Enhancing Trust –A Unified Meta-Model for Software Security Vulnerability Analysis

摘要: Over the last decade, a globalization of software industry has taken place which facilitated sharing and reuse code across existing project boundaries. At same time, such global also introduces new challenges to Software Engineering community, with not only implementation being shared systems but any vulnerabilities it is exposed as well. Hence, found in APIs no longer affect individual projects instead might spread even ecosystem borders. Tracing on scale becomes an inherently difficult task, many resources required for analysis growing at unprecedented rates heterogeneous resources. developers are struggling identify locate data take full advantage these The Semantic Web its supporting technology stack have been widely promoted model, integrate, support interoperability among sources. This dissertation four major contributions address challenges: (1) It provides literature review use databases (SVDBs) community. (2) Based findings from this review, we present SEVONT, based modeling approach formal semi-automated unifying vulnerability information SEVONT multi-layer knowledge model unified representation, captures different abstract levels allow seamless integration, analysis, modeled knowledge. takes Formal Concept Analysis (FCA) guide engineers identifying reusable concepts them. (3) A Security Vulnerability Framework (SV-AF) introduced, instantiation evidence-based detection. framework integrates ontologies (and data) allowing reasoning services trace assess impact security boundaries. Several case studies presented illustrate applicability flexibility our modelling approach, demonstrating that cannot unify sources enables types analysis.