|Article title||DETECTION OF VULNERABILITIES MUTATION IN SOFTWARE|
|Section||SECTION I. INFORMATION SECURITY RISKS MANAGEMENT|
|Month, Year||08, 2014 @en|
|Abstract||This article presents a method for vulnerabilities detection in software. The urgency associated with the need for timely detection of vulnerabilities in software products to prevent leakage or damage user data. The object of research is the «MS Office», because vulnerabilities that are present in it, have a direct impact on the user"s personal documents. For detection of mutations we identified vulnerable software modules by using a database of vulnerabilities NVD and classifiers vulnerabilities CWE. But, because it is a reference to the classifiers are not always present in the database vulnerabilities, therefore we check of coverage which showed that the classifiers CWE and it present in the database for more than 80 % of the vulnerabilities since 2009. Based on the classification of the base NVD we construct vulnerability map and vectors of attack: "Up" – exploitation old vulnerability for new software version; "Along" – exploitation for adjoining module which extends to related products; "Down" – exploitation vulnerability for new version of the software on the old one. This attack vectors of the experimental results, which showed the consistency of the method to detect vulnerabilities in software with closed source.|
|Keywords||Vulnerability; software; vulnerability map; mutation.|
|References||1. Selvaraj K., Gutierrez N.F. The rise of PDF malware, Symantec Security Response, 2010.
2. Hueske F., Krettek A., Tzoumas K. Enabling operator reordering in data flow programs through static code analysis, arXiv preprint arXiv:1301.4200, 2013.
3. Mallouli W. et al. VDC-Based Dynamic Code Analysis: Application to C Programs, Journal of Internet Services and Information Security, 2011, Vol. 1, No. 2/3, pp. 4-20.
4. Tzermias Z. et al. Combining static and dynamic analysis for the detection of malicious documents, Proceedings of the Fourth European Workshop on System Security. ACM, 2011, pp. 4.
5. MITRE Corporation, Common Weakness Enumeration, 2014. Available at:
6. SecurityLab, Microsoft ne budet ispravlyat' uyazvimost' v Internet Explorer 8
semimesyachnoy davnosti, 2014 [SecurityLab, Microsoft will not fix the vulnerability in Internet Explorer 8 seven-month-old]. Available at: http://www.securitylab.ru/news/453198.php.
7. MITRE Corporation, Common Weakness Enumeration. Available at: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2389.
8. Microsoft, KB-917150, 2014. Available at: http://support.microsoft.com/kb/917150/ru, свободный.
9. MITRE Corporation, Common Weakness Enumeration. Available at: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3431.
10. Arora A. et al. An empirical analysis of software vendors' patch release behavior: impact of vulnerability disclosure, Information Systems Research, 2010, Vol. 21, No. 1, pp. 115-132.