《计算机应用研究》|Application Research of Computers

一种基于生长曲线的系统漏洞发现预测模型

Predicting system vulnerability discovery with growth curve

免费全文下载 (已被下载 次)  
获取PDF全文
作者 唐成华,潘然,李海东,强保华
机构 1.广西可信软件重点实验室,广西 桂林 541004;2.桂林电子科技大学 a.广西密码学与信息安全重点实验室;b.广西云计算与大数据协同创新中心,广西 桂林 541004
统计 摘要被查看 次,已被下载
文章编号 1001-3695(2020)07-044-2136-04
DOI 10.19734/j.issn.1001-3695.2019.01.0017
摘要 针对系统漏洞的有效发现及预测问题,提出了一种基于生长曲线的系统漏洞发现预测模型。首先分析漏洞发现规律,引入生长曲线的概念,确定了漏洞发现量的增长阶段特征;其次在生长理论周期表达基础上,描述系统漏洞发现过程与时间的关系,提出系统漏洞发现的预测过程,以及改进后的PMGTV模型;最后在实验中与其他模型进行了对比和有效性等分析,PMGTV对win_xp、win_server_2003、mac_os_server、ubuntu_linux这四款系统软件的漏洞增长过程的拟合良好,在SSE残差平方和以及<i>χ</i><sup>2</sup>卡方值方面绝大部分优于其他模型,并且在预测准确度上最接近于真实值。结果表明,该模型在对系统漏洞发现的预测方面更为准确,为采取有效安全策略、提高软件质量等方面提供了一种可靠依据。
关键词 系统漏洞; 漏洞发现; 漏洞预测; 生长曲线; 网络安全
基金项目 国家自然科学基金资助项目(61462020,61762025)
广西自然科学基金资助项目(2018JJA170058)
广西可信软件重点实验室基金资助项目(kx201506)
广西密码学与信息安全重点实验室基金资助项目(GCIS201619)
广西云计算与大数据协同创新中心项目(YF17101)
广西重点研发计划资助项目(桂科AB17195053)
广西高等学校高水平创新团队及卓越学者计划资助项目
本文URL http://www.arocmag.com/article/01-2020-07-044.html
英文标题 Predicting system vulnerability discovery with growth curve
作者英文名 Tang Chenghua, Pan Ran, Li Haidong, Qiang Baohua
机构英文名 1.Guangxi Key Laboratory of Trusted Software,Guilin Guangxi 541004,China;2.a.Guangxi Key Laboratory of Cryptography & Information Security,b.Guangxi Cloud Computing & Big Data Collaborative Innovation Center,Guilin University of Electronic Technology,Guilin Guangxi 541004,China
英文摘要 Aiming at the effective discovery and prediction of system vulnerabilities, this paper proposed a system vulnerability detection and prediction model based on growth curve theory. Firstly, it analyzed the rule of vulnerability discovery, and introduced the concept of growth curve to determine the stage characteristics of vulnerability discovery growth. Secondly, based on the periodic expression of growth theory, it described the relationship between system vulnerability discovery process and time, and proposed the prediction process of system vulnerability discovery and the improved PMGTV model. Finally, it was compared with other models in the experiment and analyzed the validity. PMGTV fits the vulnerability growth process of win_xp, win_server_2003, mac_os_server and ubuntu_linux system software well. It performs best in the sum of squares for error(SSE) and the Chi-square value <i>χ</i><sup>2</sup>, and the prediction accuracy is closest to the true value. Results show that the model is more accurate in the prediction of system vulnerability discovery, and provides a reliable basis for taking effective security policy and improving software quality.
英文关键词 system vulnerability; vulnerability discovery; vulnerability prediction; growth curve; network security
参考文献 查看稿件参考文献
 
收稿日期 2019/1/7
修回日期 2019/3/4
页码 2136-2139
中图分类号 TP309.2
文献标志码 A