Abstract
When vulnerabilities are discovered in software, which often happens after deployment, they must be addressed as part of ongoing software maintenance. A mature software development organization should analyze vulnerabilities in order to determine how they, and similar vulnerabilities, can be prevented in the future. In this paper we present a structured method for analyzing and documenting the causes of software vulnerabilities. Applied during software maintenance, the method generates the information needed for improving the software development process, to prevent similar vulnerabilities in future releases. Our approach is based on vulnerability cause graphs, a structured representation of causes of software vulnerabilities.

URL:
http://rewerse.net/publications/rewerse-publications.html#REWERSE-RP-2006-187

BibTeX:

@inproceedings{REWERSE-RP-2006-187,
	author = {David Byers and Shanai Ardi and Nahid Shahmehri and Claudiu Duma},
	title = {Modeling Software Vulnerabilities with Vulnerability Cause Graphs},
	booktitle = {Proceedings of 22nd IEEE International Conference on Software Maintenance, Philadelphia, PA, USA (24th--27th September 2006)},
	year = {2006},
	organization = {IEEE},
	pages = {411--422},
	url = {http://rewerse.net/publications/rewerse-publications.html#REWERSE-RP-2006-187}
}