of Vulnerability- and Exploit-Prone Components

CT-ER：关于使用安全度量来识别和评估易受攻击和易受攻击的组件的风险大量的软件工程研究表明，在软件开发生命周期的早期，使用软件度量来识别易出错和容易失败的组件并预测系统的整体质量是有效的。软件开发组织使用这些知识来确定重新设计、确认和验证工作的优先顺序。在这项研究中，我们将这项工作扩展到检查软件安全度量的相应能力，以便在软件开发生命周期的早期有效地识别易受攻击和易受攻击的组件。这项研究的技术目标是创建和验证预测模型，该模型使用安全度量来识别和评级软件产品中易受攻击和易受攻击的组件的风险。该模型的结果可用于为风险管理提供信息，并在生命周期的后期阶段确定重新设计、确认和核查工作的优先顺序。通过预测模型指导软件开发工作的预期结果是生产更安全的软件。教育目标是将这些研究成果纳入到教育学生设计安全软件产品的资源中。

CT-ER: On the Use of Security Metrics to Identify and Rank the Risk of Vulnerability- and Exploit-Prone ComponentsDecades of software engineering research has shown the effectiveness of the use software metrics to identify fault- and failure-prone components and to predict the overall quality of a system early in the software development lifecycle. Software development organizations use this knowledge to prioritize their redesign and validation and verification efforts. In this research, we extend this work to examine the corresponding power of software security metrics to effectively identify vulnerability-prone and exploit-prone components early in the software development lifecycle. The technical objective of this research is to create and validate a predictive model that uses security metrics to identify and rank the risk of vulnerability-prone and exploit-prone components in a software product. The results of this model can be used to inform risk management and to prioritize re-design and validation and verification efforts in the later phases of the life cycle. The expected result from guiding software development efforts via the predictive model is the production of more secure software. The educational objective is to incorporate these research results into resources for educating students to engineer secure software products.