Evaluating Security of Software Through Vulnerability Metrics

Research output: Chapter in Book/Report/Conference proceedingPaper in conference proceeding


Understanding and measuring security of software
in terms of vulnerability metrics is important when reviewing
and deciding between softwares. The large number of disclosed
vulnerabilities will continue to expose software intensive
systems and products to attacks, and the choice of third
party software will affect stability and reliability of products
incorporating this software. We collect CVE data from NVD
and version release data from GitHub in order to study how
vulnerabilities, exploits and patches affect the exposure of
software. By combining all data for each software we propose
a software vulnerability exposure score that can be used
when evaluating security. We perform a large-scale study of
more than 37000 software and also analyze common web
servers and cryptographic libraries in more detail. We show
that the proposed score is both diverse and close to normally
distributed, making it attractive as a review and comparison tool.


Research areas and keywords

Subject classification (UKÄ) – MANDATORY

  • Computer Systems


  • Security exposure, exploit, vulnerability life-cycle, patch, NVD
Original languageEnglish
Title of host publicationProceedings of the 2018 International Conference on Security & Management
Number of pages85
ISBN (Electronic)1-60132-488-X
Publication statusPublished - 2018
Publication categoryResearch
Event International Conference on Security and Management (SAM'18) - Las Vegas, United States
Duration: 2018 Jul 302018 Aug 2


Conference International Conference on Security and Management (SAM'18)
CountryUnited States
CityLas Vegas

Related projects

View all (1)