Bayesian-model averaging using MCMCBayes for web-browser vulnerability discovery. (March 2019)

• Record Type: Journal Article
• Authors: Johnston, Reuben; Sarkani, Shahryar; Mazzuchi, Thomas; Holzer, Thomas; Eveleigh, Timothy
• Is Part Of: Reliability engineering & system safety. Volume 183(2019)
• Page Start: 341
• Page End: 359
• Publication Date: 2019-03
• Subjects: Regression -- Growth curve -- Poisson process -- Gamma process -- Cooke's method; Reliability (Engineering) -- Periodicals; System safety -- Periodicals; Industrial safety -- Periodicals; Fiabilité -- Périodiques; Sécurité des systèmes -- Périodiques; Sécurité du travail -- Périodiques; 620.00452
• DOI: 10.1016/j.ress.2018.11.030
• Languages: English
• ISSNs: 0951-8320

Abstract

Highlights: Describes vulnerability discovery phenomenon in the software security lifecycle. Presents 46 software release (SR) and security assessment profile (SAP) variables. Elicits dataset using Cooke's method; gathers empirical web-browser datasets. Details Bayesian analysis of vulnerability discovery modeling (VDM) techniques. Demonstrates new, non-parametric and Bayesian model average (BMA) VDM techniques. ABSTRACT: Most software vulnerabilities are preventabl e, but they continue to be present in software releases. When Blackhats, or malicious researchers, discover vulnerabilities, they often release corresponding exploit software and malware. Therefore, customer confidence could be reduced if vulnerabilities—or discoveries of them—are not prevented, mitigated, or addressed. In addressing this, managers must choose which alternatives will provide maximal impact and could use vulnerability discovery modeling techniques to support their decision-making process. Applications of these techniques have used traditional approaches to analysis and, despite the dearth of data, have not included information from experts. This article takes an alternative approach, applying Bayesian methods to modeling the vulnerability-discovery phenomenon. Relevant data was obtained from security experts in structured workshops and from public databases. The open-source framework, MCMCBayes, was developed to automate performing Bayesian model averaging via power-posteriors. It combines predictions of interval-grouped discoveries by performance-weighting results from six variants of the non-homogeneous Poisson process (NHPP), two regression models, and two growth-curve models. The methodology is applicable to software-makers and persons interested in applications of expert-judgment elicitation or in using Bayesian analysis techniques with phenomena having non-decreasing counts over time. Graphical abstract: