Exploring the Relationship Between Architecture Coupling and Software Vulnerabilities

Robert  Lagerstrom; Carliss Y. Baldwin; Alan   MacCormack; Daniel  J. Sturtevant; Lee  Doolan

Other Article | Proceedings of the International Symposium on Engineering Secure Software and Systems (ESSoS)

Exploring the Relationship Between Architecture Coupling and Software Vulnerabilities

by Robert Lagerstrom, Carliss Y. Baldwin, Alan MacCormack, Daniel J. Sturtevant and Lee Doolan

Abstract

Employing software metrics, such as size and complexity, for predicting defects has been given a lot of attention over the years and proven very useful. However, the few studies looking at software architecture and vulnerabilities are limited in scope and findings. We explore the relationship between software vulnerabilities and component metrics (like code churn and cyclomatic complexity), as well as architecture coupling metrics (direct, indirect, and cyclic coupling). Our case is based on the Google Chromium project, an open source project that has not been studied for this topic yet. Our findings show a strong relationship between vulnerabilities and both component level metrics and architecture coupling metrics. 68% of the files associated with a vulnerability are cyclically coupled, compared to 43% of the non-vulnerable files. Our best regression model is a combination of low commenting, high code churn, high direct fan-out within the main cyclic group, and high direct fan-in outside of the main cyclic group.

Keywords: Security vulnerabilities; Software architecture; metrics; Software; Complexity; Measurement and Metrics;

Format: Print

Find at Harvard Read Now

Citation:

Lagerstrom, Robert, Carliss Y. Baldwin, Alan MacCormack, Daniel J. Sturtevant, and Lee Doolan. "Exploring the Relationship Between Architecture Coupling and Software Vulnerabilities." Proceedings of the International Symposium on Engineering Secure Software and Systems (ESSoS) 9th (2017): 53–69. (Part of Lecture Notes in Computer Science, ISSN 0302-9743.)

This multimedia supplement accompanies the case “Innovation at Uber: the Launch of Express POOL” (case no. 619-003). Set in March 2018, the case follows ride-sharing company Uber as it develops and launches a new product called Express POOL. This multimedia supplement features a 10-minute Q&A session with Uber data science managers Duncan Gilchrist and Eoin O’Mahony as they field questions posed by students pertaining to the case.

In March 2013, Apple Computer has a very large cash balance, and is under pressure to return cash to shareholders. Hedge fund manager David Einhorn thinks Apple can "unlock value" by issuing perpetual preferred stock, dubbed iPrefs. Henry Blodget, CEO of Business Insider, disagrees, saying "you can't just wave your magic wand and make something of nothing." This short case is designed to support a discussion of "perfect" markets and the Modigliani-Miller capital structure irrelevance propositions. The case focuses on two questions: (1) From a shareholder's perspective, how is Apple's cash different from cash in a bank or money market account? (2) Can Apple create significant value for shareholders by splitting each common share into an iPref plus a common share?

The purpose of this chapter is to investigate the means by which firms capture value in open platform systems. I begin by arguing that the surplus value created by complementarities within a technical system will be split among the owners of the unique and essential components—the strategic bottlenecks in the system. However, most platforms must also execute a series of steps that are subject to “flow production” bottlenecks. Finding and fixing these flow bottlenecks is another way to capture value. In addition, two types of platform improvements provide further opportunities for value capture. “Accelerators” speed up the processing of options, while “subsidiary” platforms increase the range of options available to users. Finally, members of a platform system or new entrants may seek to supplant the owner of a strategic bottleneck by “disintermediating” platform components. I describe four generic methods of disintermediation: substitution, reverse engineering, platform independent complements, and platform envelopment.

Faculty & Research

Exploring the Relationship Between Architecture Coupling and Software Vulnerabilities

Abstract

Citation:

About the Authors

More from these Authors