软件行为的一种静态可信度量模型

A Static Measurement Model for Trustworthiness of Software’s Behaviors

摘要:

根据用户必需的软件中可能隐藏的缺陷或者破坏行为在整个软件中所占比例极低、而当前一般的恶意代码分析技术不适合此类软件的可信度量分析这种情况,提出了理想化的主体行为静态可信的强约束条件,然后结合软件业务流程的确定性、软件代码的可见性以及信息资产风险可评估性,提出了适合工程应用的主体行为静态可信的弱约束条件,并基于主体行为静态可信的弱约束条件构建了模型的实现框架,对用户必需的软件是否将如实地按照用户需求运行进行可信度量,提前确定软件中是否含有对信息系统或信息资产的潜在威胁,以便采取必要的防护措施。

Abstract:

Some bugs or even harmful behaviors may be in the software which is necessary to the user. Because of exceedingly low proportion of the bugs and the harmful behaviors to the whole software, the present technology of malware analysis is not fit for the trustworthiness measuring of such software. So, in this paper, a static measuring model for trustworthiness of software behaviors was presented, of which the strong constraint condition of the static trustworthiness of software behaviors in the model is brought forward firstly as the idealized direction. Then the weak condition of the static trustworthiness of software behaviors in the model was put forward for engineering-oriented application. Based on the weak condition, a frame to realize the model function was also given to measure trustworthiness whether the necessary software would fulfill the requirements of the user faithfully and ascertain the bugs or even harmful behaviors in advance, which would be in favor of the safeguard ahead of schedule.