文献类型：期刊文献

英文题名：Modeling and quantitatively predicting software security based on stochastic Petri nets

作者：Yang, Nianhua[1,2];Yu, Huiqun[1];Qian, Zhilin[1];Sun, Hua[1]

机构：[1]E China Univ Sci & Technol, Dept Comp Sci & Engn, Shanghai 200237, Peoples R China;[2]Shanghai Key Lab Comp Software Evaluating & Testi, Shanghai 201112, Peoples R China

年份：2012

卷号：55

期号：1-2

起止页码：102

外文期刊名：MATHEMATICAL AND COMPUTER MODELLING

收录：;EI(收录号：20114914585451);WOS:【SCI-EXPANDED(收录号:WOS:000296919500013)】；

基金：This work was supported by the NSF of China under grants No. 60773094 and 60473055, Shanghai Shuguang Program under grant No. 07SG32.

语种：英文

外文关键词：Model; Quantify; Software security; Sensitivity analysis; Hierarchical; Stochastic Petri net

摘要：To quantitatively predict software security in the design phase, hierarchical software security modeling and evaluation methods are proposed based on Stochastic Petri Nets (SPNs). Hierarchical methods mitigate the state-space explosion problem in SPNs. An isomorphic Markov Chain (MC) is obtained from the component SPN model. The security prediction value is calculated based on the probability distribution of the MC in the steady state. A sensitivity analysis method is proposed through evaluating the derivative of the security evaluation prediction equation. It provides a means to identify and trace back to the critical components for security enhancing. Security prediction and sensitivity analysis in the design phase provide the possibility to investigate and compare different solutions to the target system before realization. A case study shows the applicability and feasibility of our method. (C) 2011 Elsevier Ltd. All rights reserved.