CERIAS Tech Report 2005-06 VULNERABILITY LIKELIHOOD: A PROBABILISTIC APPROACH TO SOFTWARE ASSURANCE by Rajeev Gopalakrishna, Eugene H. Spafford, and Jan Vitek Center for Education and Research in Information Assurance and Security, Purdue University, West Lafayette, IN 47907-2086
Vulnerability Likelihood: A Probabilistic Approach to Software Assurance Rajeev Gopalakrishna, Eugene H. Spafford, and Jan Vitek Department of Computer Sciences, Purdue University 250 N. University Street, West Lafayette, IN 47907-2066 Email: !#"%$'&)(+*-,& .+/0214365)798;:=<9> ?;0@79ACBD79A:=EF<98D02BD0;?HGH8I1J: KL14BMGH>N0>1O<PHQO02RS1JTU0D> V: /0W14365'<?9:)79A B79AX:=EF<98079>Y7GH8ZQ41JTU0BU[)\]BIB9GH8D<9>? 0^<P7G:_:V/0B0 ?HGH8 1J: K 5 87;5`0D8U:V1O0B_79A'<^B79AX:=EF<980<98;:a14Aa<?9:bBI/7GHQONcGHQJ:a143Y<:J0DQ KY:a8D<9>B QO<:J0_14> :J7-< d GS<9>:a1J:J<:V1JTU0-3Y0 <9BUGH8079AZTGHQ4>0D8<P914Q41J:a1O0DB9[+eJ>f:V/14B5'<;5`0D8 gbEF058D0DB0D> : :V/0h1ON0
0D8D<PH14Q41J: KkQ414l0DQ414/77Nk<9Bh ?;0H[po<914>14>Rq<9BIB9GH8D<9>? 0%0 <98 Q Kq14>r:V/0YBD79A:=E+<980 N0HTU0DQO7;53Y0D>:? K ?DQO0^14BW79A`143s3Y0D>BD0-T<9Q=GS014>%N148D0 ?H:V14>R6AIG:IGH8D0t0Dub798;:aBU[ v 7nE+0xw8IBU:_N14B?HGHBIB6TGHQ4>0D8<PH14Q41J: KhQ414l0DQ414/77Nh14>q:V/0y? 79> :J0 z':^79AWTG9Q|{ > 08D<PH14Q41J: Kj58D0 N1O?9:a1O79>c14>cB79AX:=EF<980<98U:V14Aa<?H:VB9[^}c0W58D7;5`79B0Aa7GH8]: K5`0DB 79A+587URS8D<93~58D7;5)0D8;:a1O0DB:V/<:? <9>P0y7PHB0D8UTU0 Nn14>nBD79A:=EF<98D0<98;:a14Aa<?9:aB :J765)7:J0D> :V1O<9Q4Q KqN09:J08I3s14>0j:a/0D148jTGHQ4>0D8<P914Q41J: KfQ414l0DQ414/77N'[j.+/0D>EF0 N14B?HGHB BiTGHQ4>0D8D<PH14Q41J: KQ414l0DQ414/77N14>:a/0q?;79>:J0Dz :n79AhTG9Q4>0D8<PH14Q41J: K N0H:J0 ?9:a1O79>`[}Y0n587;5`79BD0
1 d GS0p:J7 d GS<9>:V14A|K:V/0<9B BUGH8<9>? 0 14>:a/0cB79Q=G:V1O79>Bj79At?I/ 0;?l08IBsAJ798cTGHQ4>0D8<PH14Q41J: KN09:J0;?9:V1O79>:V/<:6GHB0 B;:=<:V1O?r<9> <9Q KBI14B9[\]>Nw><9Q4Q KgEF0p14Q4Q=G9BU:V8<:J0:V/0p14365)798;:=<9> ?;0p79A TGHQ4>0D8D<PH14Q41J: KiQ414l0DQ414/77N14> :^3Y09:a/ 7N79QO7URHK :J763Y0 <9B9GH8D<PHQ Kc14>?D8D0;<9BD0]B79AX:=EF<980-<9BIB9GH8D<9>? 0H[
1. INTRODUCTION t'q HH nD;S qV t HH|'mH h|nm qS
bH|Hb9U '9 9a i 'b9O'aI- pS 4=U H t' '¡ ¢ H9 |4 £¤||¥|¦§b HHO |¦|¨bbHH9';¡'| x4 kV -S ©ZH)HHO|4£pxbHp4ª s|m`U6bf||ah| 9mH` bc`kH |b'4£|'9 |''
« ;b9f¡) aI- c )9 |H-'bOf¡)6`; H
¡ £m¡ ¢ H9 |smS¬ HYxV t
|¡b HH6'mb;S O¡'' n bY|% |mmH'jHbH9
|a t cHH 4 £ ®b¯f°W±±6²|³6´%µ¶·S¸Z¹]Ob
' ;mm|bhO|H6'f 9 ||I£ ©+V -S mb|b9;¡b||4 O9jxO|W9º |Dc«¥V -S mb4¬ '9;¡'|O4I£q|y
O'D;'Hsq9 | bj)H9|»b |Z©) 9¬ H|bm9©yH »` ; |qa t s'U `x4 x9º HH ¬ |¨§|O m bfH9' 4 £r)||9£ ¼ ½½S¾Xr«y%'UF©W £D¬ ;'Hh¡) 6 bcH9' 4 £ )9 |H]maI-S n 4J9 ''V§b4 |f 9|£;'VS i| k¿ ` 4;S OqHmH j bq '|b9;¡b||| |Hf|À bS |J9Á b||q bS f aI- 6HbO'H9 |b ©V -S j¿ `||I£ ©bnV -S 6 H|O¡'O4¬
4 £cbS^¡)H9%D b'|s9º Hb|9|£cSU_ bOD ' 9t'9 HH© bU£s mD 4£6H'H9 bHsx4 Y |bx bWb ¡b|||I£s'V¬ -S sbb'9x' f+H` | |bH^«H9V H ;)=|O Hx Hb4 |b a Â9HO'H ;Jb4 cS % b9|c'¡ ¢ H9stHbHU r`pb f||H|';;à H'| |'6a #b|b9;¡b||4 £Y9º b|4 HÄV¬ -S -HH |I£hb j x4 n¡) hH9V H ;b`Yf||H|' =|O Hj H'| |'V ÅJb4 j| ''HH4 bUcH9V H ;|4£ H|O¡)U; H4£¼ ½ÆS¾X^ÇIx|- b|y'4È+9 H O |b%=U y| H ¬ |q bxfÃH-V t YHH' 4I£q%Ub||HbO'n;Ã) É] H'#9XO¼4ʽS¾) 9»`']V t y¿ `|4 £c|c 9 m_` b^b| ¬ | HHsaI- ¨;`S;9 U OD |Hn);¡b||4 £ © H|V¡b||4 £ ©s9V¬ »`9O9b9£ ©^bf¨9b|'H9 |b ©] HD;¡b|||I£ ©]'` 9 D;bb¡'|O4I£ © b m'4»)¡b||4 £ ¤t' H 9p ¨x'O; baI- ` b9jUb;9 9 |D |Hj 9 9 m|bH^ bs¿ `||I£_ '6V t Ä aI- i 9OO¡b|||I£ ©x;`S;9 U OD |p6V -S k¿b|4 £ ©^| by' ¡`¡b|||I£m `StV t jx||F S O yJ||' 9¬Xa 9j)9;S¬ |p|pn»bº qH4 'mH yajm»'º q)9 |W |mytb 9 %` bY='4 Y|'|b
J||' HY|k 'Os9 9ºc 9HO'H ;Z|q`S ' c`
'xfO|H|bH ËjH||¡)9;S f Hm j i'n=O| ¡ £ |9 |b=b4 c| x`S-V t sHH 4 £m|tHbHU bmx4 q`f`^ % H9 |bDpÁ'|Of|m' S|bq '¿b|4 £yV t q9bO| 9b9;_ ''HY 'c 'h¡)9y^Jb4 ¡)H'h]|_ bYH ¬ |¡b O'
;`S;9 U OD |HH©4cmO jbsH||m|` %='4 j ` `Yf|S#O|Ã9O|' k]¡)H|'f |9 k9HO'H ;|4£ jÌ-¬ HU© b;m='4 ]HbOm¡)9º 'O4 n¡ £nm9b'9O|¡)9;S H4£ | Ã|b¨J
Í`Hx
| baI- b b9 UJ p'bO ¡) O k9H' kÎJs mp|H§)||9£bÏc 'aI-
a f||H|'%9H HfÐ6b9 'H|HH©qf¢D 4I£r- bn ¡b|Hm |¨V -S qH9' 4 £k bH£H¨¡) |¡b Hmm'|£ H)S fmOD;ÃH |`'|S x_) y¿ b|4 £ Wt'9 9J © |m' S|bhaI- %¿ `O4I£q|nfbbUxb;q `Sy 'sHn¬ m¨m|D;ÃHnS qO'tbO¨ S 4£§Om SfaI-S HH 4 £ Ñ
9f=¼ Ò½¾'9»bb³;¯ÓÔ ÕW·S±UÖ¶
ÖSÔX±²V×U³mh bqm9 |H `SY m'k i;`S;9 U OØ9n bnH9 O^JH ' 9Y-V¬ -S m¿ ` 4;S OH4£ ©+ bsHO|»b |Z©_9m`S |Z©Z` f 'Hf |``4£ |]f¡)b'O|+^Ä a t ym9 |H ¡)WHO4»`HY| -' H9_m9 |HZ`j ''9mU O9HZÁ'|O ' 9Hxm9 |Hx¿ ` 4a£S |¡b' 9-_ 's'HH|bm9]' ¬ HHc`k] 'n HH|'mH jH4 'mH ©+' ''9sm9 |H ¿ ` 4V£k |¡b Hst 'nV t f 4J9%4 H4 ÄaI-S m9 |Hjbn¡)HHk' )pJcaI-S
¿ b|4 £p|HbU; bqV t cHm'|9º |I£bqV -S s H|V¡b||4 £i|ib |H ¬ O
t'iÙÚÚÊ
] Ãb§O J f |§HH 4 £D£ D H; |' `;'Ã |'k¼ Ò¾] |Hbk'4È+9 9s)H9 6t9H' 4 £im9¬ |HHÜÛIÁbqb'O]rHb q` xb ¨ bk 'h¡)9 mH)ÝHÞ6W)9;|'O' aI-S y9H' 4 £cmU O9_-Wbt 'sUb||Hbc' ¡'|Hmy'|HbHq¡ £
9H' 4 £
9º )9 yx ' ÙÚÚ½ißÁ ¬ àÄ á¦Äbmm9Ç 'D 4 ' q¼ â¾mtbm HH|'mH j mHb|'J'bH9' 4 £%m9 |HW-;b9f^j;bnUb||Hb Sf b Ñ á« Ñ J9 9bHpãÛä;báyH ; Ñ b||HbHÞ 9b9H' |H4£qOkÙÚÚÙ¼ ƾWbÙÚÚ½¼ å¾Xytb|y9º Hmb|4»`H- ' |mm O WbHHsamHb|'J'm' HF'V -S tHH 4 £ )U HH|¡£9º )9 -|q '6»`9V+ ÇIh b|`)9©]y| ''Ht b-9b9H'^æ µç|¸)Ö;±;·'è²Oç|²=Ô|émç|²|ê ÖUë ç|²|ì)¯ ¯íc+6aI- xS 4=U©xb|;%tx 9»`'t^y' ¡`¡'|O|D¬ |Hm9]Fb|bU;¡b||4 |Ht|m bxV -S jS |J9WÁr a Hbc ]'|mH'|b6t 'nO'x¿ ` |V£ O'qb|'9¬ ¡b||4 £p||ÃH||b Fhî_4 D©Z]n O9b6 'hO'ft¿ ` 4a£ |b 'jb|bU;¡b||4 £||ÃH||b i_aI-S %S 4=U Htt'Oy | x4 ¨ '|9 |bi 'mbh¡)UY`O H |§yb|'9;¡'O|4 |H |q%V t c 4J9-'4È+9 H -'`9-_4ª y'HH|bm9 |4JU¬IU£'9OÁr-' )-J' £ )HW+ ;ï )9 |HW `S H¨) 9 OO4£¨¡)m'|§iV -S qb|'9;¡'O|4 £' H'|9¬ |Àm H-b¨'|H'h bUb||HbHm|§b|b b9iÁr 9bO 9] 'O]^sb9`;'|¦|n bxH Uº ^F '|9 | ¡)9'Y H|bxt ÃqbyH'HH ;
' H'|9 |bna¬ t Y='4 H©FJ||' HH©Z`| '|b¡b 6' '|b9;¡b||| |HH ðb|'9;¡'O|4 |H_bS^¡)H9Y|HD | c' |f |4£jV ~ '] 9¬ 99 |m|9x)| ^Ä H9`+©]y )6 9U'bO¿ b-¡`n ¡b¡b|||D |sD; |j`4£ |tJy¿b 4a£ |bs bç|²OêÖ;ç|²Oì`¯ ¯í
¯SÓ ·
æ µçO¸)Ö;±;·'è²|çO²=Ô4ék6 9 H9
¡£
hD;S |%H9' 4 £
U'H;Ã9^«4¬ '' 'bYD;S Ok`4£ | § 9 H9b|'9;¡'O|4 |H |Yb%'9s©_ 'nH'HH %y¿ ` 4a£ |b bfb' º |f |' |pD; |h`4£'|6 fHD |fS Y 'Y||ÃH||b p bY 9 H9 'O'9;¡'|O4 |Hn|hib9ã`;'| `S%]
¡)9O|Hfx||-|¬ '4»` 4£¨|mb9Y bb9ab|b9nD; |q9H' 4 £U'HUÃ9 ¡ £%;bÃ|bYb|bU;¡b||4 |Ht¡ £h 'H4nÛIJ|j)| |9bHH Þn«y` »b`O4£ ©Ftm H9 |¡)h '% |m-b|b9;¡b||4 £p||ÃH||b r| aI- % ;'Hsm9 b |£
2.
