一种Web软件安全漏洞分类方法

被引:10
作者
杜经农
卢炎生
机构
[1] 华中科技大学计算机科学与技术学院
关键词
Web应用软件; 安全漏洞; 分类模型;
D O I
暂无
中图分类号
TP393.08 [];
学科分类号
0839 ; 1402 ;
摘要
研究了环境错误与状态错误引发Web应用软件安全问题的途径,在此基础上提出了一种用于进行Web应用软件安全漏洞分类的层次分析模型。使用该模型对CVE漏洞数据库中抽取的Web软件安全漏洞进行了分类,并与使用EAI模型分类的结果做了对比。评估结果表明,该模型具备良好的漏洞分类能力,适用于指导Web应用软件的安全测试和安全防御工作。
引用
收藏
页码:10 / 14+20 +20
页数:6
相关论文
共 11 条
[1]  
Susceptibility matrix:A new aid to software auditing. Jiwnani K,Zelkowitz M. IEEE Security and Privacy . 2004
[2]  
Vulnerability Testing of Software System Using Fault Injection. Du Wenliang,Mathur A P. Coast TR98-02 . 1998
[3]  
Vulnerabilities analysis. Bishop M. Proceedings of Recent Ad-vances in Intrusion Detection . 1999
[4]  
Software Vulnerability Analysis. I.Krsul. . 1998
[5]  
Cross-site scripting worms and viruses:The impending threat and the best defense. Grossman J. http://www.whitehatsec.com/downloads/WHXSSThreats.pdf .
[6]  
A taxonomy of causes of software vulnerabilities in in-ternet software. Piessens F. Supplementary Proceedings of the13th Interna-tional Symposium on Software Reliability Engineering . 2002
[7]  
A software flaw taxonomy:Ai-ming tools at security. Weber S,Karger P A,Paradkar A. Software Engineering at Secure Systems-Building Trustworthy Application (sSESS’05) . 2005
[8]  
Towards a taxonomy of vulnerabilities. Bazaz A,Arthur J. Pro-ceedings of the40th Annual Hawaii International Conference on System Sciences (HICSS’07) . 2007
[9]  
A taxonomy of computer program security flaws. Landwehr C E,Bull A R,Mcdermoll J P,et al. . 1994
[10]  
Common Vulnerability Enumeration. http://cve.mitre.org/cve/index.html .