Predictive models for identifying software components prone to failure during security attacks

Sometimes software security engineers are given a product that they not familiar with, but are asked to have a security analysis done for it in a relatively short time. An early knowledge of where the most vulnerable regions of a software-based system are likely to reside can help prioritize their efforts. In general, software metrics can be used to predict faultand failure-prone components for prioritizing inspection, testing, and redesign efforts. We believe that the security community can leverage this knowledge to design tools and metrics that can identify vulnerabilityand attack-prone software components early in the software life cycle. We analyzed a large commercial telecommunications software-based system and found that the presence of security faults correlates strongly with the presence of a more general category of reliability faults. This, of course, is not surprising if one accepts the notion that security faults are in many instances a subset of a reliability fault set. We discuss a model that can be useful for identifying attack-prone components and for prioritizing security efforts early in the software life-cycle.