Foretell security attacks in FOSS? Yes, please! But how??

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

>>> Foretell security attacks in FOSS? Yes please!
(but how??)
Name: Carlos E. Budde
Inst: Università di Trento, Italy
Dat...

>>> Intro
[~]$ _ [2/16]

>>> Intro
[~]$ _ [2/16]

>>> Intro
[~]$ _ [2/16]

>>> Intro
[~]$ _ [2/16]

>>> Intro
© loonylabs
[~]$ _ [2/16]

>>> Outline
1. Problem
2. Proposal
3. Practice
[~]$ _ [3/16]

>>> Problem
1. Problem
2. Proposal
3. Practice
[1. Problem]$ _ [4/16]

>>> Software’s vulnerable lifecycle
org.redisson:redisson
3.17.5
ℓa
io.netty:netty-codec
4.1.79
ℓd
Sep'22
Aug'22
Jul'22 De...

>>> Software’s vulnerable lifecycle
org.redisson:redisson
3.17.5
ℓa
io.netty:netty-codec
4.1.79
ℓd
4.1.80
ℓd
Sep'22
Aug'22...

>>> Software’s vulnerable lifecycle
org.redisson:redisson
3.17.5
ℓa ℓa
3.17.6
3.17.5
ℓa
io.netty:netty-codec
4.1.79
ℓd
4.1...

>>> Software’s vulnerable lifecycle
org.redisson:redisson
3.17.5
ℓa ℓa
3.17.6
3.17.5
ℓa
io.netty:netty-codec
4.1.79
ℓd
4.1...

>>> Software’s vulnerable lifecycle
org.redisson:redisson
3.17.5
ℓa ℓa
3.17.6
3.17.5
ℓa
ℓa
3.17.7
io.netty:netty-codec
4.1...

>>> Software’s vulnerable lifecycle
org.redisson:redisson
3.17.5
ℓa ℓa
3.17.6
3.17.5
ℓa
ℓa
3.17.7
ℓa
3.18.0
ℓa
3.18.1
ℓa
3...

>>> Software’s vulnerable lifecycle
org.redisson:redisson
3.17.5
ℓa ℓa
3.17.6
3.17.5
ℓa
ℓa
3.17.7
ℓa
3.18.0
ℓa
3.18.1
ℓa
3...

>>> Software’s vulnerable lifecycle
org.redisson:redisson
3.17.5
ℓa ℓa
3.17.6
3.17.5
ℓa
ℓa
3.17.7
ℓa
3.18.0
ℓa
3.18.1
ℓa
3...

>>> Software’s vulnerable lifecycle
org.redisson:redisson
3.17.5
ℓa ℓa
3.17.6
3.17.5
ℓa
ℓa
3.17.7
ℓa
3.18.0
ℓa
3.18.1
ℓa
3...

>>> Software’s vulnerable lifecycle
org.redisson:redisson
3.17.5
ℓa ℓa
3.17.6
3.17.5
ℓa
io.netty:netty-codec
4.1.79
ℓd
4.1...

>>> State of the ART Models to predict vulnerabilities
Q1 Pr(vuln.) as function of time
* time-regression models on CVE pu...

>>> State of the ART Models to predict vulnerabilities
Q1 Pr(vuln.) as function of time
* time-regression models on CVE pu...

>>> State of the ART Models to predict vulnerabilities
Q1 Pr(vuln.) as function of time
* time-regression models on CVE pu...

>>> State of the ART Models to predict vulnerabilities
Q1 Pr(vuln.) as function of time
* time-regression models on CVE pu...

>>> State of the ART Models to predict vulnerabilities
Q1 Pr(vuln.) as function of time
* time-regression models on CVE pu...

>>> Gap analysis
* Studies typically try to detect, not forecast vulnerabilities.
* The dependency tree is seldom analysed...

>>> Gap analysis
* Studies typically try to detect, not forecast vulnerabilities.
* The dependency tree is seldom analysed...

>>> Gap analysis
* Studies typically try to detect, not forecast vulnerabilities.
* The dependency tree is seldom analysed...

>>> Gap analysis
* Studies typically try to detect, not forecast vulnerabilities.
* The dependency tree is seldom analysed...

>>> Proposal
1. Problem
2. Proposal
3. Practice
[2. Proposal]$ _ [8/16]

>>> Idea: fit CVE disclosure time
[2. Proposal]$ _ [9/16]

>>> Idea: fit CVE disclosure time
org.redisson:redisson
3.17.5
ℓa ℓa
3.17.6
3.17.5
ℓa
ℓa
3.17.7
ℓa
3.18.0
ℓa
3.18.1
ℓa
3.1...

