Developing a probabilistic security measure using a software reliability model.

摘要

Security in computer systems is becoming increasingly important due to the uses of networks for critical transactions. In this highly interconnected world, creating systems that are more secure requires us to view computer security as a system requirement instead of using “find-and-fix” methods. For this approach to succeed, we need a way of evaluating security mechanisms based on what they can provide at the design stage of system development.; The purpose of this dissertation is to investigate how to develop a probabilistic security measure that can be used to evaluate various security mechanisms for a specific system during its design. This will eventually lead to the development of more secure systems, as informed decisions about security can be incorporated into the system design from the earliest development stages.; The approach used here is based on software reliability modeling and statistical analysis. Since a software reliability model is a mathematical model that can be used to predict the degree of software reliability, a security measure based on a software reliability model can be used to predict the degree of system security. The non-homogeneous Poisson process (NHPP) is used as an estimation technique for failures in the system. Regression analysis is used to predict a future value of a variable based on knowledge of old values of the variable. Together, these modeling techniques provide the foundation for a predictive security measure that provides some reasonable values, as several examples show.