一种基于软集和多属性综合的软件漏洞发现方法  

Method for Software Vulnerability Discovery Based on Soft Set and Multi-attribute Comprehensiveness

作　　者：唐成华[1,2] 田吉龙[2] 王璐[2] 王丽娜[2] 强保华[1,2] 

机构地区：[1]桂林电子科技大学广西信息科学实验中心,桂林541004 [2]桂林电子科技大学计算机科学与工程学院,桂林541004

出　　处：《计算机科学》2015年第5期183-187,共5页Computer Science

基　　金：国家自然科学基金(61462020;61363006;61163057);广西信息科学实验中心基金(20130329);广西自然科学基金(2014GXNSFAA118375);桂林电子科技大学研究生教育创新计划项目(2013110124)资助

摘　　要：针对软件漏洞检测中的漏洞覆盖率和人工缺陷审查等问题,提出了一种基于软集和多属性综合的软件漏洞发现方法。首先基于多检测工具的可信集成,建立了软件漏洞影响的评估模型;其次引入软集实现漏洞影响因素的度量,接着通过多属性综合的集成工具确定漏洞对软件安全的严重性影响,并最终完成软件漏洞的发现过程。实验结果表明,该方法对不同级别的漏洞均有较好的检测能力,为改善软件漏洞检测的误报率和漏报率等问题提供了一种可行的途径。Aiming at the problem of the vulnerability coverage and artificial defect review in the software vulnerability detection, a method for software vulnerability discovery based on the soft set and multi-attribute comprehensiveness was proposed. Firstly, based on trusted integrated detection tools, an evaluation model of software vulnerability factors was established. Secondly, the soft set was introduced to measure vulnerability factors, then the serious impact on software security was determined through the method of multi-attribute comprehensive integration tools, and the discovery process of software vulnerability was finally completed. Experimental results show that the method has better detection capabilities for vulnerability in different level , which provides a feasible way for the improvement of software vulnerability detection false positive rate and false negative rate.

关 键 词：软件漏洞 软集 属性集 漏报率 误报率 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]