Measurement Framework for Software Privilege Protection Based on User Interaction Analysis

Authors:
Michael Yanguo Liu;Issa Traore
Affiliations:
University of Victoria;University of Victoria
Venue:
METRICS '05 Proceedings of the 11th IEEE International Software Metrics Symposium
Year:
2005

Citing 0
Cited 2

Complexity Measures for Secure Service-Oriented Software Architectures

PROMISE '07 Proceedings of the Third International Workshop on Predictor Models in Software Engineering
Quantitative risk-based security prediction for component-based systems with explicitly modeled attack profiles

Journal of Systems and Software

Quantified Score

Hi-index	0.01

Visualization

Abstract

Software security is a complex notion that has to be analyzed from several perspectives. One such perspective is the restriction and protection of software privileges. In other words, a secure software system should be able to prevent misuse of the privileges granted. Privileges are usually protected in software systems by integrating or implementing appropriate security modules or mechanisms. Knowing how system privileges are protected by security mechanisms helps software developers in reducing the security risks underlying software systems. In this paper, we propose a measurement framework to evaluate quantitatively the privilege protections of a software system at the design level. Our analysis is based on modelling and analyzing user interactions based on the so-called User System Interaction Effect (USIE) Model. Specifically we define some measurement abstractions and associated metrics for assessing software privilege protection. We evaluate our framework by conducting an empirical study based on a medical record keeping software system.