当前位置:
X-MOL 学术
›
IEEE Trans. Reliab.
›
论文详情
Our official English website, www.x-mol.net, welcomes your feedback! (Note: you will need to create a separate account there.)
From Analyzing Operating System Vulnerabilities to Designing Multiversion Intrusion-Tolerant Architectures
IEEE Transactions on Reliability ( IF 5.9 ) Pub Date : 2020-03-01 , DOI: 10.1109/tr.2019.2897248 Anatoliy Gorbenko , Alexander Romanovsky , Olga Tarasyuk , Oleksandr Biloborodov
IEEE Transactions on Reliability ( IF 5.9 ) Pub Date : 2020-03-01 , DOI: 10.1109/tr.2019.2897248 Anatoliy Gorbenko , Alexander Romanovsky , Olga Tarasyuk , Oleksandr Biloborodov
This paper analyzes security problems of modern computer systems caused by vulnerabilities in their operating systems (OSs). Our scrutiny of widely used enterprise OSs focuses on their vulnerabilities by examining the statistical data available on how vulnerabilities in these systems are disclosed and eliminated, and by assessing their criticality. This is done by using statistics from both the National Vulnerabilities Database and the Common Vulnerabilities and Exposures System. The specific technical areas the paper covers are the quantitative assessment of forever-day vulnerabilities, estimation of days-of-grey-risk, the analysis of the vulnerabilities severity and their distributions by attack vector and impact on security properties. In addition, the study aims to explore those vulnerabilities that have been found across a diverse range of OSs. This leads us to analyzing how different intrusion-tolerant architectures deploying the OS diversity impact availability, integrity, and confidentiality.
中文翻译:
从分析操作系统漏洞到设计多版本入侵容忍架构
本文分析了现代计算机系统由于其操作系统 (OS) 中的漏洞而导致的安全问题。我们对广泛使用的企业操作系统的审查通过检查有关如何披露和消除这些系统中的漏洞的可用统计数据以及评估它们的严重性,重点关注它们的漏洞。这是通过使用来自国家漏洞数据库和通用漏洞和暴露系统的统计数据来完成的。论文涵盖的具体技术领域是永久漏洞的定量评估、灰色风险的估计、漏洞严重性的分析及其按攻击向量的分布以及对安全属性的影响。此外,该研究旨在探索在各种操作系统中发现的漏洞。这引导我们分析部署操作系统多样性的不同入侵容忍架构如何影响可用性、完整性和机密性。
更新日期:2020-03-01
中文翻译:
从分析操作系统漏洞到设计多版本入侵容忍架构
本文分析了现代计算机系统由于其操作系统 (OS) 中的漏洞而导致的安全问题。我们对广泛使用的企业操作系统的审查通过检查有关如何披露和消除这些系统中的漏洞的可用统计数据以及评估它们的严重性,重点关注它们的漏洞。这是通过使用来自国家漏洞数据库和通用漏洞和暴露系统的统计数据来完成的。论文涵盖的具体技术领域是永久漏洞的定量评估、灰色风险的估计、漏洞严重性的分析及其按攻击向量的分布以及对安全属性的影响。此外,该研究旨在探索在各种操作系统中发现的漏洞。这引导我们分析部署操作系统多样性的不同入侵容忍架构如何影响可用性、完整性和机密性。