Security Vulnerability Categories In Major Software Systems: A Comprehensive Analysis.pdf

It examines datasets from major operating systems and web servers, identifying attributes exploitable for risk prioritization and effective testing plans.

Key Findings:

Categorization Matters: Linking vulnerability types to severity levels helps prioritize testing and directs efforts towards high-risk vulnerabilities.
Modeling for Better Maintenance: Modeling vulnerabilities by category aids in post-release maintenance and patching by projecting the types and severity of future vulnerabilities.
Applying Vulnerability Discovery Models: Specific models, like the Alhazmi-Malaiya Logistic model, can predict vulnerability discovery rates for different categories and severity levels.

Taxonomies Discussed:

Vulnerability Type Taxonomies: Several proposed taxonomies aim for a universal classification, with MITRE Corporation and NIST's NVD adopting a widely recognized framework.
Severity Taxonomies: The Common Vulnerabilities Scoring System (CVSS) provides a standardized method to rate vulnerability severity based on multiple attributes.

Data Analysis:

The paper analyzes datasets from:

Windows XP, Windows 2000, RH Linux 6.2, Fedora (various server types)
* Internet Information Services (IIS), Apache (web servers)

It explores the distribution of vulnerabilities across categories and severity levels, identifying patterns and potential development flaws.

Contribution:

The study contributes to a more quantitative and systematic understanding of software security vulnerabilities, paving the way for improved testing strategies and better post-release maintenance.