A classification of malicious software attacks

This paper presents a classification of attacks by malicious software. Unlike previous schemes, it focuses on application software instead of operating systems. We classify attacks pertaining to input, processing, and output of an application. Our scheme can be used to adapt testing strategies and is intended as a step towards developing a security metric for assessing robustness of programs.