VULNERABILITY LIKELIHOOD OF A SOFTWARE ARTIFACT «yU Y|%m|D;Ã%f'%¡ £ki'HH|)9hÇIcm| s¡)h
I£ );b'OHW9 ©
m|D '|bt
)H9|»b |Z©
m|D¬ '` 9 D;b'|by`xbyb¡' ' |b]' HH©bYq¼ Ùñ¾X« U sm| |i f'%sm s=b4 Hsîbb4 %ÎX|
Ã'Sx '9aH9 ;Ïn qO H O b 9ºm bi ;iàq HH|H4£ ©'j='4-|] b'4È+9 H'Hy¡)9 ]HHm by|bH H9- ¬ ;Â` b%H HUc9 |¼ Ùñ¾Xntbn9º H9' |k^='4 £ 9'xfH£%|h jØH9 s]m t=O| HH© xb9 y6J||' x| ' Î=' ¬I9m' £bÏ-'4È+9 9bHY¡)9 ]HH bc H'| bY|bH H9 `q9 H9y ;¼ Ùñ¾X
«D `£Y 9OHh¡ £s 'tß% ÄYË6H`S mH Ñ mm9 Hª Ð6¬ |`ÇIbD 4 ' )Ä;bbS;'`cH;b'|£fÎ=Ð6ÇÄ xÏF|hÙÚÚÙ 9D OfS m `taI-S c'9aH9 tHDxß% ÄmHH'Y£òÆñ Æ%¡b|4¬ || bb|4£~¼ óS¾tbD `£|rabb bmS9fb4s '%'9aH9 sS %'yJb`i ||_O %Oi 'h HH|bmH y9£¬ 9Oc`m `S-m y `qY '|;fZ bj9D -HbO
bS6¡)HH 9O|m|`S ¨4 'q 9JHU n¡)HH§O'H 4»`H` HmSH¬ ||96Oi 's9£ H|ytbU 9J ©+4]bOi¡)s'9J'_|pn 'h¡)9 t-H£ 6
' OUj b% 'h¡)9jbk| S Ot'9aH9 s| aI- 4J9qq'4È+9 H f'`9| 4ª O4a9¬9£ H|¥îb Uºbmb|©) '|9 |'n bcbh¡)Ux^'9aH9 Op 4È+9 H 6a¬
-S sm''O9-
bH|q | 4 |ØHs HD |bhUÈ+ - % 'jm 'UJH9¬ bpm b|HH¤ô '|9 |'§ 'p 'h¡)9fc HO'` 'UJH9 6Î=)D¬X H|j'9aH9 ;Ï^|YaI- 6' ''9tHbH| bq bq¿b|4 £§6 bq'H||9 HÀ' b9m`'U 9 m|b b6f| H`bHjUÈ+ «@aI- pb|'9;¡'O|4 £|ÀO'D;'Hc9 O b )HH4»b |F©'9H|'mH ©H »` ; |h)a t xb; `Sm4 m9º HH OÀH |VS i b
HH' 4I£§)||9£õ¼ ½½¾XÇ '9xt;'H©)h'9aH9yxbc9º H9' |
i|OS c 'sHH ¬ 4 £Y)||9£hO6'O'9;¡'|O4I£ WÄ j|bb|'9;¡'O4 |H^ x 9JHU ¡b |''9aH9 -'Wb|bU;¡b|4 |HHW«y`YWmH |bHYS¬ ||9©) |U O'q] 9J99 j| |bm m=||' 9sO6H9V H ;| `S ' ¡b h |9 |br6'O'9;¡'|O4 |Hn|'|bp kHH' 4I£ |O |'x| '|b-fH£f¡)s H||¡)9; c`
f|O9ObH^« f||H|'s| '|rHZ©F|rHbU;=©_ qm %b Å b 9HO'H ;`J||' ^ÄmxF bx|9tfH£nOY¡)yO ;b|¡'O b;f b- H''; |mF¡) n 'yaI- 6'HH|)9^xb V t p` bq '|b9;¡b|||I£À`§ biaI- p'9mxb 9º )9 |H'H 'q| b|F«ymb;Z©t4n]'VÀ¡)i'|bU ' | |I£ra%¡) bf HH|)9n` 'fb9Y ¡)f¡'Om ' H'|9yb|b9;¡b||4 O9x bq'9aH9 H Ç j '|H9 |Z©St| ÃsS b] Ãj|j bS y aI-S t'U¬ J99W' |9 |ZÁ]O H |V£%m'9 ¡`H%% ¡b¡b|||D | b%'||D Oyb' ;% bW` bt) H V S9 Hm] b ;Hx¡b;à Yx 'm' H|'|£r' )m H|HiÁm¡)H||H `Sx b|xaI-S h 9JHU '|9 |m'H+|f9 c 6¡b|J^6aI- xb|'9;¡'O|4 £Y '|9 |%m'H¡)HHb b|bU;¡b||4 |H6S c|f'UJH9 HWÁr6 bH
' )jJ'x £ )H y ;Ü )9 |HY `%¡)bHrx| '|§ 'ma;mU¬ t Ã
b;hm H) -; x' OU O'nb|bU;¡b||4 |HH
2.1 Software Defect Prediction tbU f mbm9 bjD b'|Hc|r b|cS i-aI- 9JHU
' H'|9 |FqÌ9 ntf¡' |9Í'£r'mf |ØHh 'f'4È+9 H Y 9JHU ' H'|9 |pm'9O6s |Hb|kîbH p`iÐH|-¼ ÙÆS¾` '99 |¡)j bs' ¡`¡b||OD |cm'9F )q¡ £f bHi Ê-ôW |9 |i'O' Ñ m'|9º |I£qàq9 |H àqD- 9J99t '|9 |m HH ;bJ H'fHD;¡ ¬ O |'O's'UJH9 WWyabbU Oh`Hmb|9º 4 £cm9 |Hx4 b £ ) b9Om b' ;mm|'rHmb|9º 4 £ÀÈ+HU bj| ''9 |`
)U OD 9bHsW'9aH9 H Ñ m'|9º¬ |I£m9 |H-q¡)jH'O'9
b` 9ta'yS H |Hj ' )q¡ £ Ñ s9yXy¼ Ò½S¾X¹ ÎXÏö ²|÷Ö¶
ÖSÔX±²V×U³ bkm b|ØH§faI-S b|bø`S;m9 U b;¦||bH¨q9'©m ÃH H' ©`6ab'9 |cH' _îbUºbmb|©«yà 4£f ¼4ÊÚ¾Hm'' H^ ba||xO'f¿ ` |
HO |'h b bh¡)U-W 9J99 Ë#`f bs||bHxH'YùW¹ úïû Ò'ü åóý¨Ú ü Ú ÊHåþ
ÎDÊSÏ
tb|x¿ `S O
'HD - `xOS 9xa t cm ¬ b|H`|t9 '9aH9'H'4 O9CÎX'UJH9 ;ÿS|ØHSÏU b9D b'|HW `¡b9 - '- m-b'HbmHb bVS 9m b|H_bS|by|t9^'UJH9 Hb4 |HWS¬ Hm' q9º 'V|r4c¡ £ £') bH|ØH|'
`SsO 9 m''O9mf£¡)'HH|)m qH 9ab|4£À b f||9~m'b|Hõ~ bøO U#m''|Hõf£
D ||s`r'm9 ' HO `Y 9JHU ¡)H'r f||9c HDcfHS9; Ñ m `pÁ4 '¬ ¼4ÊóS¾bHmb '^J|Ox|bs)4£''mO 9 HD¬ |iH¿b |Jj«b%m b|HH¹ úãûÚ ü ÚóñýÚü ÚÚ ÊÆóþý¨Ú ü ÚÚÚÚÚÚÒâþ
ÎÙÏ
«b¡`H~ø b|¿ `S |Z©s '9£õ' ) ' Ûä6O'|| UÃ)ª ôW |b9O'|© Þxb|;%'HD _ `S bU |t' |h'¥m''Ox|ØHy `^|]'H4 b9^ Y¡'| b- mf|+x| H)H9x m 9J99'H'|I£
Î=¡) Ï s· ÔI·Y³HÔX±µ ×SÔ µ±UÖ¶
ÖSÔX±²V×U³t bxm' j bjm' b;M|'b'¥ ©õ' H9 |Z©øbÜ b a MV t fb;rsS O¡b|mHb ©ZÌj|D Fª )U;`ÂHb Î ÏCbM ;¨ 9H' H'HH¥ )U;` 6Î ÏU© ||6 O¡'|HH©S O¡b|`'H© ='¬ |Z©'b
='¬
Î=Ï _ ¯ ²V×j³HÔX±µ ×Ô µ±UÖ6¶
ÖSÔX±²V×U³- `m' j bs9 Í` )H9 mjV t b;Àf'9H|OHb © àq Ñ ¡)ª kU£'9Of |Hmb|9º 4 £ ©jÄ ;b'HO'9x|` bÌ6È+fbFª %m|b|%bMb%¡)9Y`S b%` Ub¡b||4 £fm9 |HH© H' f_b9D O''©'bÃ' H
ÎX`Ï W ¯¶¯S³²=Ô ÖY¶
ÖSÔX±²V×U³j `SsHh¡b|'% ]q%m h b¡)^m9 |HZb;Y_Ì6|D +ª Wöb¯SÓIÔ Õ·±UÖöb×U²Oë Ö;¸`×Ö%m9 |HHpÌj|D ¨ 9 |Hc bmJO|x|bp 9¬ O |'b|r¡)U t9H 'hb%¡)9j-'UJH9 cËã` bqð^O'mim9 |ið ÎJx'|U | |
'9»bb |r 9 mY- ''h¡)9c'bO¿ bm)9;b'%` b'O¿'6)9; ;ÏU¹ ú¦û½ÚÚÚ
ÎX½Ï
¨9º 'V| b'HS Ok9 HO |ø¡)U t9Hm''O |ØHCÎ=|¤ 9 mki||b9
H'ù_Ïk`¤ 9JHU§'H ¬ 4 £
Î=ËcÿùÏU©áy9 ¡)U m¼ Ò Ê9¾)'HD b¡)Hb- bU h'D¡)-ybH |tH HO |m¡)U t9Hh|b9+ù
` ÊSÿù© b
H HOS O ¡)9ItHHÀ|ØHbÀ 9J99'H'4 £ h'Dt|%¡)ybH |xxbH'H9]'UJH9 t y x|bnS mD^||bS |£nOm|ØH]t'xbH |yH HOS Oq`h ' ä6O O| ;Ã)ª ' |'H|b|i;`||H'i b
