The Likelihood of Vulnerability Rediscovery and the Social Utility of Vulnerability Hunting
Andy Ozment · 2005
Initial attempts to apply software reliability growth models to the process of vulnerability finding relied upon noisy data. Here, a more appropriate data collection process is discussed and employed to identify the age of vulnerabilities in OpenBSD 2.2. A number of models are tested against the data and two are found to have acceptable goodness-of-fit.