Software risk assessment method based on defect analysis

Abstract

The invention discloses a software risk assessment method based on defect analysis. The risk assessment method comprises the following steps of obtaining input data and an input relationship required by risk calculation through software asset identification, the defect analysis and consequence attribute evaluation, calculating consequence attribute factors of consequence attributes in functional modules, calculating risk degrees sumRtk of consequences of whole software, calculating weighted means of the risk degrees of the consequence attributes according to weights (pwti) of the functional modules of the software, obtaining the risk degrees sumRtk of the consequence attributes of the whole software, calculating a whole risk value of the software, calculating weighted means of the risk degrees of the consequence attributes of the whole software according to weights (rwtk) of the consequence attributes, obtaining a final risk value Risk of the software, evaluating a risk level, and obtaining the risk level of the software as an assessment result according to the risk value Risk of the software. The method solves the problems that risk element assignments in most risk assessment models relate to more expert opinions at present, and some assignments are unquantifiable. The method avoids repeated risk calculation to the greatest extent.

Description

technical field [0001] The invention relates to the trusted computing field; in particular, it relates to a software risk assessment method. Background technique [0002] With the rapid development of the software industry and the rapid spread through the network, the security of software products has received more and more attention. So, how to evaluate the level of software security is good or bad? Software risk assessment techniques provide a basis for evaluating software security. Software risk assessment is to use scientific methods and means from the perspective of risk management to systematically analyze the threats faced by a certain software product and its existing loopholes, and to evaluate the degree of harm that may be caused by a security defect event. Risk, or control the risk at an acceptable level, so as to provide a scientific basis for maximum protection of software security. [0003] In human social and economic activities and daily life, the word ris...

AI Technical Summary

Problems solved by technology

[0005] Through the analysis of some traditional risk assessment models, it is found that these assessment models have the following problems: 1) Many steps in the risk assessment process require the participation of experts, and rely on the subjective experience of security experts, there are some problems that are difficult to quantify, especially in the probability of risk occurrence It directly affects the accuracy of software safety assessment

2) Many existing risk assessment models have double counting of risk events, which leads to large errors in software risk assessment

Images