Using complexity metrics to improve software security

详细信息    查看全文

• 作者：Sara MoshtariAuthor Vitae ; Ashkan SamiAuthor Vitae ; Mahdi AzimiAuthor Vitae
• 刊名：Computer Fraud & Security
• 出版年：2013
• 出版时间：May, 2013
• 年：2013
• 卷：2013
• 期：5
• 页码：8-17
• 全文大小：2995 K

文摘

Information technology is quickly spreading across critical infrastructures and software has become an inevitable part of industries and organisations. At the same time, many cyberthreats are the result of poor software coding. Stuxnet, which was the most powerful cyber-weapon used against industrial control systems, exploited zero-day vulnerabilities in Microsoft Windows. The US Department of Homeland Security (DHS) also announced that software vulnerabilities are among the three most common cyber-security vulnerabilities in Industrial Control Systems (ICSs). Therefore, improving software security has an important role in increasing the security level of computer-based systems.

Software vulnerability prediction is a tedious task, so automating vulnerability prediction would save a lot of time and resources. One recently used methodology in vulnerability prediction is based on automatic fault prediction using software metrics.

Here, Sara Moshtari, Ashkan Sami and Mahdi Azimi of Shiraz University, Iran build on previous studies by providing more complete vulnerability information. They show what can be achieved using different classification techniques and more complete vulnerability information.