Measuring Impact Score on Confidentiality, Integrity, and Availability Using Code Metrics
| Title | Measuring Impact Score on Confidentiality, Integrity, and Availability Using Code Metrics |
| Publication Type | Conference Paper |
| Year of Publication | 2018 |
| Authors | Al-Far, A., Qusef, A., Almajali, S. |
| Conference Name | 2018 International Arab Conference on Information Technology (ACIT) |
| Date Published | Nov. 2018 |
| Publisher | IEEE |
| ISBN Number | 978-1-7281-0385-3 |
| Keywords | Availability Score, CIA Model, Code Characteristics, code metrics, Complexity theory, Confidentiality Score, Correlation, Couplings, CVSS, Integrity Score, Measurement, Metrics, metrics testing, national vulnerability database, Object oriented modeling, object-oriented methods, object-oriented PHP application, PHP security, pubcrawl, secure software, security, security metrics, security of data, Software, software metrics, software quality, software quality metrics, software security, software vulnerabilities, source code (software), vulnerable source code |
| Abstract | Confidentiality, Integrity, and Availability are principal keys to build any secure software. Considering the security principles during the different software development phases would reduce software vulnerabilities. This paper measures the impact of the different software quality metrics on Confidentiality, Integrity, or Availability for any given object-oriented PHP application, which has a list of reported vulnerabilities. The National Vulnerability Database was used to provide the impact score on confidentiality, integrity, and availability for the reported vulnerabilities on the selected applications. This paper includes a study for these scores and its correlation with 25 code metrics for the given vulnerable source code. The achieved results were able to correlate 23.7% of the variability in `Integrity' to four metrics: Vocabulary Used in Code, Card and Agresti, Intelligent Content, and Efferent Coupling metrics. The Length (Halstead metric) could alone predict about 24.2 % of the observed variability in ` Availability'. The results indicate no significant correlation of `Confidentiality' with the tested code metrics. |
| URL | https://ieeexplore.ieee.org/document/8672678 |
| DOI | 10.1109/ACIT.2018.8672678 |
| Citation Key | al-far_measuring_2018 |
- object-oriented methods
- vulnerable source code
- source code (software)
- software vulnerabilities
- software security
- software quality metrics
- software quality
- software metrics
- Software
- security of data
- Security Metrics
- security
- secure software
- pubcrawl
- PHP security
- object-oriented PHP application
- Availability Score
- Object oriented modeling
- national vulnerability database
- metrics testing
- Metrics
- Measurement
- Integrity Score
- CVSS
- Couplings
- Correlation
- Confidentiality Score
- Complexity theory
- code metrics
- Code Characteristics
- CIA Model