>>> Idea: fit CVE disclosure time
org.redisson:redisson
3.17.5
ℓa ℓa
3.17.6
3.17.5
ℓa
ℓa
3.17.7
ℓa
3.18.0
ℓa
3.18.1
ℓa
3.1...

>>> Idea: fit CVE disclosure time
org.redisson:redisson
3.17.5
ℓa ℓa
3.17.6
3.17.5
ℓa
ℓa
3.17.7
ℓa
3.18.0
ℓa
3.18.1
ℓa
3.1...

>>> Idea: fit CVE disclosure time
org.redisson:redisson
3.17.5
ℓa ℓa
3.17.6
3.17.5
ℓa
ℓa
3.17.7
ℓa
3.18.0
ℓa
3.18.1
ℓa
3.1...

>>> Idea: fit CVE disclosure time
org.redisson:redisson
3.17.5
ℓa ℓa
3.17.6
3.17.5
ℓa
ℓa
3.17.7
ℓa
3.18.0
ℓa
3.18.1
ℓa
3.1...

>>> Idea: fit CVE disclosure time
org.redisson:redisson
3.17.5
ℓa ℓa
3.17.6
3.17.5
ℓa
ℓa
3.17.7
ℓa
3.18.0
ℓa
3.18.1
ℓa
3.1...

>>> Rules of the game
* Count each CVE as one data point
* must choose one affected version!
* Discriminate per developmen...

>>> Rules of the game
* Count each CVE as one data point
3.17.5
ℓa
ℓa
3.17.6
3.17.5
ℓa
ℓa
3.17.7
ℓa
3.18.1
ℓa
3.17.7 ℓ
3.1...

>>> Rules of the game
* Count each CVE as one data point
3.17.5
ℓa
ℓa
3.17.6
3.17.5
ℓa
ℓa
3.17.7
ℓa
3.18.1
ℓa
3.17.7 ℓ
3.1...

>>> Rules of the game
* Count each CVE as one data point
* must choose one affected version!
* Discriminate per developmen...

>>> Rules of the game
* Count each CVE as one data point
* must choose one affected version!
* Discriminate per developmen...

>>> Rules of the game
* Count each CVE as one data point
* must choose one affected version!
* Discriminate per developmen...

>>> Security-relevant code metrics
CVEs with the "Java" keyword
Attack Vector
Physical Local Adjacent Network
0
1000
2000
...

>>> Security-relevant code metrics
CVEs with the "Java" keyword
Attack Vector
Physical Local Adjacent Network
0
1000
2000
...

>>> Security-relevant code metrics
[2. Proposal]$ _ [11/16]

>>> Security-relevant code metrics
(Own) Code size
[2. Proposal]$ _ [11/16]

>>> Security-relevant code metrics
Some SW metric
Some
other
SW
metric
Types of so�tware library
[2. Proposal]$ _ [11/16]

>>> Security-relevant code metrics
Some SW metric
Some
other
SW
metric
Types of so�tware library
(Own) Code size
Used in r...

>>> Security-relevant code metrics
Some SW metric
Some
other
SW
metric
Types of so�tware library
(Own) Code size
Used in r...

>>> Security-relevant code metrics
Some SW metric
Some
other
SW
metric
Types of so�tware library
(Own) Code size
Used in r...

>>> Security-relevant code metrics
Some SW metric
Some
other
SW
metric
Types of so�tware library
(Own) Code size
Used in r...

>>> Practice
1. Problem
2. Proposal
3. Practice
[3. Practice]$ _ [12/16]

>>> Results for Java libraries
Time from release date of library to publication date of CVE
Probability
of
CVE
in
own_code...

>>> Results for Java libraries
Time from release date of library to publication date of CVE
Probability
of
CVE
in
own_code...

>>> Results for Java libraries
Time from release date of library to publication date of CVE
Probability
of
CVE
in
own_code...

>>> Library update: survival analysis
org.redisson:redisson
3.17.5
ℓa ℓa
3.17.6
3.17.5
ℓa
io.netty:netty-codec
4.1.79
ℓd
4...

>>> Library update: survival analysis
3.17.5
ℓa ℓa
3.17.6
3.17.5
ℓa
4.1.79
ℓd
4.1.80
ℓd
4.1.81
ℓd
4.1.82
ℓd
ℓa
3.17.7
? ? ...

