Defect analysis based software creditability evaluating method

Abstract

The invention discloses a defect analysis based software creditability evaluating method, and relates to the field of software security. The method comprises the following steps: constructing an attack model base on the basis of common attack pattern enumeration and classification (CAPEC), increasing the attribute of threat degree, and establishing a several-for-one mapping relationship between the attack mode and the software defect to acquire the threat degree of the software defect; constructing a defect base; constructing a formalized uniform software model on the basis of formal language and traditional unified modeling language (UML) time sequence diagram, and constructing a software security defect knowledge base based on the uniform software model; discovering potential software security defect in the uniform software model through a theorem proving machine; dividing the software security defects into security vital defects, privacy vital defects and fault-tolerant vital defects according to the classification standard and the defect base; calculating the creditability values of the three types of defects according to the threat degree of the defects, the corresponding software environment index and a calculation formula; and realizing creditability evaluation of the software security defect by combining a privacy quantization value, a fault-tolerant quantization value and a user experience quantization value.

Description

technical field [0001] The present invention takes the design and development stage of software as the main object, and is dedicated to quantifying software credibility evaluation, improving the accuracy of software credibility evaluation, and improving the quality and efficiency of software development. It belongs to the field of software security, and particularly relates to a defect analysis based Software credibility evaluation method. Background technique [0002] The continuous emergence of software malicious attacks and the unsatisfactory status quo of software product quality have caused more and more attention to the issue of trustworthiness. With the continuous development of trusted software technology, there is an urgent need for reasonable trust evaluation methods to examine the contribution and effect of these technologies in improving trustworthiness. At the same time, in the process of software development, software engineers can also evaluate the credibilit...

AI Technical Summary

Problems solved by technology

[0003] Although there is no broad consensus on the precise definition of trustworthiness, in general terms, trustworthiness can be positioned as a guarantee that a system should be trusted: whether it is in the environment interference, human error, malicious attack or design , In the case of implementation errors, the system behavior does not exceed expectations

Images