Security Evaluation for Software System with Vulnerability Life Cycle and User Profiles

This paper proposes the definition of a security criterion and security assessment based on the criterion. More precisely, we present a stochastic model with a vulnerability life-cycle model and a user profile using continuous-time Markov chains. The composite model can be represented by a Markov arrival process under some assumptions. Using the vulnerability data for existing applications, we perform the security assessment numerically.