Studies on the Development and Improvement of Quantitative Vulnerability Assessment Methods for the Internet Software

我们首先讨论了针对暴露在恶意用户面前的互联网软件的软件脆弱性评估方法。在讨论了软件脆弱性的概念后，对传统的软件可靠性评估方法进行了扩展，建立了一个随机模型，将软件脆弱性作为事后评估进行评估。我们已经指出，当软件系统运行在允许用户匿名性的操作环境中时，传统的软件可靠性度量方法是不可信的。针对Sendmail系统给出了软件脆弱性评估模型，并给出了实际评估结果。为了发展和改进软件脆弱性评估方法，我们对软件调试过程进行了更微观的处理。采用仿真方法，取得了一项丰硕的成果。尤其是我们的SIMA…更多的模型具有基于最小均方误差准则对仿真模型中包含的控制参数进行校准的能力。同时，为了提高软件可靠性/脆弱性模型的适用性，提出了一种基于线性增长曲线模型的软件可靠性/脆弱性评估方法。在软件可靠性/脆弱性评估的文献中，到目前为止已经提出了许多评估模型。它们是许多研究人员进行研究的成果。通过观察软件开发过程，已经尝试了各种方法来定量地描述软件可靠性。也就是说，有使用随机过程的模型、非参数模型、神经网络等。这一事实表明，对于本文本身分析的几个数据集，每个模型都有一定的优势，但该模型并不总是适用于所有类型的数据。因此，我们有许多软件可靠性模型。为了克服模型选择的复杂性，我们讨论了一种推广软件可靠性数据分析的方法。这些新方法为软件脆弱性评估方法打开了一扇新的大门。较少

We have first discussed the software vulnerability assessment method for the Internet software, which is exposed to the malicious users. After discussing the concept of software vulnerability with expanding the traditional approach of software reliability assessment methods, we have modeled a stochastic model in order to evaluate the software vulnerability as an ex post facto estimation. We have pointed out that classical software reliability measurement methods would not be trustworthy when the software system is operated in the operational environment, which allows anonymity of the users. We have presented the software vulnerability assessment modeling and shown its practical estimation results for the sendmail system.To develop and improve the software vulnerability assessment methods, we have secondly tackled the problem of making some more microscopic approach for software debugging process. One fruitful result has been obtained by using simulation approach. Especially, our simula … More tion models have an ability of calibration of control parameters included in the simulation models based on a least mean square error rule. This simulation-based approach can treat wide variety of modeling for software reliability/vulnerability assessment.Also, in order to obtain more applicability for the software reliability/vulnerability models, we have developed a new methodology based on a linearized growth curve model. In the literature of software reliability/vulnerability assessment, there have been many assessment models have been proposed so far. They are the achievement of studies performed by a lot of researchers. Various approaches have been tried to describe software reliability quantitatively through the observation of software development processes. Namely, there are the models which use stochastic processes, non-parametric models, neural networks, and so on. This fact shows that each model has some advantages for several data sets that are analyzed in the paper itself ; however, the model is not always applicable to all kinds of data. Therefore, we have a number of software reliability models. In order to overcome this complication of model selection, we have discussed a method of generalizing several proposed software reliability data analysis. These new methods can open a new door of software vulnerability assessment methods. Less