A Quantitative Assessment Approach to COTS Component Security

Algorithm 1

QACS (quantitative assessment of component security) algorithm.

Input: Interface information XML file; Fault injection operator; Prediction rules PRED;

Probability matrix 𝑃; MC’s threshold and IC’s threshold value 𝛿 and 𝜃.

Output: The security level of the whole component

01 {

02  Read XML file;

03  MC = 0, IC = 0, 𝑖 = 0, cnt = 0; // cnt is the number of component vulnerability methods

04  While IC < 𝛿 do  // For each interface 𝑖 in 𝐼

05  {

06   𝑖=𝑖+1, 𝑗=0;

07  While MC < θ do  // For each method 𝑚 in 𝑀_𝑖

08  {

09   𝑗=𝑗+1; // 𝑗 is the number of the testing methods

10  Generate method parameter values set according to fault injection operators;

11  Call testing cases generating algorithm TGSM(); //call the generation algorithm of the

   minimum 𝐾 factors combined cover test case based on solution matrix

12  Running 𝐶 and 𝑀_𝑖𝑗;

13  If (the output after running 𝐶 and 𝑀_𝑖𝑗 satisfies PRED)

14   {

15      increment cnt;

16      Vul_𝑖𝑗=VC_𝑖𝑗 × 𝑃_𝑖𝑗;// the vulnerability level of the method 𝑗 in the interface 𝑖

17   }

18  MC = 𝑗/𝑆;

19  }

20  IC = 𝑖/𝑁;

21  }

22   Vul_𝑐=1−∏^cnt_𝑖=1(1−𝑃_𝑖×VC_𝑖);

23 (Output) 1−Vul_𝑐;

24 }