Software security analysis and assessment model for the web-based applications

Article type: Research Article

Authors: Wang, Y.^{; *} | Lively, W.M. | Simmons, D.B.

Affiliations: Department of Computer Science, Texas A&M University, College Station, TX 77843, USA

Correspondence: [*] Corresponding author. E-mail: [email protected].

Abstract: For web-based applications, a security analysis was conducted in order to identify software vulnerabilities and develop a new security assessment model. During such an analysis, the major security vulnerabilities observed in the open web proxy honeypot during the data collection time from February to March 2005 were computer worm attacks in Code Red and Nimda, AWSTAT attacks, unauthorized access request (HTTP error code 403), MS-SQL version overflow attacks, etc. To develop the security assessment model, we extended the generic security model for a single component system to multiple components using the multidimensional Markov process model. The resulting model was applied to the most popular software systems. The software system availability in security is computed using real data, and the mean time to security failure is calculated. This paper not only provides the software vulnerability analysis of the web-based applications, but also details the software security assessment for multiple component systems.

Keywords: Software security, assessment model, web-based applications, Markov process model

DOI: 10.3233/JCM-2009-0246

Journal: Journal of Computational Methods in Sciences and Engineering, vol. 9, no. s2, pp. S179-S189, 2009