Predictive models for identifying software components prone to failure during security attacks
Michael Gegick, Laurie A. Williams, Mladen Alan Vouk · NCSU Libraries Repository (North Carolina State University Libraries) · 2008
Sometimes software security engineers are given a product that they not familiar with, but are asked to have a security analysis done for it in a relatively short time.An early knowledge of where the most vulnerable regions of a software-based system are likely to reside can help prioritize their efforts.In general, software metrics can be used to predict fault-and failure-prone components for prioritizing inspection, testing, and redesign efforts.We believe that the security community can leverage this knowledge to design tools and metrics that can identify vulnerability-and attack-prone software components early in the software life cycle.We analyzed a large commercial telecommunications software-based system and found that the presence of security faults correlates strongly with the presence of a more general category of reliability faults.This, of course, is not surprising if one accepts the notion that security faults are in many instances a subset of a reliability fault set.We discuss a model that can be useful for identifying attack-prone components and for prioritizing security efforts early in the software life-cycle.