Excerpts from the Abstract:

The consequences of a class of system failures, commonly known as software vulnerabilities, violate security policies. They can cause the loss of information and reduce the value or usefulness of the system.

An increased understanding of the nature of vulnerabilities, their manifestations, and the mechanisms that can be used to eliminate and prevent them can be achieved by the development of a unified definition of software vulnerabilities, the development of a framework for the creation of taxonomies for vulnerabilities, and the application of learning, visualization, and statistical tools on a representative collection of software vulnerabilities.

This dissertation provides a unifying definition of software vulnerability based on the notion that it is security policies that define what is allowable or desirable in a system. It also includes a framework for the development of classifications and taxonomies for software vulnerabilities.

This dissertation presents a classification of software vulnerabilities that focuses on the assumptions that programmers make regarding the environment in which their application will be executed and that frequently do not hold during the execution of the program. This dissertation concludes by showing that the unifying definition of software vulnerability, the framework for the development of classifications, and the application of learning and visualization tools can be used to improve security.

Excerpts from the Introduction:

As shown in Section 2.1.3, the existing definitions of software vulnerability have one of the following forms: Access Control definitions, State Space definitions, and Fuzzy definitions. This dissertation provides a unifying definition based on the notion that it is security policies that define what is allowable or desirable in the system, and hence, the notion of software vulnerability ultimately depends on our notion of policy. This dissertation also shows that existing classifications and taxonomies for software vulnerabilities, or related fields, do not satisfy all the desirable properties for classifications and taxonomies.

Section 3.1 defines the properties of measurements or observations necessary for the development of classifications; and provides a framework for the development of taxonomies for software vulnerabilities and related fields. This framework can be used as a basis for measuring features of vulnerabilities that can be used for the generation of classifications. These can be used to generalize, abstract, and communicate findings within the security research community, and contribute to our understanding of the nature of software vulnerabilities.

This dissertation presents an extension and revision of the classification of vulnerabilities presented by Aslam in [Aslam 1995]. Unlike its predecessor, this classification focuses on the assumptions that programmers make regarding the environment in which their application will execute, and that frequently do not hold in the execution of the program. Those vulnerabilities identified with this classification are not the result of software faults identified by common testing methods, because when tested in an environment that conforms to the assumptions made by programmers, the programs execute correctly.

This dissertation shows that machine learning and statistical analysis tools can reveal patterns and regularities that either reinforce our understanding of vulnerabilities, or pro-vide new insights into the nature of vulnerabilities. Machine learning and statistical analysis tools can also in ence the development of a priori classifications.

Finally, this dissertation describes how the development of taxonomies for software vulnerabilities can be used to build special domain-specific tools for the development of security-sensitive software.