JbbbmH ;-H'¬ HH m6V -S p'H9m)4 ||ÀaI- 9b|'H9¬ |b fôW ; 9mb|9º 4 £iOcHU;|b4£k'm] 'nH'¬ |¡b O'6=9 W s 9JHU ¡''W4W|^' 't'|£%b àq'9Os bc' H'|9s bh'9aH9 YcfJ'b9 |-b4£ ' ;Hm'OUº'4I£'Ybx9bO 9x b6Hb ZUÈ+H9 _' ;mm9 t`'9Ob9 H©'' ¡b|H m Hb4I£ © ` '9OÀ9mb|9º 4 £ rtb HO |'b|¡)U t9H'9aH9 bm' ;ïHm'OUº'4I£n|^ '9 9J 6'-cD;|a¬ -S;q' Ù xô '|9 |'|bm9D O'fàq9 |H tbj'9aH9 y'9 99 q ' |bc b HD |bh'`Hx
¡) bH6 y '|9F HO'b 9J99 'O'xD; |D |9º; ¬ OS OÀ H;b'O¿'HHrHDmHSU;©^x'O;§|mm9 | Hmb|9 H'HHH;'|bm fn HDH|H9 |p9 4 9 | b;sf¡';b;kcD; Hm9©+Hk¡)%'p
'U O bjHD WÈ+99 |Hb9-á6S OqÎXá6Ï]m9 |6Jh|H 9]+ HDtHHH^tbWá Jts9tF 9DtHt|^ ' ' ) | bsHSU;YU'O9F^t'c 9VS |b'| ¡)9ItHHk HDcHS9;mm9 |Hc`'9aH9Y'9b4 £pb |m¡)H9iD ` OH¼ ½óS¾
½ -ôW |9 |i¡bqô HH 6`|4 £ËsS; ôW H9]m9 |H^¿ ` 4a£Y byS O¡'' H) 'xaI-S 'H9ObmH f HHq|'H|`'|'¨' HH
¿ `O4I£ ¥tb 'mH ]| `^' 9H-¿ `O4I£n|ts f' H'|9 ] ' ''9^¿ `|4 £h|n 9 mW+ b- HO'b) 9J99t Hb4I£ tbsƬO9HZ Ä WÇ Ñ `¡b|||I£qài ' 4I£
àq'HÎ Ñ ààÏ]| 9º'mb|qYr' H9q¿ `||I£m9 |qxbk| Í`'¬ HbHqÀ 9V `6 9JHU'H'|I£§`¡)9HÀ9mb4 ||4£ bx¡ £rË6VØfb¨Ä ||§¼ ÙÊU¾p b9ca t
'HH4¬ bm9t' HHym9 ''||Hx|bH|` j b Ñ |' b U~¼ ÙÙS¾X © º Hmiô ;mm|bÀ¼|ÊÊ9¾X©x`ô_U¬ `VÿMÄV -S côW 9Hh¼ Ùâ ©+Ùå¾X îbH q`fÐ6H|W¼ ÙÆS¾ZbHD- by| ''ic|yZ HS U ¡)HH%Hb'bU Y|Y btS 6`V t y'9aH9W '|9 |F© ` b6' ¡'|Hã HfO'-O 9|£
b'|
b b|' |byb'¬ |DJ9 £ nß6'|S VS m'' ;bH6
' |9 |rm H||b c|mb|©'| b4 |©b`qb)H||b'©`¡b'x|bHH ; -àqb4 4¬ O hb U'HnÎJ `Sj'%m Y bp'% '|9 sS 4¬ ¡'|SÏcbm'È+9 Ha 'm' ¡b|HÂx9||O' 4I£xb9 ]§im p' OU
S V¡b|H
' p bp mpbb'9¬ 4£ O'¨=U ix'Hõhb4 | O H H|# H)Hb' b 'm' |]Ø99 fH HOS Or¡)9ItH9' OU j O¡b|HH tbU£ b `S
'p' ¡'|H Of|'|£ÀY'`'U D;` |b bh H' 9H O's b-Hmb|9ºn| 9¬X HO |bb|']|n bxV¬ -S t HH|'mH +' H9bj' )t-b|OD |]b Uj V t j 9J99] '|9 |m H||bs¡`nfj ¡b¡b|||D | H;b'V¿ 'jÃbxiÉ]£HOpÉ]H||9WÐ9 ] ÃH
2.1.1
A Model Based on Bayesian Belief Networks
« ÉtH£ HO@É]H||9¨Ð9 ] ÃÂÎXÉtÉ]ÐjÏÀ|ã 4 H9 ;b
`Sx H' H9 x ¡`¡b|||D Oc HO |bb|'jmbh 'j;b b HHtbyb HW H' H9]S O¡b|H]bh by H^ H' H9 bh' Y|'Í`'H O HO |'b|b%mb bh O¡b|HH ;%'']| HO Yx| %¸`¯íbÖ )±;¯ è·'è²|çO²=Ô4é
ÔI·'èçaÖyÎ=Ð6ô^xÏ `SsH;|bs b
ÎXÉtH£ HO`Ï6Hb'4 |`^ ¡b¡b||4 £k^ b b c|Hq 'sD; YW4ª b H b HH-t'Y ¡b¡b||4 |H |
';¡'|s s 9 |ma ' H|'4£f¡bU
D;S |D OH bS;hxV 9º )9x'|b|'y|i4 y¡'Hb9 ÉtÉ]Ð^9`¡'|-b- jm H'`Y mO% b-' 9HbHx+b'¬ H9;|I£ t'-bbhf 'Hf |¡`|+É]£HOm' ¡`S¬ ¡b||4 £
b
b6O '| |6;'b|Z H HH ; |qfÃy bH b4;¡b|sJ6m'H||bf`q|`|OØ9O'fHm'OUº
HOS Ob'O' mbm O¡'|Hjb;py b%|i bca t h'H9ObmH ' 9HH« ' £ )
ÉtÉ]Ð Jf'9aH9m '|9 |øÎXn||O'D¬ ; H%|
¼ ÙÆS¾aÏ H' H9 |'y '] HO |'b|b¡)U t9Hn 9JHU bY 't' H9H^))HH4»b |F©'9OqÎ=|b9Ob'|b6H'|bÏU© b HD |'n|y'xq|
»b' nÊHD |b% bjm H+i'; a Ùåc' S¢D99 -`tbxf `^ b' OU Ob-S H|O¡'| b
H'H ;O'¼ ÙÒ¾X
2.2 Software Vulnerability Prediction «'UJH9h' |9 |¨m'9]b;§Y bf'f¡`H§§ÉtÉ]Ð
bbOq|h¡)s¡b|6 h '|9t '|b9;¡b||| |HH]6 - £') b9¬ |^| `SWtxhHbbb9] b-m H t;'W '|9 |bs'|¬ bU;¡b||4 |Hs¡ £q|b9 );S |bq'6Ã 'xOH'%¡)'6 '|b9;S¬ ¡b||4 |H]| s b-m'9XÁxbbOnH'O'9]¡) n b-HbU; ;`;9 9 |D |H+b|bU;¡b||4 |H`Y bt)H9|»b-Ub;9 9 |D¬ |H-_'4È+9 H tI£ )H]_b|bU;¡b||4 |HxOf bm'H)9bO¬ 9 |bm b6;Hx¡`;ÃqmDHmb4 |Z H ;pp 9JHU
Problem Complexity
Design Effort
Design Size (KLOC)
Defects Introduced
Testing Effort
Defects Detected
Defect Density at Testing
Residual Defect Count
Residual Defect Density
!#"%$'&)(#*,++,-/.10#23054!06#798:06$<;%&=8>&@?A.B2C$'&@;C D?A. E05FHG6IB D4EJ 4!"CI1.1$'G6.1&@;K DF9LNM6O@PRQST.U$'&=2C$'&@I1&FV. IU. W &?AG#"CI1G64X DFZY3"%[email protected] !G#4 $'&@4!G. !05FCI W% !2[IK\3&@.^]_&@&@F`;%&=8>&@?A. IaG6FC;b. W%&c2C$'0Z?A&@I I1&@Id0#8 I123&@?e Ef[?AG6. E05Fg[; &I E5Fihj !FC?e4D"C;% DF%a?A0Z;C DF%Zk g%G6FC;a.1&@I1. !F%%Q STFl. W%&Kf[#"%$'&VgWm ±;¯'èçJÖ ¶×H¯¶` çaoÖ n ²XÔ4éc?AG#Fp\3&) !FZ.1&=$'2C$'&=.1&@; G6I. W &B?A0Vqa2C4!&=r% !.^7s DFCW%&=$'&@FZ. DFs. W%&t8:"CFC?A.1 !05F%G64C$u&@vZ"C !$'&wJ qs&FV. Id068x.1W%&I123&?A Ef3?AG. !05FyG#F%;z. W%&.1&=${q|s Ö;³² ¸} !F J ?A4D"C;%&@I~\30#. W}; &I E5FlG#F%;l?A0Z;C DF %Q~*(w
#
#
c DF%&@I 068_0Z;%&5Q '|9 | |n `m '9£§`
=||À r'|D |bb| ¡)9ItHH 4È+9 H xHOHW 9J99 %¼ ÙÆS¾X ÇIq b|xH9 |Z©`]% H9 |¡)s' ;@ )9 |Hx `Sy]s¡)9¬ ||HfHbO¨È+99c bmb|bU;¡b||4 £|OÃH|O' ¨yiV t S 4=Usb b-| Í`b9bH6 'sb|b9;¡b||4 £' |9 |ZWÁr a Hbmb4£§§ bb|bU;¡b||4 |Hm| bHH§|§ bH'|' '`¨bø'~ b '9H |¡'' |b§=9 pb;~ ¡'O9 9mb|9º 4 £ ©'9O¨9È+©Wc bn HD |bUÈ+iÇ |s|m); 6 q' Y `6tnS nbs| 9 HD p|r9 `O4£ 9 H9 |'ib|b9;¡b||4 O9hSs b|cD;f-' |9 |bib|'9¬ ¡b||4 £ ||ÃH||b +¤Ák p| 9 HD b4£ |õ'U 9 m|b|b ;ã )9 |H `S]|` | y bx' H9bHyFb|bU;¡b|4¬ 4 |HH Ártb Ñ W 't' ;mmO'Obbxa||O'D; |bsmD 'yO'HHxt'Oy|¡)9'©)nf¢D |I£i bs9 4 |_` 'O'9;¡'|s' ;mxH |bj h¡)j- | 9i| Ñ ¼ ½S¾Xtt'9 |%|pi|Yx|H9£rH'm- 4 H| Ñ ZÁm9º )HUcf £ Z 'x¡bU S Ob-`h H'4 ^ c¡)6b'O|¡b| c ;m - 4 HqOq bUxVb`H6'Uq Ñ ýsý#b< WÁj| 9¢ H9 j `] b9 6x||F¡)jOb`9¬)HH4»bjJS ' H- `S x||bj|'ÍbbH'Hj
