设计类脆弱性研究

对目前的软件脆弱性分类方法进行了分析,针对Unix/Linux操作系统,提出了基于软件脆弱性所在部件和引入原因的二维度的脆弱性分类法,并简要说明了对引入原因的进一步分类的方法。设计类脆弱性是一类重要的软件脆弱性,但在已知的各种脆弱性分类中对设计脆弱性的分类几乎是空白。本文重点对其中的设计类脆弱性进行了研究,提出了将设计类脆弱性的划分方法,分成限制脆弱性、需求无法实现脆弱性、安全设计脆弱性、异常处理脆弱性、功能局限脆弱性和随机结果脆弱性等几类,并给出了每一类设计脆弱性的定义和典型的实例。

Research on Design Vulnerabilities Class

This paper analyzes the existing taxonomies of software vulnerability. For Unix/Linux operation systerm, this paper proposes two-dimensional taxonomy of software vulnerability based on location and cause attributes,and describes the classification scheme of software vulnerabilities according to their cause. Design vulnerabilities class is an important class of vulnerabilites, but no existing classification identifies the types of design vulnerabilities in further detail yet. This paper elaborates on the aspect of research on design vulnerabilities and proposes the classification schema which divides design vulnerabilities into following subclasses: limit vulnerabilities, unsatisfied requirement vul- nerabilities, security design vulnerabilities, exception handling vulnerabilities, restricted function vulnerabilities and random result vulnerabilities. This paper gives the definition and typical examples of every subclass.