Library update: survival analysis
3.17.5
ℓa ℓa
3.17.6
3.17.5
ℓa
4.1.79
ℓd
4.1.80
ℓd
4.1.81
ℓd
4.1.82
ℓd
ℓa
3.17.7
? ? ? ?
...

Library update: survival analysis
3.17.5
ℓa ℓa
3.17.6
3.17.5
ℓa
4.1.79
ℓd
4.1.80
ℓd
4.1.81
ℓd
4.1.82
ℓd
ℓa
3.17.7
? ? ? ?
...

Library update: survival analysis
3.17.5
ℓa ℓa
3.17.6
3.17.5
ℓa
4.1.79
ℓd
4.1.80
ℓd
4.1.81
ℓd
4.1.82
ℓd
ℓa
3.17.7
? ? ? ?
...

Library update: survival analysis
3.17.5
ℓa ℓa
3.17.6
3.17.5
ℓa
4.1.79
ℓd
4.1.80
ℓd
4.1.81
ℓd
4.1.82
ℓd
ℓa
3.17.7
? ? ? ?
...

Library update: survival analysis
3.17.5
ℓa ℓa
3.17.6
3.17.5
ℓa
4.1.79
ℓd
4.1.80
ℓd
4.1.81
ℓd
4.1.82
ℓd
ℓa
3.17.7
? ? ? ?
...

Library update: survival analysis
3.17.5
ℓa ℓa
3.17.6
3.17.5
ℓa
4.1.79
ℓd
4.1.80
ℓd
4.1.81
ℓd
4.1.82
ℓd
ℓa
3.17.7
? ? ? ?
...

Library update: survival analysis
3.17.5
ℓa ℓa
3.17.6
3.17.5
ℓa
4.1.79
ℓd
4.1.80
ℓd
4.1.81
ℓd
4.1.82
ℓd
ℓa
3.17.7
? ? ? ?
...

Library update: survival analysis
3.17.5
ℓa ℓa
3.17.6
3.17.5
ℓa
4.1.79
ℓd
4.1.80
ℓd
4.1.81
ℓd
4.1.82
ℓd
ℓa
3.17.7
? ? ? ?
...

Library update: survival analysis
3.17.5
ℓa ℓa
3.17.6
3.17.5
ℓa
4.1.79
ℓd
4.1.80
ℓd
4.1.81
ℓd
4.1.82
ℓd
ℓa
3.17.7
? ? ? ?
...

Library update: survival analysis
3.17.5
ℓa ℓa
3.17.6
3.17.5
ℓa
4.1.79
ℓd
4.1.80
ℓd
4.1.81
ℓd
4.1.82
ℓd
ℓa
3.17.7
? ? ? ?
...

Outro
* Some things done
* Pr(vuln.) as time from library release to CVE publication
* Discriminate per type of library (s...

Outro
* Some things done
* Pr(vuln.) as time from library release to CVE publication
* Discriminate per type of library (s...

Outro
* Some things done
* Pr(vuln.) as time from library release to CVE publication
* Discriminate per type of library (s...

Outro
* Some things done
* Pr(vuln.) as time from library release to CVE publication
* Discriminate per type of library (s...

Outro
* Some things done
* Pr(vuln.) as time from library release to CVE publication
* Discriminate per type of library (s...

Outro
* Some things done
* Pr(vuln.) as time from library release to CVE publication
* Discriminate per type of library (s...

Outro
* Some things done
* Pr(vuln.) as time from library release to CVE publication
* Discriminate per type of library (s...

Outro
* Some things done
* Pr(vuln.) as time from library release to CVE publication
* Discriminate per type of library (s...

Outro
* Some things done
* Pr(vuln.) as time from library release to CVE publication
* Discriminate per type of library (s...

Foretell security attacks in FOSS? Yes please!
that’s how!!
Name: Carlos E. Budde†
Inst: Università di Trento, Italy
https...

Share Slideshare

LinkedIn
Facebook
Twitter

Embed

Size (px)

Show related Slideshows at end

WordPress Shortcode

Link

Share
Email

2024 Trend Updates: What Really Wor... by Search Engine Jou... 1057327 views
Storytelling For The Web: Integrate... by Chiara Aliotta 973877 views
Artificial Intelligence, Data and C... by OECD Directorate ... 910242 views
How to Leverage AI to Boost Employe... by SocialHRCamp 385546 views
2024 State of Marketing Report – by... by Marius Sescu 218326 views
Everything You Need To Know About C... by Expeed Software 235577 views

View on Slideshare

1 of 76 Ad

View on Slideshare

1 of 76 Ad