NDLI: Analyses of Two End-User Software Vulnerability Exposure Metrics

Please wait, while we are loading the content...

2015 10th International Conference on Availability, Reliability and Security

2014 Ninth International Conference on Availability, Reliability and Security

2013 International Conference on Availability, Reliability and Security

2012 Seventh International Conference on Availability, Reliability and Security

ARES 2012 - 2012 Seventh International Conference on Availability, Reliability and Security [Cover art]

Table of contents

ARES Conference: Welcome Message from the ARES Conference Officers

ARES Workshops: Welcome Message from the ARES Workshop Co-Chairs

ARES Committee Lists

Message from the FARES Workshop Organizers

Message from the IWSMA Workshop Organizers

IWSMA Workshop Program Committee

Message from the MoCrySEN Workshop Organizers

MoCrySEN Workshop Committee

Mesage from the OSA Workshop Organizers

OSA Workshop Program Committee

Message from the RISI Workshop Organizers

RISI Workshop Program Committee

Message from the SecOnT Workshop Organizers

SecOnT Workshop Program Committee

Message from the SECSE Workshop Organizers

SECSE Workshop Program Committee

WSDF Workshop: Welcome from the WSDF Workshop Organizers

WSDF Workshop Program Committee

Analyses of Two End-User Software Vulnerability Exposure Metrics

An Adaptive Risk Control and Security Management for Embedded Real-Time System

Using Linear Support Vector Machines to Solve the Asymmetric Comparison-Based Fault Diagnosis Problem

Topology-Driven Secure Initialization in Wireless Sensor Networks: A Tool-Assisted Approach

On Measuring the Parasitic Backscatter of Sensor-Enabled UHF RFID Tags

Veto-based Malware Detection

Efficient Generic Construction of Forward-Secure Identity-Based Signature

From Computationally-proved Protocol Specifications to Implementations

Oblivious and Fair Server-Aided Two-Party Computation

A Group Signature Based Electronic Toll Pricing System

Anonymous Communication by Branch-and-Bound

An Analysis of Implemented and Desirable Settings for Identity Management on Social Networking Sites

An Approach to Bridge the Gap between Role Mining and Role Engineering via Migration Guides

Towards Automated Assistance for Mined Roles Analysis in Role Mining Applications

A Coordination-Driven Authorization Framework for Space Containers

RIM: A Method to Defend from JIT Spraying Attack

Building a Flexible Service Architecture for User Controlled Hybrid Clouds

Towards a Holistic Information Security Governance Framework for SOA

An Algorithm for Compression of XACML Access Control Policy Sets by Recursive Subsumption

E-mail Classification Using Social Network Information

Two-Pronged Phish Snagging

Civitas and the Real World: Problems and Solutions from a Practical Point of View

Understanding the Development Trends of Electronic Voting Systems

Secure Mobile Data Collection Systems for Low-Budget Settings

Dynamic DNS Update Security, Based on Cryptographically Generated Addresses and ID-Based Cryptography, in an IPv6 Autoconfiguration Context

Enforcing Access Control in Virtual Organizations Using Hierarchical Attribute-Based Encryption

Boosting Logical Attack Graph for Efficient Security Control

High Level Model of Control Flow Attacks for Smart Card Functional Security

Federated Identity Management Challenges

An Empirical Study on Design Diversity of Functionally Equivalent Web Services

Using Security Requirements Engineering Approaches to Support ISO 27001 Information Security Management Systems Development and Documentation

A Personalized Whitelist Approach for Phishing Webpage Detection

Model-Based Digit Analysis for Fraud Detection Overcomes Limitations of Benford Analysis

Antidotes for DNS Poisoning by Off-Path Adversaries

Classic Replication Techniques on the Cloud

An Economic Model for Maximizing Profit of a Cloud Service Provider

Security Concept and Implementation for a Cloud Based E-science Infrastructure

Organizational Risk Assessment Based on Attacks Repetition

A Critical Survey of Security Indicator Approaches

Fault Tolerance and Power Consumption Analysis on Chip-Multi Processors Architectures

A Privacy preserving Approach to Call Detail Records Analysis in VoIP Systems

Design and Implementation of a CBR-based Privacy Agent

Disabilities and Authentication Methods: Usability and Security

Privacy Policy Preferences Enforced by SPARQL Query Rewriting

Policy and Context Management in Dynamically Provisioned Access Control Service for Virtualized Cloud Infrastructures

Trusted Virtual Infrastructure Bootstrapping for On Demand Services

Automatic Anonymization of Natural Languages Texts Posted on Social Networking Services and Automatic Detection of Disclosure

E2E: An Optimized IPsec Architecture for Secure and Fast Offload

Location Anonymity Based on Fake Queries in Continuous Location-Based Services

Janitor, Certificate and Jury (JCJ) Trust Scheme for Wireless Ad-hoc Networks

Repackaging Android Applications for Auditing Access to Private Data

On the Weak State in GGHN-like Ciphers

A Scan-Based Side Channel Attack on the NTRUEncrypt Cryptosystem

Symmetry in Security Protocol Cryptographic Messages -- A Serious Weakness Exploitable by Parallel Session Attacks

BPVrfy: Hybrid Cryptographic Scheme Based -- Federate Identity Attributes Verification Model for Business Processes

Integrating ISO/IEC 27001 and other Managerial Discipline Standards with Processes of Management in Organizations