bjb|'9;¡'O|4 £
||ÃH||b F Êxô O||HHùZ|bHx Ñ ' tbc' |^ | ||HY|yJbbbmH ;) n bcHbHH ^HHHH Fxb9 c O'H|`OYÎ=' 9HH6j'9 ;Ï `h'4È+9 H c|H9Os-' |||HHc`krHH9Yb4£ bhD£ D H2 H HH6 bj 'H4j' |||Hn|HH_|c4¬ |t §9HHH¦Ì6|'9
' |O|HpO9H|iS |O] 9HHm k 'qm
9 4 |D£ D H H HHfbÀS b9H' |¡b|j n Uj¡bb Ëj4È+9 H mm b|HncpaI-S S 4=U
fH£ H¿'4 '4È+9 9^|HH|^Z' |O|HHt|nxb|;fx b9£h9º HH bb'9
bpO'H 4 £ %b9 q bq` bkbH9H £
' |O|HHH¥Á'Hõ'4È+9 H `S
%O'|km'b| '4È+9-|f bH4- O||H ¿ b4 HmH ^¡)H'jF b`S¬ ' ht)9; |'s b9£p)9a i©F' |||HHc¡)hH4¬ HS i` b)qx4 'Oi 'cm'b|Hyb|'mH9;| S |kßb4ºbÏUsÄ
'j|_ b mHUb'OmYÎ=b;k A O|'H
cH'pYS |J9
b9HH |4£ 'Àx4 b m-' |||HHH^«y`Y '- `S^ 'hx4 m S 9^' | ¬ O|HH^ -`¡'|t+ 9^'ft¡)Hbt '9£c` HH9 m9 4 |D£'D 9 9' 9HHytb9 UJ ©F £qU¬
f'¡ £À' ;mm9fxb||p- 4 |b§H ` 9º HH' 9hx4 À'OÀ | ||HHÎ=bH'H9a À UJ9 HH§ %ôW ||O9§ùZ|'H% Ñ 'fhôù_ Ñ Ïsf£p H'4h| qb|b9;¡b||4 £ qîbY9º'm'|©|bD;'Hfyq¡''È+9 9Í`§|m¡'| UÃY)9't `SW9º HH H_x4 h b^' | ¬ O|HHYx =e{ |rßb4ºpu={Aep|Á Ob'xc| mhb|bU;¡b||4 £ Ð62|6tbmi `Sf' ;mmU n`H9;| 9 n;S bh§¡)9º ' H¨|§ 9 m%6||b9n H's b9qtc£ ) bH|ØHs `Sy S 96 'cô^ù Ñ OfaI-S f 4=9Ycm''|©+ S 9c4ª s '|b9;S¬ ¡b|||I£n||ÃH||b +]«y4 b'h '|]HHmW s¡)x| '4 OH4£ OOõbOqHb4 m|ØHHõ| bk' |'H|b|h; |b OHDi | ||Hpa
b|Dq|Hb c |m©-tp'H Hmb4 |]HV Hb9faf)| |H HO |À¡)9 ]HH ô^ù Ñ b b 'h¡)9Y6b|'9;¡'O|4 |Hm|§aI-S 4=9 Hjt'HitcpbYô^ù Ñ jn=9 Jj' U¬ '|9 |bsb|'9;¡'O|4 £h|OÃH|O' f`|b] j 'xbx ù_ Ñ mk|ØHqm9 |
jV t iHmb|9º 4 £rO' U¬ '|9 |bm 9J99 H ÙW ¬I ' Ñ bD '9 tbHY 9J9s f)H9|»bhHbD '9 sbk99;|p-H£ j b|b 'UCH'D b9 `Sk`§'OD £#mÍ)HxH tb9£fH£9| '9Y¡)m|O¡ ;£kJ'b9 |'%YD£'D 9Â|| Î=Oä ' 'ïO|¡ ;£ D '¡b;ÏU tbU£ãHbO O ¡)'9¬X- 4 HJ'b9 |'Y b%`m¡)H99 ¬ b Oø b¨bD tb¨9£ø' HH'H¨nb;CHbD bU mO c¡)m9 ¬' bm%m|Y H)Hb bm`S ' y bH4fS bm9 %n 'H4nH4 'mH h6'§îb O'D;'H©+ b%O9b p- bmH b'Ok¡)% 9ab|4£ © u w © U'HUÃxb||b|bpJ'b9 |'mb; A { ~O¤¡''È+9S9ÍbSxH îb fS¨S¬ ` u 'e b @ 'w bm9
Jb'9 |'b;ã @ b'O
¡)j;bH;Ã+©H)HHOO4£q|Z b9£
S jS O¡b|Hy` b9¬m'4»`¡b|©b
Oa fSjD |bb|b9;¡b||4 O9 ¼|ÊâS¾Xx«y`ab'9 |b- by)9;S ci»`|sbmHxbbO ¡)pSO'Àb 4 9 b |Hm `Sbi»`|p H9 |' b'O¡)n'k
' H96;HmH` | |b|b9;¡b||4¬ O9Y¼4ÊÙS¾X «¡b9bHb;§9 ¬' bH'D b9 n' Hn'hOn¬ b4£i b%¡'Hb9h^b|bU;¡b||4 |Hj Hb4 |bfa Å b9| bô ;mm9 ya 9p- 4 c bH46Sx SJ%9 |' c9 ¬I ' Ñ ||¡';£J'b9 |b
`Àb bH | ¬ D +iÁb||m H' bH|'p 'nJ'b9 |b|4 £rx bm|4¬ ¡';£kJ'b9 |bH©W bm9 hm| %|k`m¡)H9§''¬ b|| ÀOÀxb|U b's'U' ;mm9¬ - | 9Jb'9 |'%|n%U ¬' bc bH4 Ñ ||¡';S£ H' U ` H ôW H9bHYb;9 ¬I 'Y9bD '9 j H6'bHU¬ H |4£HbD 4 ' pb|bU;¡b||4 |HH¦tb9£Àm| ` ¡)HH'r|§¨b ' OS fb'9sx4 ¨Ã 'xOH' W bH49 ¬ bc O |bHÉ]'y b|y|6b4-H£
bôW ;mm9 nV HÀ'pbmHm'|9 H4£¨b ¬ 'U D;`q 'Yb'9 y'O'fb;qJ'b9 |'H9i4 bU£m' © b9£%m| ^b]¡)yt Z JUx4 9 b |HH ß64 |f 9|£ ©S'UcJ'b9 |b_Hbsbc9 |''s¡)H' O;ÃWH-S HbHxxVUÃmHbH9 F«4 bb
¬ ;mm9 mm| fUq|b;Ã £OÀ `m 'H4bc'U HbD bU y q x n¡)s`S mO9¡)HHbs bsb¬ '
bH4 bmH nn b
H| bmH ©^fÃ|b 4mib¡b4%t'O¨ 9b4h|¨ b9|Y H)S ¨bbb4¬ |f H4£ Hb4
| '|b9;¡b||| |HH#Ì6tH9©x b9 | bkHm'| |xHV Hb9
Jm b|nH¢ H9 ' Ç]i Hm'| |||£'HmbD;S n bm9º |D Hb9yb;¨ib'9¬ bmHbs bHs `S_tbO-¢DbD 4V£s b]']`9 ¬I ' HbD bU scm=9 sac' H'|9 |bf bYb|b9;¡b||4 £ ||ÃH||b ihV -S hS 4=U Ñ b9UÃU % `Sm 9 H9% HH HbH9n9 ¬ bH'¬ D bU |bH|b'á6«xÄ%¼ ÙS¾X©î_VH-»b`'Ut¼4Ê9¾X©`jÇ xÄ Òc¼ ÒóS¾ tb9;b9UÃU s)9J |9º |tb4£ |hb|'q H'O 9º ' 9Ob6`p 9 H9f ;bHxx4 9 ¬ bYH'¬ D bU -D Of b9|y';¡`9H]«x 'mH t 6mO ¬ |f|4£;bH;ÃO¨99;|§9Ht'9£ 'b9fp||D Û '4 ÞYx4 'HU O |b]F bx' ¡b|HmH© b9|]| ¬ ||f '6H © 9VS q|H9)F OÃ)©'bm) H O a9x| U ` |9HtÄb;mU'H;Ã9 tS ¡)U 9] bmb|' b O|4 £s ;ha9 ¬ b]H'D b9 _a f £ bn¼ Òó¾Xc«4 'b b9£qbYOm'|Yb 9 f ;b|''© b9jU'H;Ã9 t|` | ) |'- '6H `SWW|D^'H9 tH 9ab 9 ' | £ _t'tb]`b4£ |9º |Fb4£ |-fÃH bHU'H;Ã9 ^JD 9- bm b `S6] Ãpb pH'ctb|c|H`¡b|H6 'H@ t Ãfq' ¬I H' 9H
9'©xb|;qfÃHt4x)4¬ ¡b|j m`|£ ØHc|)|¡'Os¡'b|O'xh' ;i ½xô ;mm|bnm|D;ÃH Ç ~àiS U~ÙÚÚÒ ©Y§U | |cHH' 4I£b|b9;¡b||4 £ t Jbbk|p bnùF| ºÃ9 'HmHm£fb9mH 6H |bO'f b_ D£ D H|t¡)HHbqJ||'
;bH;Ã
'j 9 ' |bc]hab'9 |O||i bcD£ D¬ H H|H nÎ=O'H 4»`Hq Ñ «yЬ ÙÚÚÒ¬IÚÚââh¡ £ Ñ ð ]ÏU Ñ b9UÃ|bc bx 9 ' f|b9tFJ'b9 |'tH)H9V||£D£ D¬ H¤O|tb|bc¡)H9h HHb|ØHHtj f ;n¬ m|b
