Provides a mathematical foundation for predicting 'residual vulnerability' density using adoption-based logistic models.
A quantitative study of major operating systems found that vulnerability densities fall within predictable ranges, analogous to general software defect densities (which typically range from 1 to 5 per 1,000 lines of code). Analysis of Windows 95 and 98 showed known vulnerability densities of 0.0033 and 0.0047 per KLOC respectively, while the server-centric Windows NT 4.0 showed a significantly higher density of 0.0113. The ratio of vulnerabilities to total defects (VKD/DKD) was found to be approximately 1% for commercial systems and up to 5.6% for open-source systems like Red Hat Linux. The research proposes a logistic 'Discovery Model' (dy/dt = Ay(B-y)) to predict the number of residual vulnerabilities based on current discovery rates, finding that vulnerability discovery typically follows an S-shaped curve driven by product adoption and eventual saturation.
The study identifies that the discovery rate of vulnerabilities is influenced by the size of the installed base, with more installations leading to faster discovery.
exposure to a surge of newly discovered vulnerabilities as a project gains popularity
monitoring discovery velocity is a key leading indicator of a project's future security debt, especially during its peak adoption phase.
vulnerability density is the number of vulnerabilities in the unit size of a code... the residual vulnerability density... contributes to the risk of potential exploitation.
Risk Guard reports known vulnerabilities but does not estimate the 'Projected Residual Vulnerabilities'—those likely to exist but not yet discovered.
Risk Guard would be better if it provided a 'Residual Risk Forecast' that estimated the number of undiscovered flaws based on the project's current discovery velocity.