Towards an Open Standard Vote Verification Framework in Electronic Voting Systems

Sensitivity Analysis of Loss of Corporate Efficiency and Productivity Associated with Enterprise DRM Technology

A Multi-objective Decision Support Framework for Simulation-Based Security Control Selection

An Integrated Method for Pattern-Based Elicitation of Legal Requirements Applied to a Cloud Computing Example

A Private Information Detector for Controlling Circulation of Private Information through Social Networks

Return-Oriented Programming Attack on the Xen Hypervisor

Peer-to-Peer Driven Software Engineering Considering Security, Reliability, and Performance

Evaluation of an Improved Visualization System for Helping Children Identify Risky Websites

A Common Body of Knowledge for Engineering Secure Software and Services

Building an Incident Management Body of Knowledge

Challenges of Web-Based Information Security Knowledge Sharing

Using Ontologies for Adaptive Information Security Training

An Ontology for Run-Time Verification of Security Certificates for SOA

IO: An Interconnected Asset Ontology in Support of Risk Management Processes

Representing Threats in BPMN 2.0

Type Classification against Fault Enabled Mutant in Java Based Smart Card

Towards Concurrent Data Sampling Using GPU Coprocessing

A Taxonomy of Time and State Attacks

Comparing Privacy Requirements Engineering Approaches

A Comparative Study of Software Security Pattern Classifications

Uncertainty Bounds for Digital Forensic Evidence and Hypotheses

Using Attack Graphs in Forensic Examinations

A Statistical Approach for Identifying Videos of Child Pornography at Crime Scenes

Synthetic Data Creation for Forensic Tool Testing: Improving Performance of the 3LSPG Framework

Simplifying RAM Forensics: A GUI and Extensions for the Volatility Framework

InnoDB Database Forensics: Reconstructing Data Manipulation Queries from Redo Logs

IEEE Computer Society Technical & Conferen [Roster Page]

2011 Sixth International Conference on Availability, Reliability and Security

2010 International Conference on Availability, Reliability and Security

2009 International Conference on Availability, Reliability and Security

2008 Third International Conference on Availability, Reliability and Security

The Second International Conference on Availability, Reliability and Security (ARES'07)

First International Conference on Availability, Reliability and Security (ARES'06)

Analyses of Two End-User Software Vulnerability Exposure Metrics

Content Provider	IEEE Xplore Digital Library
Author	Wright, J.L. McQueen, M. Wellman, L.
Copyright Year	2012
Abstract	The risk due to software vulnerabilities will not be completely resolved in the near future. Instead, putting reliable vulnerability measures into the hands of end-users so that informed decisions can be made regarding the relative security exposure incurred by choosing one software package over another is of importance. To that end, we propose two new security metrics, average active vulnerabilities (AAV) and vulnerability free days (VFD). These metrics capture both the speed with which new vulnerabilities are reported to vendors and the rate at which software vendors fix them. We then examine how the metrics are computed using currently available data sets and demonstrate their estimation in a simulation experiment using four different browsers as a case study. Finally, we discuss how the metrics may be used by the various stakeholders of software to aid usage decisions.
Starting Page	1
Ending Page	10
File Size	232855
Page Count	10
File Format	PDF
ISBN	9781467322447
DOI	10.1109/ARES.2012.33
Language	English
Publisher	Institute of Electrical and Electronics Engineers, Inc. (IEEE)
Publisher Date	2012-08-20
Publisher Place	Czech Republic
Access Restriction	Subscribed
Rights Holder	Institute of Electrical and Electronics Engineers, Inc. (IEEE)
Subject Keyword	Measurement Google security Databases Software Internet Browsers experimental security metrics Security
Content Type	Text
Resource Type	Article

Central Library (ISO-9001:2015 Certified)
Indian Institute of Technology Kharagpur
Kharagpur, West Bengal, India | PIN - 721302

See location in the Map
03222 282435
Mail: support@ndl.gov.in

Sl.	Authority	Responsibilities	Communication Details
1	Ministry of Education (GoI), Department of Higher Education	Sanctioning Authority	https://www.education.gov.in/ict-initiatives
2	Indian Institute of Technology Kharagpur	Host Institute of the Project: The host institute of the project is responsible for providing infrastructure support and hosting the project	https://www.iitkgp.ac.in
3	National Digital Library of India Office, Indian Institute of Technology Kharagpur	The administrative and infrastructural headquarters of the project	Dr. B. Sutradhar bsutra@ndl.gov.in
4	Project PI / Joint PI	Principal Investigator and Joint Principal Investigators of the project	Dr. B. Sutradhar bsutra@ndl.gov.in Prof. Saswat Chakrabarti will be added soon
5	Website/Portal (Helpdesk)	Queries regarding NDLI and its services	support@ndl.gov.in
6	Contents and Copyright Issues	Queries related to content curation and copyright issues	content@ndl.gov.in
7	National Digital Library of India Club (NDLI Club)	Queries related to NDLI Club formation, support, user awareness program, seminar/symposium, collaboration, social media, promotion, and outreach	clubsupport@ndl.gov.in
8	Digital Preservation Centre (DPC)	Assistance with digitizing and archiving copyright-free printed books	dpc@ndl.gov.in
9	IDR Setup or Support	Queries related to establishment and support of Institutional Digital Repository (IDR) and IDR workshops	idr@ndl.gov.in