';U O9iîb||' n iifH£kbY4-H£ %| ib|b9;¡b||4 £ hÉ]'s4cm| jx'HUº'9H' |b H`'4 |% HH -Î=b;hW '^abbU O%J||^`s 9 ' ' %9 H SÏW|% 'tx` b-ùF| ºcb|b9;¡b||4 £ 6|%b '|9n¼
ÒâS¾W;bH;Ã
a6 H'bbbObmH H© H%9'©`c ''`' H`'4 |b|OhùZ|'º+t'9£ ' Jbb
D 'hH HO |¡)U t9H
'U ''`' t ¬ ; )9 |Hhbrx`% b9£ 9JUh kÛ `S;9¬ Þk `Sn|bH|b'b6V H¨mHm£ ©'9 9a9 H'HH 6b|x)| 9 H©t) H Vy''| UÃH©t`§b H|H | UÃHt'9£nJ b9Jbbh `t6»`|yH ;|'O'cb;f b`''9£-j bb4£kÒ Æ{@ ÊÚÚeÅm n|OÃH4£k `jh`S;q9 x biY;` m4£U'H»`| Ox'U
'e ©`ù Ñ ùZ| s¼ Ù½S¾©`bf '¬ eh' | |k 'nä6Ðß Ñ Hmb||9s;bH;Ã
ac' ;Å' )9 |H b; 'ÀH ©-b'À HHO;S |bH©xI£')
|bH'¬ |D Hb9O9H©b'j¡)9J s'U»`b4 |F©|b U ' f|bHH© D; 9mH nx| b9È+99 H©x|OÃH4£|'»bb4 i| 'H©` @u ' D; Hm9 H¤Ä b; ¬ =|j ' ' HHi| ' ; ' )U O9qS b
9JHU
qb|'9;¡'O|4 |HO b9mH|Hh¡''% b9£¨9bO§¡)q|` | m) H O
b9Htb9£km| s¡)h 'h H'|c-m|D;Ã9sf'h¡£ f ;mm9xxbf|69| '9b`Ht Yj'bHbHU b+ br ;mm9m|i`|' õ bH a U U'HUÃ|bx b9~ y¡)]`S m|HH3Wmb4 ||4£Y¡bU |'6 H HOS Op¡)9 ]HHi'Ui ; ' )9 |H6`q'|¬ b9;¡b||| |HtbOr¢D'D |V£ 'H4
'pO' OU O' b '|b9;¡b|||I£O|Ã9O|' iWV t % 4=9 H-t'j=U `U6 |mbd WbOUf¼ ÒâS¾^`ha'`p)4 |mH 9VS¬ Op¡)9 ]HHp ' HYb;p' )U O9sbpb;9 j| HbH';|b Ò'-ôW ;@Ä £ | ôW ;mm|'D £ |
|h9b99 brx4 ¨ bm b¡b|||I£ - ;mHf«ï ;M `Sc|% mHb4s q Hkx|| ¡)% mHb4y fb` 9 D;bF©bm'4a£ ©' HD©+bif| ;| ¡)H'sbf'jÎ=mD 4£
'4È+9 9xbHx|i%H|O¡);¬ Oq HH|'mH nH4 'mH UÏcS i||¨|¨ bH 9 |4 O9HqÇst'O b9 UJ fSÈ+H9c bm'D£ U'|OH Hm'OUº'4I£q bc' ;mHtÇ b96 Hb¡b||4 £p` Hm'OUº'4I£]'V
H4 b9y| 'b9sb9~b|b9;¡b||4 O9 Î=q'9aH9 ;Ïnq||Å bUº'|D |b¨bHf )9 |Dq¡£ SO'|bi'9 HU OZfÇI b|cf'b9©Z' ;Â' )U¬ O9jH'H9 'px4 kD £ |hSÈ+H9j 'hb|'9;¡'O|4 £iO|ÃU¬ O|' ia t Y 4J9 H tb9 % YH9;_¡) Ã6`pS O9O9j ;mm|b D £ |sU b|b~`øôWVb9§¼ ½ Ê9¾%|¨â⧠'|H Û Þm' ;mm|'%DI£'|^6fq` Ñ Ãk¼ ÒÚ¾Z' ¬ O j%||DyÙ½ó%D £ |6 b|Hx`q|n' )sc;º ¬ %£p¼ ½ñ¾ by`- b6a||Sx|'fa H H |HH¹ ÎXÏ yÖ;¸+Ö ±;·ç ` ±;·×ÔX²V×Ö;³§ HO Hã C b ;mm|b ' H9'Um'`'U D;` |b`'9»bb|bk b ' ¡b|H¥¡)9a xH'|'c`Y 9- 4 O'sH'-|'D Wb ;b|b%yHmm9 |'%¡bqH Î=¡)Ïp®bé ¯' ±; · `ìb²V×y³HÔ4é)çaÖt HO m Y 'OH£ '-`fHn¬ mH |btbH Wb;c'|bx`H|b'©¡'VbÃO|'HH© Hmm9 H©`S H bH9H©bhm'|bab O'H 4»`9 `mHt n|m' Sj9VS 4 £q`f '¡'O|4 £ Î=SÏ W¯¸)ÔX±;¯ç)³HÔX±µ×Ô µ±UÖ]³HÔ4é)çaÖ^ HO Hm s 'y9 bÍb )HU j `sÈ+H96 bhUº'9H' |p] b%' ; b;h|bHWbm''VS 4 £ ©Sb9D O''©O b|b © ` ¡';b;b|b ÎX`t Ï ¸'Ó=¯±¶· ÔX²V¯¸q³HÔX±µ×Ô µ±UÖ-³HÔ|é`çaÖ- HOS %bS;%D bU¬ '
b';Í`ã 9U'bO¿ bH%b;Àn;b|H
bS; D b9 HH©h|'| OO|ØS |¤f O¡'|HH©m` |V' ||b'' H «4 bbj 'HWD £ | b|H_S ^¡)9O|H6 -`WHm9 a %H'Hb'y9º )9 |H'H
;mm9 x` U¬ ;b9 H©Z b9 n nf£iH ; |9 £k'O'H||bHY b Hq¡ £6fb Ñ Ã¼ ½ñ¾XyùUÃ
W nH|H 6Hn¬ b4 |b 9b4 t`h bx'Z|m )9m9 ''|£m| D ` £ |bf b%¡)HbU»b s]' ;mm|'
DI£'|nbnO ¡)HH¡'9 ¨¼ Ò Æ¾Xctb9 Y`Zª j¡)9Hh'Ui H Os ']Hm'| | |V' |Y'D £ |^J9 HtbxV H4£¬ biDI£'|c b|H`Y¡)HHp9HH' Hk6¡)HD6';9 |HHH îb
9º'm'O©y 'àq qÇ b'bD£ Ä aI- káyH|V¡b|4¬ |I£k« HOS O ÎàqÇÄá6«6Ï|4 sbO'H||b9cas 'nb Ñ V -S %|' m¡b||Hc¼ ½â¾`y99;Z' ; D £ |6=9 H Ñ bH;Ã|bhayD £ |6=9 b
¡b9 |b bC '9£iH HO Yx| pb|'9;¡'O|4 |H6]bO' SO' n¡`|xJ6|b9Ob'|bn 'H %J9 j|iV t h'|¬ b9;¡b|||I£q '|9 |Z
3. LIKELIHOOD OF A VULNERABILITY «Â ;iª qHmb|Ob9x4 ø§ )9I£ø¡)k;bH;Ã
9| '9] b'¬X |msÎX £ bm|t;bH;ÃO'cbhH9 |` HD¬ |' Ïn
Hmb||9¬X |m~Ä;S Op`|£ |Om 'i' H9
Uº ;9 |bpHf |f|'a f |§¡) mi ;ÜSnHn¬ '|Oc |mytbY¡b|||I£i m;bH;Ãq ;@ )9 |Hyx4 b b |' rUº'9H' bi ; |fH)HHO|4£b)H||bra 9H' 4 £
' )9 |HH^«~ |9I£qD; |Yb4£ Oy;bH;Ã9 ta 9 H9 |'rV t pb|b9;¡b||4 O9bq¡)H9' )ø¼4ÊSÙ© ÊÆ©)ÙÚ ©bÒÒ¾
ÇI ;' 9' ;D;S |%`|£ |6|ybb'HHO'¡b|f¼ ñ¾_`
f £ | 9 H' ;sD;S O`4£'| ¡b|Hmq Ðjô¬I9mb|9 ¼ ½å¾Xjt'|6|mb||Hx `| 9 ' HH'';_D; |%b4£ Oh'D fÃnb Sº |f |bj q¡)n'HHO'¡b|f`k;9;¡'|iÎJ»`'O |f)4£ bmOb |mSÏUW«y|Vt`4£ |H©xb|Uf|] 'y ¡'O9ï D;S ||4£
»b` O'h|VHH©`|-cJ'`bmH ;` ¡'O9 D; | `|£ |m¡)Hb
£§';¬XÍbS b4£ OhO¨ '
HHb9
)| U x`f' 9' HsÎ=|4¬¡ £ ¬X 9a9 H'HjÃ|``ÏW`t h x4 m|VHHWÁ`SWfÃ9|O^b4£ OWb |HbOS |£h'm9b4 |s b%=U% bcH9x4 'n|mb|4a£ |bbm' | `S |yb 'h| ;
9º HH ;¡b|kÎ=bH9H £¨ kfà | ; H ';6D; |k`4£'|q'HHO'¡b|SÏU©y| ; H' ; |Vh`|£ |s|cD O|Wbb'H9V'¡'O%JcObbHsx| Hb'4¬ |`|H©x| 'H©x £ bm|
D ;©yb HH |i';D '9¬ Hc¼ ½Ò¾X '|mb+ `Z| ;' 9' ; OOb4£ OZJ_tOb` t 'Up Ñ `y mfÃc'' º |f |'x m¡)Y HHOb¡b|Y` a' '9Y'' º OfS |bj q¡)h;9;¡b|t'Hf'' º OfS¬ |bh H'4m|À|`HH ; q|' |'h r';S¬Íb' ¡b|HmH î bfOUx)| h;b9UÃ|bp' ; )9 |HH©W b9 b Sº |f |bYÈ+HU% 'mH9';U£x'%U ObHÄ'a b Sº |f |bH© 'x `^' 99 - bx9º 9 b|4£n¡'9 ; ¡)H`|©t 9b4 |b|SU HD |f HffH£§|À J|-)4 |HH«`j'b SJtb Sº |f |b_fH£j|c y¡) J|Y)4 |Hyb=|%'HS OHH Ñ H D; |y`4£'|^¡`HhHH |I£h;b9UÃU ^b ;h ' 9 H9 |k '|b9;¡b||| |H|n¡'|`£qf'b9D hb|bU;¬
