Systems Performance Modeling

Adarsh Anand, Mangey Ram, Adarsh Anand, Mangey Ram

• Publisher: De Gruyter
• Year: 2020
• ISBN:
  9783110607635
• Edition: 1
• Topic: Technik & Maschinenbau
• Subtopic: Automatisierung im Maschinenbau

This book describes methods to improve software performance and safety using advanced mathematical and computational analytics. The main focus is laid on the increase of software reliability by preventive and predictive maintenance with efficient usage of modern testing resources. The editors collect contributions from international researchers in the field.

1 Impact of available resources on software patch management

Adarsh Anand

University of Delhi, Operational Research, Room No 208, 110007, Delhi, India

Jasmine Kaur

University of Delhi, Operational Research, Room No 208, 110007, Delhi, India

Anu A. Gokhale

Illinois State University, USA

Mangey Ram

Graphic Era Deemed to be University Dehradun, Uttarakhand, India

Abstract

Software security has been an area of immense research as most of the things surrounding us are technology based. Much has been talked about vulnerabilities, their categories and types. Some studies elaborated and extended the available discovery models but few have considered the correction process in the same work. In this study, an approach to deal with software vulnerability through the release of patch/updates has been presented. The methodical work presented here discusses a mathematical model for optimal allocation of resources to remove vulnerabilities through an update.

Keywords: severity, software patch, software security, software updates, vulnerability, vulnerability correction model,

1.1 Introduction

Software security is a matter of grave concern, and the need for secure software has been stressed upon enough. The first half of the year 2019 had already seen 3,800 cases of publicly disclosed software breaches and 4.1 billion records exposed [1]. With the hacking tools getting more and more advanced, it is a tough fight to keep the system safe from the intruders. Even minor loopholes or oversights leave the software highly vulnerable. Often, the exploited loopholes have a fix available, but due to lack of comprehension of the situation’s gravity, they are never plugged. Such faults or glitches in the system architecture, design, code or implementation that compromises the software’s security are termed as software vulnerabilities. The most common vulnerabilities are caused by memory safety violations, input validation error, privilege confusion bugs, privilege escalation, race conditions, side channel attack, and user interface failure. The most common types of vulnerabilities are SQL injection, command injection, buffer overflow, uncontrolled format string, integer overflow, cross-site scripting, and so on. The software vulnerabilities are also categorized on the basis of the extent of damage their presence or exploitability causes. The Common Vulnerabilities and Exposures (CVE) database provides a Common Vulnerability Scoring System (CVSS) score to the reported vulnerabilities known as the severity index on an ascending scale of 1 to 10 [2]. On the basis of severity score, vulnerabilities are categorized as low, medium, high, and critical. The vulnerability discovery process is modeled through Vulnerability Discovery Models (VDMs), which help quantify the vulnerabilities discovered and understand their detection behavior with time. The foremost software VDM was the Anderson’s thermodynamic model [3]. Rescorla [4] presented a linear and exponential trend in the vulnerability detection process. The Alhazmi-Malaiya model, an S-shaped, logistic VDM defined the three phases in the vulnerability discovery process as linear, learning, and saturation [5]. An effort-based model was proposed by Alhazmi and Malaiya [6] to m...