Effort and coverage dependent vulnerability discovery modeling

In this paper, our primary focus is to propose a generalized mathematical model that can discover potential vulnerabilities on the basis of two key factors: operational effort rate and operational coverage rate. Here, the term operational effort rate refers to the proportion of manpower required to discover vulnerabilities. The operational coverage rate refers to the proportion of software covered by the effort in discovering vulnerabilities. It is assumed that the proposed model follows the Non-Homogeneous Poisson process properties thus different distribution are used to formulate multiple cases. To evaluate the operational effort function, exponential and Weibull distribution are used considering coverage rate either to be a constant or logistic. For model validation, a case study of real commercial software data set has been used.