Experience Report: Study of Vulnerabilities of Enterprise Operating Systems

被引：14

作者：

Gorbenko, Anatoliy ^{[1
]}

Romanovsky, Alexander ^{[2
]}

Tarasyuk, Olga ^{[3
]}

Biloborodov, Oleksandr ^{[4
]}

机构：

[1] Leeds Beckett Univ, Sch Comp Creat Technol & Engn, Leeds, W Yorkshire, England

[2] Newcastle Univ, Sch Comp Sci, Newcastle Upon Tyne, Tyne & Wear, England

[3] Natl Aerosp Univ, Dept Comp Syst & Networks, Kharkov, Ukraine

[4] Plarium Ukraine LLC, Kharkov, Ukraine

来源：

2017 IEEE 28TH INTERNATIONAL SYMPOSIUM ON SOFTWARE RELIABILITY ENGINEERING (ISSRE) | 2017年

基金：

英国工程与自然科学研究理事会;

关键词：

security; vulnerability; operating systems; vulnerability databases; days-of-risk; forever-day vulnerabilities; vulnerability life cycle; vulnerability statistics;

D O I：

10.1109/ISSRE.2017.20

中图分类号：

TP18 [人工智能理论];

学科分类号：

081104 ; 0812 ; 0835 ; 1405 ;

摘要：

This experience report analyses security problems of modern computer systems caused by vulnerabilities in their operating systems. An aggregated vulnerability database has been developed by joining vulnerability records from two publicly available vulnerability databases: the Common Vulnerabilities and Exposures system (CVE) and the National Vulnerabilities database (NVD). The aggregated data allow us to investigate the stages of the vulnerability life cycle, vulnerability disclosure and the elimination statistics for different operating systems. The specific technical areas the paper covers are the quantitative assessment of vulnerabilities discovered and fixed in operating systems, the estimation of time that vendors spend on patch issuing, and the analysis of the vulnerability criticality and identification of vulnerabilities common for different operating systems.

引用

页码：205 / 215

页数：11

共 34 条

[1] THE N-VERSION APPROACH TO FAULT-TOLERANT SOFTWARE
AVIZIENIS, A
[J]. IEEE TRANSACTIONS ON SOFTWARE ENGINEERING, 1985, 11 (12) : 1491 - 1501
[2] Barth B., 2017, LAG BUGS 1 DISCLOSUR
[3] Bilge L, 2012, ACM C COMP COMM SEC
[4] Cisco Systems, 2009, TCP STAT MAN DEN SER
[5] Clark B., HACKERS TAKE HOSP OF
[6] Edmonds P., 2007, IT COMES PROTECTION
[7] FIRST.org, 2015, COMM VULN SCOR SYST
[8] Frei S., 2006, SIGCOMM WORKSH LARG
[9] Garcia M., 2011, IEEE IFIP 41 INT C D
[10] Gartner, 2016, GARTN MARK SHAR AN S

← 1 2 3 4 →