Cluster-based vulnerability assessment of operating systems and web browsers

Organizations face the issue of how to best allocate their security resources. Thus, they need an accurate method for assessing how many new vulnerabilities will be reported for the operating systems (OSs) and web browsers they use in a given time period. Our approach consists of clustering vulnerab...

Full description

Saved in:
Bibliographic Details
Published in:Computing 2019-02, Vol.101 (2), p.139-160
Main Authors: Movahedi, Yazdan, Cukier, Michel, Andongabo, Ambrose, Gashi, Ilir
Format: Article
Language:English
Subjects:
Artificial Intelligence
Clustering
Computer Appl. in Administrative Data Processing
Computer Communication Networks
Computer Science
Computer simulation
Cybersecurity
Information Systems Applications (incl.Internet)
Mobile operating systems
Modelling
Operating systems
Poisson density functions
Power law
Reliability analysis
Software Engineering
Software reliability
Vulnerability
Web browsers
Citations: Items that this one cites
Items that cite this one
Online Access:Get full text
Tags: Add Tag
No Tags, Be the first to tag this record!
Description
Summary:Organizations face the issue of how to best allocate their security resources. Thus, they need an accurate method for assessing how many new vulnerabilities will be reported for the operating systems (OSs) and web browsers they use in a given time period. Our approach consists of clustering vulnerabilities by leveraging the text information within vulnerability records, and then simulating the mean value function of vulnerabilities by relaxing the monotonic intensity function assumption, which is prevalent among the studies that use software reliability models (SRMs) and nonhomogeneous Poisson process in modeling. We applied our approach to the vulnerabilities of four OSs (Windows, Mac, IOS, and Linux) and four web browsers (Internet Explorer, Safari, Firefox, and Chrome). Out of the total eight OSs and web browsers we analyzed using a power-law model issued from a family of SRMs, the model was statistically adequate for modeling in six cases. For these cases, in terms of estimation and forecasting capability, our results, compared to a power-law model without clustering, are more accurate in all cases but one.
ISSN:0010-485X
1436-5057
DOI:10.1007/s00607-018-0663-0