¡'|O4I£%|H4 '9W' H9_¡'H Wtb|¡'Ob£c S mH _H'¬ '|%x4 h btJ9 `SW bt;bH;Ã9 WfÃ-'' º |f |'W ÃHH
'sb4£ | HHOb¡b|© ;9;¡b|©bb
V¡b|c| x ¡) n=ObH |H]bmJ|6)4 OHHîb' '9 m © sb4¬ '9;¡'|O4I£§'9 99 ¡ £r'U§;bH;Ã9 Y¨¡)
HO|»b§h J|)4 |m'|£¡ £kf`|')H9 |FqÇIb9 r H9'¬ 9bHJ|s)4 |Hx`n b9È+tO|fOO'H 4a£ |b J|Y)4 |HxfÃ6HH' 4I£
;b9UÃU -O9'9J'X ÇIn W H ;Z©ty x|HD |S O's ab Sº |f |b 9¬ OS Y yÍ`-¬Hb4 ||I£ ©9 9º¬Hb4 ||I£ ©` ¬Hb4 ||I£ © 'fm H|O''© 9 6m'H||bfÎ=D bU ' H]`fS;£ ;ÏU© `À 9H' |p';rD '9 ' HH©-`Àbb SJpb' º |f |' 'Us|b |'qJ'b9 |k)| 9 H©Z)| 9Y 4 'm9 |©Z` |``` OU Hmtbh£ ) bH|j|j `Ss4-|bD;bHHs- a `pb' Jnb º'|fS Obj HH s||OYb4£ OY`pO 4ª h9O|H hb4£ Hh'U§Y U'|bk'9»bb4 |¨`|£ |nS ;UÃF©m' +©]`¨Hh¡b|'b|bpHU;|À'H' |D |HH© 'H bkHH |I£;bH;Ã9 ¡b'O4qõ õY bHb4£ H Hi'j bHjmH' 9mH ] m 9VS h%H »)'9bHj|' Î= ¡b¡b||4 £bÏ]x4 i;
9)yh'O'9;¡'|O4I£ t'jH'») Hb96|iY '|b9;¡b|||I£m H)© xb|;
|b4»`H- '
||ÃH||b nb b-b|bU;¡b||4 £Y¡)H|bj9 b|4£h HH ©x||b¡) |9 H4£¨ ) |`- b9º H njb Sº |f |bh| ¬ Oq||F bcb4£ H by|q % bc'U H9 | ` b|bU;¡b||4 £ Wt'|t|-¡)H'© bm x b'' º OfS |b f yx'|O6'9 99 |bYY'O'9;¡'|O4I£ © by S 9t by' ¡`S¬ ¡b||4 £Y' `S'9 HU Oh¡)H|'jyJ|x)4 |Wt'|W 9U'bO¿ b
¡)ybn s;'Ãh byb|bU;¡b||4 £n 9) t¡bmf b9| ÛIJ|i)| |9bHÞpxb|;§]q¡)H||Hfx||-Ob4»`H 4£§On¬ `9q 'pb9ab|bHqYHH |I£;bH;Ã9 Hïtbb4£ |i b|bU;¡b||4 £% H) a ¦HH 4 £%U'HUÃ9 ^Hm bHh¡)y 4¬ 4 |ØHi¡ £m»' D6`|£ ØH|'h bj H) - `Sy`sh U ||ÃH||b iW¡)9O'mU `Fb|bU;¡b||4 |H6`bxJ|c)4¬ |HH
4. ROLE OF VULNERABILITY LIKELIHOOD IN SOFTWARE ASSURANCE METHODOLOGY Áy`y H9 |¡)n bxHbHH tb|'9;¡'O|4 £nO|Ã9O|' | b-ItcH 9º Zb|b9;¡b||4 £n '|9 ||ma t 6 4¬ =9 t`h'O'9;¡'|O4I£m'U H9 |n'|bsD; |b4£ O^U'H;ì 9 H%Ç b|sHU OZ©Fth'H9 |¡)n'¦m9 ''O£p¡b §b|'9;¡'O|4 £r|OÃH|O' H¨b9O§ O 4 OØ9ibH'HH ¬ ; m 'f 9' 9H%| 'n HD |bpbbm pib¡'9Yx b m''|H-|hV t Y 4=9
ùZUtb^'my b b-J'tI£ )H^F' ;ï' )U O9t'U¬ 9 |¡)i|iHU OkÙh cHm'4 OH|4£q'Sx
mH HOS cx4 bh 'h¡)9jxb|bU;¡b||4 |HcO bnm b|Hsy
aI-S 4J9Áb9qcV -S Y 4=9yOt H £m %¡) HD HF© b '4È+9 96m''O96 b% 4J9cp¡)Y 'p 'kpæ µçVë ¸+Ö ±;·'è²|ç|²=Ô| é ` ±UÖHí²V×ÔI¯S±Zx'O;cU'H;à FJ_ bJ' )9I£6I£')9H àq9 |HtHm¡)yH'9; natH; )9I£hI£')îbt9º'n¬ b|©|f byô^ù Ñ ©4ttbO¡)x byb%¡)9_||b9t H h| bhm b|s `Sj bix4 kH|HS p' |O|HHHY«b |m bx '9] HHHH© 4tHbOm¡)y 'x 'h¡)9|bD;bH9 WU ¬' bsHbD bU H©`' ;mmO'nm|D;Ã9H©``q) ' ;mmO'qDI£'|
Ç 'D;'HHc HH O'i|' |||H||b9 W9'jtbOq¡)j9bO 9 qm jH9 j b
bU H tb96m9 |H^f£h¡)]H| m¡`m by9º H ] b9| H HO |'yx4 ib|'9;¡'O|4 |Hy' O'h OyHmb4 |F|4¬ bS |bHyt'9£ifH£q|¡)Y' fO|ØHHi¡`Hii bc|ØHY bYV t nm b|h`i bYb%¡)9yt )9 |H6U'HUÃ bb'9yUiI£ )-t'shb4 O'|mH'|`ZmU O9W '|b9;S¬ ¡b||4 £m||ÃH||b
HOS x4 f bym'b|H^f¡)ybn ;'Ã bHimÄ b;
;'à |'qm9 ''|£ptbOrb9OO'H ¬ 4a£% b-m xb|'9;¡'O|4 £¬' b-a t ym''O9WV ¤ b '9 Ht'|m bH¡)q'§ ' | 4 |ØHi '
|mi` 9È+q||H| bi HD |'¨b`¤«Å|ObS |s '| m9 ''|£tbOø H¿'4 bk HD |bbbr À9 b|4£ '|HSUsm % '|b9;¡b||| |Hs|km''O96O'H 4»`Hksm b|bU;¡b||4 £¬' bs `k| bc b96m'b|H6bqx| ' £
' |Ãbx|'cW bsb|'9;¡'O|4 £¬' bH'Hxm ¬ b|HH ÁrH'VõJ b9p|b9 );S §O b|m9 b |£ ©s b H;b'V¿ 'jtc' )s f¿ ` 4a£ bs||ÃH||b W '|b9;S¬ ¡b||4 |Hj 9 H9 i¡ £D; |YHH |I£i;bH;Ã9 Httb| 9U'bO¿ b Y¡)W'6 y HO ]-O|Ã9O|' Ym9 |_x4 c;cb|b9¬ ¡'|O4I£p'9 99 ¡ £iD; |%U'HUÃ9 H6ÌH' |D |Hf£q¡)%' fH%¡b|bYb;m9 |HyJs|_ bYb|b9;¡b||4 O9s'9 99 |fjm''OWtbHym9 |HW¡)-'m|bsx4 f '-h'|¬
O Om9b|bm9 |HOp;'ÃO'fm'b|Hy q 9 9 m|bs ' Uº 96J b9 HD |bf9È+ 6¡`Hpk 9DjHS9;h` f`+' HcH c` 4 H Äb;Âãm9 |9¬¡bM`@a HbHÅ HD |bm9 ''|£ ]'V¨|r O'9 ¨aI-S i ;'HV  bfH9'¬ 4I£n|9x)| îb' '9 m © m9 |H¡`Hfmb|b9;¡b||4 £ ||ÃH||b mtbOm|ys' ¡`¡'|O|D |6mH' xZaI- jD¬ ;'H«y`k|m' S|b bmm9 |Hc¡ £b H|bi ' 9 |¡b' |'=9 H©b-9bO%|s'9mbD;S tm';¡'| |by| ;'H
5. OTHER RELATED WORK É Sx'69t=x¼4ÊHÒ¾ZD b £hD; |D |` Hb'^Om H) m| ¬ |b]|'HO'H W| |O'j9º b|| Hn '|b9;¡b||| |H^bn'U O f H 9Or¿ b |p `Sj H' 9H 6 b%Hb%bO |cHb ` H) h|bHO H WyabbU Oh` b] |mt|'Ht b^D; bjUº''|4y9£ H|
t'9 sS c%b%¡)9]D ` |Ht `Sx Hm ] h¿b 4a£m ' ';bHYi)9;S |`_D£ D H2y')
f¿ b 4a£¬ |'YD;S |j |¡'' H^On 'y'H|`f'HH|bm9sD£ D¬ 9 ¼|ÊHå ©_½Ú ©½Æ©Ò Ù¾qÄb;rb' ;bHcm H bn| b| HHc`|'s m H||bf=||' hO H|O¡'|O4I£D b'|HH ÌtHU©Z 'm' mH'4 £pbU h||HcOm'H||bf bhO H | ¬ ||I£q HH y|
b6O 'Oi' 9HH
Ëj Ñ D;9s=n¼4ÊñS¾ Hm fO'H 4a£qJb'9 |'6|kfa¬ t ;Ü `Sm`qk U
'O'9;¡'|O4I£§O|Ã9O|' b 'k b9
J'b9 |'q| bp ;iïtbH4i £ ) ¬ 9Of|m `Srf|x)9 HH ;6Jb'9 |'mbSqk H O'b cÎ=b;x bY9 ;|b|' © © © ©tb ÏYOhmDn||ÃH4£ pH ;|§ '|b9;¡b||| |HH t'9£' SV m|Om4 kHmb4 |]|Ob | Î=b|bqb4£kJ' aI- % 4J9 ;ÏxW bH4y £ ) b9OHttb|b Ui|y|'¬ U HD |bq¡''6`
