Abstract
Software security is a crucial issue in software implementation processes. There is a general agreement in literature that software vulnerability metrics are major measures within software product security assessments. A vulnerability discovery model (VDM) describes and predicts software vulnerability occurrence rates and tendencies. Proper VDMs could help to determine the estimated release date while mitigating risk in delivering software products to market. Software reliability growth models (SRGMs) applied to software vulnerability discovery processes exists. However, there have been an increased number of VDMs proposed with increased software security concerns. Among the various models, the Alhazmi-Malaiya logistic model (AML) within the inflection s-shaped model family and Weibull distribution model (WB) within the exponential family show high performance in vulnerability predictions. In this work, we provide an analysis of enhanced VDMs with a single change-point, based on WB and AML. We utilize the model by making the change-point selection adhere to the vulnerability explosion characteristic of the software security-related defects. Our research focuses on seven experimental models’ performance on fitness of vulnerability data in a vast range of software types. The vulnerability data in this work is collected from the National Vulnerability Database (NVD). With the vulnerability data, the capability for a model to fit is demonstrated via diversified fitness tests and criteria. Comparisons are drawn on the data results utilizing seven various models. Models with a change-point perform relatively well due to software vulnerability data curves having similar characteristics. The data curves with rapid jumps show the Weibull distribution model with single change-point (WBCP) and the Alhazmi-Malaiya logistic model with single change-point (AMLCP) better fitting models. Our results have positive implications for analyzing vulnerability distribution.