基于本体的软件安全漏洞模式

Software security vulnerability patterns based on ontology

针对软件缺陷与软件安全漏洞研究中存在的概念混淆问题,对DevSecOps框架下的软件安全漏洞生存期进行研究。基于软件安全漏洞生存期引入漏洞的4种情况,结合漏洞的特点提出软件安全漏洞模式定义,并采用本体方法进行表示。本体是概念化明确的规范说明,能够解决软件安全漏洞研究领域存在的二义性、不一致性、难以共享,以及由分析知识分散所导致的对人员知识和经验过度依赖的问题。以软件安全漏洞模式的分析为基础,兼顾宏观事件表现,构造漏洞分析的3层模型,即事件表示层、行为动作层和漏洞技术层。实例应用所构模型的层次结构实施渗透测试,包括安全风险分析、威胁建模、漏洞分析及渗透攻击等。实验结果表明:基于所提软件安全漏洞模式本体库的改进渗透测试具有科学性和有效性。

This paper studies the lifetime of software security vulnerabilities under the DevSecOps framework aiming at the conceptual confusion problem of research on software errors and software security vulnerabilities.This work provides a definition of software security vulnerability pattern together with vulnerability characteristics,and uses ontology to represent it.It is based on four scenarios of introducing vulnerabilities in the life cycle of software security vulnerabilities.An ontology is an explicit specification of a conceptualization,which can solve the problems of ambiguity,inconsistency,difficulty in sharing,and excessive dependence on personnel knowledge and experience caused by the dispersion of analysis knowledge in the field of software security vulnerability research.A three-layer model for vulnerability analysis is built,comprising the event representation layer,behavior action layer,and vulnerability technology layer,based on the study of software security vulnerability patterns and accounting for the macro event performance.The example application implements penetration testing according to the hierarchical structure of the bulit model,including security risk analysis,threat modeling,vulnerability analysis,and penetration attacks.The experimental results show that the improved penetration testing method based on the software security vulnerability pattern ontology library proposed in this paper is scientific and effective.