¡)Y HD x| km YV t f 4J9 ¡)UJ ¡)H|b¨'
bkc 'k'H' |D |H ¨HO4a£ ' ab'9 |b]Ofsa t j ;ã| Û m 'O'9;¡'|HÞY` ÛI|H'O'9;¡'|HÞn9 H
u
A
A @' { {
j 9mHbHç`cWb|9k¼ ½ÙS¾6' )prD; |D |6 H;bbO¿ b H||÷ë=±;·¸'ê²O¸@
k;'ÃU m H) mH'9; ¡ £§D; |
; b4£ |n |HõtbU£§HO4a£ÀU'H;à naf ; )9 |Hp| b9HHDJ'h;bH;èÎ=' ; | S |bp `S S |Da£m by;bH;Ãn )9I£`ÏWbn=||fU'H;à Î=' ;ï|¬ H |' `S|O Hs 'WU'HUÃj' )9 £ b9 H¡ £H'D 4 '¬ |'YU t H) ;ÏUWtbybb'9 4£ |bs £ ) 'H|]|^ b%ÛI b9Þ U _ H) ^H'9;|4£sJU§Ocb%¡)9Ä -JWx` |H'O )9I£ ©+ b9£9m`S % 'hb%¡)96t'HHHDabU'HUÃ6 'jb%¡)9-=||i;bH;ÃHWÇI_ '9 sS jJ9]9x=||i;bH;à Î=U H) ;ÏZHmb s ybHH9DJb ;bH;ÃH© 'Hc b9 ^O_ U];`bH] bW bt=O|n;b9UÃW t 't9 9) `kbsJ|f)4 |HHt'9£kbh 'OsJ9 Y ;'ÃkU 9) %`k bH4Ym HmH j|` | m `Sc b|s;bÃ|b 9U'bO¿ byO-¡)U 9] b
c;`'m|ØHn;'Ã |'hñå Æ ï ' |mtb|] H;b'V¿ ' 9 9 m|b9^ bx=|j)4 |H'Ht U c H)Y¡ £pHm` |'i4sx| bnb%¡)9jx '9c9¬ 9) `
bHH9DJbZU'H;Ã H©`bqb¡ £
b4£ ØH|bn ' H'j¡)H'Ob
bcHb9;S |pW bs H)-ÁY |H|`S 'tb UmZ;bÃ|bcf9 ] H)t¡bnf 'x9º H x'' º |f |kbk|4 cH'9; | i q%b;k¡)U 9 bq 'H4- HO |j;bÃ|bnm9 'F
A
6. CONCLUSIONS tb~H'HH b|bU;¡b||4 £||ÃH||b @2b U
n ¡`¡b|||D OH|4£pm O'mbq Hm'D;¡b4£|m' S|b V t y ;b9y|W6'9`S;'|# ` HO Ha # b ; 4 O`F¡'|`£b ;f %b|'9;¡'O|4 £ 9 H9 |Z«b bm¡)HDhy hÃ'Sx| ©W 'OY|nO 'f»' Dh'||D | '' ;q nV t cb|b9;¡b||4 £' |9 |Z Á6 sH H 4£fV H 4a£ |bhaI- cS 4=U `aI-S '9H|'mH nH4 bm9 Y rHm'4 OH|4£À|ObS i f £ ¬ ) 'H|f¡)'ma t b|'9;¡'O|4 £§ '|9 |Z«` ¬ -S;'-|ObS O'h'- £ ) 'H|tf by|OÃH|O' qb|b9¬ ¡'|O4 |Hh'9 HU ¡ £D;S |
;bH;Ã9 H©tf`m|mb|Hm9 H ' I£')]U'HUÃ9 _J^¡''È+9WSUÍ`bYJ fD |bj'|¬ bU;¡b||4 |HWb|bx b^ô+«6î
V;m9] Ãm¼ ÙóS¾b`c4ª W HO | 4 bm bW¡b|J _|mb|Hm9;S |sbOSJ iZÁ s] Ã|bnq;;ÃO'fb
m' |bh 'c'' º OfS |b HO pk' ¡`¡'|O|D |im9 |fx4 Àb|'9;¡'O|4 |Hf'U¬ H9 HF
7.¼4ÊU¾Yî_REFERENCES VH-»b`'U'--s x'HH|9 HÿSÍ)H-»b`'U ¼ Ù¾cábq«b'4 |bnZ ZajÄ H9' 4 £kÎ=á«^xÄ'ÏU --s 9H' HaI- 9i ¼ ½S¾Ytbc]t9I£qàqD Ñ | |ÇI U b9ÄHH' 4I£ ð^'O'9;¡'|O4 |HH`tbcÄ «ÐsÄfÇ 'D | © F¹ ÿÿS--s bH ÿS `ÙÚ ÿ ¼ Ò¾sÁ Ã'qiÇ J f | ¬DÄHH |I£¬DÄ £ D Hïá |'mb á6bÃ|b'Á|||Om¡b '©bð64 |bO©+àiH£ÙÚÚÊ ¼ ƾ Ñ 6 á « Ñ 'a9 H'Hcpä;`
áyHS U Ñ `||H'HO Ñ mb 9Ä 9O9bHc` Wb|bH9 |''© bbsÙÚÚÙ F¹ ÿÿS--s 9; ÿ«9 |4 |H;ÿ;`+ Ub||HbHUÿ
<
5
¼ óS¾Ytb WH'm|sÇ mb9 tWÇ b'H¿b jÇI'V;D bU ' J6ÄaI-S %ZHD |b'©)àiH£ÙÚÚÙ `ÐÇÄ'ôWO'b|b áH)yÚÙ¬ ½)«yOO¡b|ja F¹ ÿÿS--s 'OD 'ÿ'4 H9 Uÿ' ¬aSÿS 9);ÚÙ¬ ½ + I
6
¼ â¾ Ñ `||H'YôW ¡b|Hmx|ÄaI-S hÄHH |I£+© bbYÙÚÚ½ F¹ ÿÿS 9 ;Z m|9 a Hÿ' S¢D99 ;ÿ ÄÁøÄHHÇ 'D 4 ' SÿSUb||Hb9¬m9 | i ¼ åS¾ Ñ á6« Ñ 'a9 H'Hcpä;`
áyHS U Ñ `||H'HO Ç 'a fS OÄHH' 4I£ ¤«y';'H©'Ð6SH%¡)9yÙÚÚ½ F¹ ÿÿS--s 9; ÿ«9 |4 |H;ÿ;`+ Ub||HbHUÿ HH' 4I£`ÿSbm m=
<
< ¡ {¢£#¤D¥§¦T¨T©«ª¡£#¨^¤D¬#«¤ £5¥§¦T©o®3¯:¦o^°w¬6¤±«²6¦T©o®³{¬#´¯> {¥ ©
¼ ñS¾Y«4a
ð%'«''©'á6ZÄ 9 'X©bb UÈ) 9£qË%'ß|OfZ «6b |'¬XÁrH|9£
ùZ'fiôWb¡b||b|' Ñ '|©`ÇIb|©FÊñåó ¼4ÊÚS¾Yîbbm|n«yÃ|£ f «yq9º'mb|j_aI-S %D£ D H 'H¡'b|b' ©_ʹ ½Æ½ ½âñ ©ÊñâÊ
5µj¶3µj· ¡ {¬w¸{¨o¦T©o© '¹ ¼4ÊÊU¾sH yÉ]H;Ã+# º¡» ¯¨o¦T¢¦ £#¨R o¸{¨j³{¢¢,¤D¬=¸~¦ » £#¥N³{¤D¬V¦R´wª¦T¢B¼«¨R³AT¦ ^°³{¬=¸w¦ `«6''| ¬ÁrH|9£
ùZbfiôWb¡'O|'O' Ñ '|© Ç bO©`ÙÚÚÚ
¼4ÊSÙ¾%àiÉ]|bbàq|UbHZËj|O9 Ñ bH;ÃO'hJ;H Hb'4 |bx|q»bOcHHH9H © ñ'ÎÙÏU¹|ÊH½ Ê bÊSÆÙ©ZÄ |bqÊHññó
T¹
¡ {¢£#²=¯¤D¬=¸B½6¾u©^¯:¦T¢,©
¼4ÊH½¾YÉ Á#bÉ] Hbi©6''áYbÉ^ xZ©`biàbùZ|)s 6` |;S |jH|`S |iWaI-S %¿ b|4 £ Ç
· R¨ ^¦o¦o´u¤D¬=¸{©, j¿U¯!°6¦_ÀA¬5´t¤D¬6¯:¦T¨^¬5³u¯¤ {¬5³{¥[o {¬ ¿ ¦T¨R¦T¬5^¦t {¬ ½5 Á¿T¯Â³{¨o¦t¦T¬w¸{¤D¬V¦o¦T¨^¤D¬=¸ ©b`H6ÆñÙ ¹óÚÆ ©_Êñâó ¼4Ê9Ò¾cÌ%@n É^ x'©bÁ#'«c «y ¡`bZ©' bàqHÌ6'F©b`fÁ#'ù î_4 bHF`«õ H`
b4£ Oy_9º b|4; |bH`ÇI
· ¨R ^¦o¦o´u¤D¬=¸{©, j¿U¯!°6¦ µjº¡º¡º ½6¾u¢£@ {©o¤D²=¢Ã {¬ ½5¦o«²=¨^¤D¯¾ ³{¬5´ · T¨ ¤DÄu³A«¾ ©b`HÙÊ9Òu¹ ÙÙñ©Zài£iÙÚÚ Ê
¼4ÊÆS¾cÌj Ñ b9b
ËsOÁ¨'9)àjô^Ä+¹b |'V;D bU ' jJ6Uºbm|b|b%HH' 4I£
)9 |Hy V t bÇ · ¨R ^¦o¦R´{¤D¬w¸{©_ j¿U¯!°6¦,Å{¯!°xÆ_%Ç/o {¬ ¿ ¦T¨R¦T¬5^¦ {¬ ¡ {¢£#²=¯:¦T¨³u¬5´x^ u¢¢²=¬¤o³{¯¤ {¬©U©«¦o«²=¨^¤D¯¾ ©)`H Ù½ Æ ¹ ÙÒÒ ©ZÙÚÚÙ ¼4ÊHó¾YÉb6 Ñ m' qb Ñ bÁ | s`ô '|9 |p` H Z«Ë«øaI- %'UJH9 H È {²=¨^¬5³A¥[ Á¿½¾{©o¯:¦T¢,© ½5 Á¿T¯Â³{¨o¦ ©ZÊSÙ ÎX½ÏU¹|Êññ ¹ ÙÚâ©WÊHññÚ ¼4ÊâS¾ Ñ |b| Ñ -Z©+àiSÉt |b9©+Ä HsÉ^ |©)ä H j '¬ÌjS fF©`àq|Ãcî ; ØHHF©b` m|cùZÃOU îb fUä6`S;F¹«y' fS |j' H9 |qV O J fyD |bn'O'9;¡'|O4 |HHbÇ · ¨R ^¦o¦R´{¤D¬w¸{© Á¿,ÉAÊu¯!° Ë ½ ºÌµjÍ ½5¦R«²@¨^¤D¯¾ ¡ {¬1¿ ¦T¨o¦T¬#T¦ ©bÁ¨'|b iË Ñ © «''DÙÚÚÊ ¼4ÊHå¾%àËsH|9©=Îh Ëj9D- ©b`
à=c'O;b@6` 4;S O 9mH )U; |b_H9' 4 £+¹^àq'9Ob OH H;b'|Fá9)ù««jÄmáH)ñóÒñ½©FàiH£kÊHññó ¼4ÊHñ¾cËsqËs Ñ D; © Ñ ' |D 'b9yËsbZ©bÄb4 ài'H O OH© b
ð^|||jô HHOÃ|H Ñ `;9 9 |ØH|bm '_Ï HH' 4I£ b|bU;¡b||4 £||ÃH||b Fª`a t cJ'b9 |'HbÇI
· R¨ ^¦o¦o´u¤D¬=¸{©, j¿U¯!°6¦ µ ¬¯:¦T¨T¬#³{¯¤ {¬#³A¥¡ u¬ ¿ ¦T¨R¦T¬5^¦ {¬ ½5 Á¿T¯Â³{¨o¦Çs³{¤D¬6¯:¦T¬#³{¬5^¦xÐ µ [½=ÇxÑ ©)ÄH' H%¡)9yÙÚÚ½ ¼ ÙÚ¾Y«OiËj1s Ã+'ô^Ä Z¹^«~||m4
¡'O9'b9xJy Hj»`|HH`«|O¡'OcS Z¹ ÿÿ--s D OÃ9 ;H- Z ÿqOb`ÿSbZ
¼ Ù Ê9¾%àq|UbHZËjOØc`< H'kÄ ||'bÌ6øV -S c' HH |m' SHm9]bH|)
m O 5µjºº¡º ½5 Á¿T¯Â³{¨o¦ © ÊHÒ'ÎÆÏU¹ âÆ1¹åÊ©Êññâ
°6¦_1¥§¦R³{¬6¨j {¢Ó³^£e£#¨R ³A^°¯> x±«²6³{¥ ¤D¯¾ ©T j¿T¯Â³{¨R¦´w¦TÄ{¦«¥N T£#¢B¦T¬6¯ VbÁ||9£~¦ ÄbH©'Ç '|©+ÊññÙ ¼ Ù½¾cËsO
' ¡`¡b||OD |cm'9+aV -S Y'9aH9y' |9 |Z© ÙÚÚ ÊFÄ '¡bm4 nJjôWb¡'O|S |Z`«|O¡'OjV Z¹ ÿÿ--s 'HH ¿ h'X bÃ'ÿhb¬ f`ÿb)9 ;ÿJH Ã ;' 'H| jÇ ¡¡x + I
¼ ÙÆS¾cÐ6 f< xbîbH qbiài |ÐH|Xb«~U | O¿ bs V t %'9aH9y' |9 |qm H|HVµjº¡º¡ºzÒ ¨R³u¬6©T³e«¯¤ {¬© {¬ ½5 Á¿T¯Â³{¨o¦ º ¬=¸{¤!¬V¦o¦T¨T¤!¬=¸ ©+ÙÆ ÎÆÏU¹ óâ1Æ ¹óåñ ©ÊHñññ ¼ Ùó¾Yô ;mm|bmùZb`Hyá9 ;ä bZ ôWáyjù«ÐjäsÄ«y`|£ |yî';mUt ÃpÎXô+«6îWÏU Z¹ ÿÿ--s ' ObH 9 H )ÿ
¼ Ùâ¾sÁ¨ yÄ)bÌbm'' 9£ µ ¬¯¨R ´{²«¯¤ u¬a¯> B¯!°6¦Ø£¦T¨^©T {¬5³A¥ ©« Á¿T¯Â³{¨o¦Ø£6¨R ^¦T©o© )«6b |'¬XÁrH|9£
ùZ'fiôWb¡b||b|' Ñ '|©`ÇIb|©FÊññâ ¼ ÙåS¾sÁ¨ yÄ)bÌbm'' 9£ µ ¬¯¨R ´{²«¯¤ u¬a¯> B¯!°6¦_¯:¦R³{¢Ù©T j¿T¯Â³{¨R¦ £#¨R ^¦T©o© +«6''| ¬ÁrH|9£
ùZbfiù+;F|©)ÙÚÚÚ ¼ ÙñS¾cÇj¡-|ÊññÚ +«yÐsÄÇÿÇÁ¡§D;`';q| £qWa t HbO'H9 |b% 9 m|b|£ 'jÇ ¡' HH ¼ ½ÚS_ ¾ W Ob~ bp`
f66|SF`«~¿b 4; | m'H+ 'jHH 4 £| '|i HHy¡`Hq ;;Ã9y¡)Hb |Vµjº¡ººÚÒ ¨R³{¬©T³e«¯¤ {¬© u¬½5 j¿T¯Â³{¨R¦ º ¬w¸{¤D¬V¦o¦T¨^¤D¬=¸ ©)Ù½'Î=ÒÏU©)«y' |Êññâ ¼ ½ ÊU¾YÉ Á#6 sU b|b`qô_ '`ôO'9Û Ò °6¦ º ¥§¦T¢¦T¬¯© j¿ · ¨j o¸{¨R³{¢,¢¤D¬w¸½6¯¾{¥§¦ +àqä;-¬ÌO|=©)Ð9Î] Ã+©+ÊHñâÒ ¼ ½Ù¾Y j 9mHbHÃf`qËjx Wb|95Ü)¬X;bÃ|b'¹Wß|b D; |D |`|£ |- nHb 9x bj|mb9xD; | `4£'|'' º OfS |bH'Ç < · ¨R ^¦o¦o´u¤D¬=¸{©, j¿U¯!°6¦tÉAÊu¯!° Æج6¬6²³A¥ µ ¬6¯:¦T¨^¬5³{¯¤ {¬5³A¥Z½6¯>³{¯¤Æج5³A¥ ¾u©o¤D©U½¾{¢£@ {©o¤D²=¢ © b'cÙÚÚ½ ¼ ½½S¾cÇ qð|9 Øj b= ½5 Á¿T¯Â³{¨o¦sÝ=²@¥ ¬V¦T¨j³e¼«¤¥ ¤D¯¾Æج#³A¥ ¾u©^¤!© ôb b9OH©`ô ;''jß6'O9 4 £ ©'àiH£ÊHññå ¼ ½Ò¾sÁ|O|O2ùZ` =bß`'9HOb¡'|O4I£
WD; |cb4£ |H
Þ ¦T¯¯:¦T¨T©, {¬ · ¨R o¸{¨j³{¢¢,¤D¬=¸ Þ ³{¬=¸{²³ ¸w¦T©,³{¬#´½¾{©o¯:¦T¢,© ÊÎ=Ò ÏU¹ ½Ù½' ¹ ½½â©+ËjH9Hh¡)9sÊHññÙ
©
Æ_%Ç
¼ ½Æ¾YÉ`ùF4 OUt F©+Ä+'É^ ;à |H D©`Ð%'îb9 Z©'ô_)àq9O|© Ä+bô©`ËhÁr |6 © ''Ëj¡'F# © '`àqHËjU mV+©`` Ëh)ä6|OfbFbZSt; )9; |bZm Hx Hm'' 9-9H' 4 £ ¡ {¢£#²=¯:¦T¨_½5¦R«²@¨^¤D¯¾ ©+Ù ¹ Ù Ê^Ê ¹ ÙÙñ © Êññ½ ¼ ½óS ¾ Îtt n`àiO4£©`Ðj4º'|ùF=©#| É]|HfZ©'á|;à c H|;Z©b`
É]¡Ä Ã|¡b¡)btb6 9VS |¡)9ItHH aI-S c 9DxHS9;cb H|O¡'O|4 £ 'Ç ~ · ¨j ^¦^¦R´{¤!¬=¸{©_ j¿
¯!°6¦ µ ¬¯:¦T¨T¬#³{¯¤ {¬#³A¥%½6¾u¢£@ u©^¤!²@¢× {¬ ½# j¿T¯Â³{¨o¦ßئ«¥ ¤³e¼«¤¥ ¤D¯¾ º w¬ ¸{¤D¬V¦o¦T¨^¤D¬=¸Ð µ ½½@ß º Ñ ©bÐ6SH%¡)9jÊHññÒ
¼ ½â¾YtbYàq yÇ ` bD£qÄ aI- sáyH|O¡'O|4 £i« HOS O ÎàqÇÄ á«jÏU[Õ ²@¤´w¦«¥ ¤D¬V¦T©[¿1 {¨¯!°6¦ Ë ©«¦, Á¿¯!°6¦B Þ ³{¬=¸{²³ ¸w¦ ¤D¬9Ý6¦o°=¤1¥§¦Uàس{©«¦o´B½5 Á¿T¯Â³{¨o¦ ZÊññå ¼ ½åS¾_x`à
£ 9 Hb«~ HH|cO 9¬ H' ;ZbS;%Í` | | 'ibÇI· ¨R ^¦o¦R´{¤D¬=¸{©, j¿U¯!°6¦_áA¯!° Æ_%ÇÔ©o¾u¢£@ {©o¤D²=¢ {¬ · ¨^¤D¬5«¤ £5¥§¦T© j¿£#¨j o¸{¨R³{¢,¢¤D¬w¸x¥N³{¬w¸{²6³1¸w¦T©BÐ · Ö ·¡Þ Ñ © `S£ÊHñåÊ ¼ ½ñS¾Yô`6f
b Ñ Ñ Ã))«õ;º '%£fW' ;mm|' D £ |bÇI· ¨R ^¦o¦R´{¤D¬=¸{©, j¿U¯!°6¦ º ¤N¸'°=¯:¦o¦T¬6¯!°~Æج¬6²³A¥#Æ_%Ç ¡ {¢£#²=¯:¦T¨½5«¤¦T¬5^¦¡ {¬1¿ ¦T¨o¦T¬#^¦ ©)`HÙÒuÒ ¹ÙÒ â ©ÊññÚ ¼ ÒÚS¾Yô`6f
b Ñ Ñ Ã))«ø' ;mm|b%D £ | ;º '%£ ½¾{©o¯:¦T¢,©½5 j¿T¯Â³{¨R¦ ©ÊÆ Î=Ò ÏU¹ Ùåâ ¹ ½ÚÊ©WÊññ Ê ¼ Ò'ÊU¾_ 9xáy9 ¡)U 'bÄ m6m|H'HH Ob-¡) xO|'H- H''Ç ~ · ¨j ^¦^¦R´{¤!¬=¸{©, j¿U¯!°6¦â¯!° µjº¡ºº9µ ¬¯:¦T¨T¬#³{¯¤ {¬#³A¥ ½5 j¿T¯Â³{¨R¦Çd¦T¯¨^¤«©U½¾{¢£@ {©o¤D²=¢ãÐDÇ ºÒ ß µ [½aÉAÅeÅ=äoÑ © Ð6SH%¡)9jÊññâ ¼ Ò Ù¾%ä HÄU` H+biÉ^;'|9£<''Ár Fb«6 9 £f] à =U 6yhm9 |6aO J f |';bHbÇ
· j¨ T¦o¦R´{¤D¬w¸{©, j¿U¯!°6¦ Ì ¦TÂc½V¦R«²=¨^¤D¯¾ · ³{¨j³e´{¤§¸{¢,©~å< {¨oæu©j° ^£#® ¡ {¨oæu® µ ¨o¦«¥N³u¬5´ ©`Ä H Hh¡)UyÙÚÚÚ
¼ Ò½¾ Ñ YÄ) Ë%O©'Ëj'bm 6Ì% x|©bbiÄ 'HqðY Îh º ¬=¸{¤D¬5¦^¦T¨^¤D¬w¸BÇd¦T¯¨^¤«©³{¬#´tÇa ´e¦«¥ © `tb É]H¢mO`ÿ Ñ 'mmO' Ñ m` £ © Ç '|©+Êñåó
½5 j¿^¯ÂÛ³u¨o¦
¼ ÒÒ¾cß6m9iÄ`'ÃS©@sb`4-S5 © 9È) U£Ä)`îbD 9©b` ËsOÁ¨'9bË69 H9 |b%J fSyD O'nb|bU;¡b||4 |H x4 q £ )s¿ b|4»`9 H'Ç ~ · ¨j T¦o¦R´{¤D¬w¸{©, j¿U¯!°6¦tÉeÊu¯!° Ë ©1¦T¬¤ » ½V¦R«²=¨^¤D¯¾½6¾u¢£@ {©o¤D²=¢ © Á¨b|b F©`Ëh Ñ |©`«ybbDÙÚÚ Ê ¼ ÒÆS¾YÉb«Y`Ä 'H|Xbtbs'D£ U'|OHD b £_' ;mm|b Æ_%Çç¡ {¢£6²@¯¤!¬=¸½²=¨TÄ{¦T¾u©Ð^[½ Ë ßÛÑ ©Fʽ'ÎDÊÏU¹|ÊÚ Ê^¹`ÊÙÚ © Êñå Ê ¼ Òó¾_biðO9 # © ' 6)É]| ;Z©`_'£bZ s'b ©``iäjS£ àqSä;Hs)Ç xÄ Ò'¹«øD; |cb|b9;¡b||4 £'b9xa Ñ b Ñ ýsý#H bË6HHH%¡)9ÙÚÚÚ ¼ ÒâS¾Îj|;bHx6|s`fËsHx<'|9'ß6|bY ''`bbH|Ht »`b
9 H ½ µuÕ ½%Ö ¶Ò ½5 Á¿T¯Â³{¨o¦ º ¬=¸{¤!¬V¦o¦T¨T¤!¬=¸ Ì {¯:¦T© © ÙâÎXóÏU¹ Æ^Ê ¹óÚ ©ZÙÚÚÙ
