{"created":"2025-01-19T01:46:32.089612+00:00","updated":"2025-01-19T07:33:36.825520+00:00","metadata":{"_oai":{"id":"oai:ipsj.ixsq.nii.ac.jp:00241746","sets":["581:11492:11505"]},"path":["11505"],"owner":"44499","recid":"241746","title":["Proposal of Open Source Software Security Risk Indicator Based on Vulnerability Management Interview"],"pubdate":{"attribute_name":"公開日","attribute_value":"2024-12-15"},"_buckets":{"deposit":"e4e3f252-105b-467b-bea7-a3095670456a"},"_deposit":{"id":"241746","pid":{"type":"depid","value":"241746","revision_id":0},"owners":[44499],"status":"published","created_by":44499},"item_title":"Proposal of Open Source Software Security Risk Indicator Based on Vulnerability Management Interview","author_link":["666037","666038","666039","666042","666041","666043","666040","666044","666046","666045"],"item_titles":{"attribute_name":"タイトル","attribute_value_mlt":[{"subitem_title":"Proposal of Open Source Software Security Risk Indicator Based on Vulnerability Management Interview"},{"subitem_title":"Proposal of Open Source Software Security Risk Indicator Based on Vulnerability Management Interview","subitem_title_language":"en"}]},"item_keyword":{"attribute_name":"キーワード","attribute_value_mlt":[{"subitem_subject":"[特集:社会的・倫理的なオンライン活動を支援するセキュリティとトラスト] vulnerability risk, open source software, software security","subitem_subject_scheme":"Other"}]},"item_type_id":"2","publish_date":"2024-12-15","item_2_text_3":{"attribute_name":"著者所属","attribute_value_mlt":[{"subitem_text_value":"Graduate School of Engineering, Kobe University"},{"subitem_text_value":"Intelligent Systems Laboratory, SECOM CO., LTD."},{"subitem_text_value":"SIOS Technology, Inc."},{"subitem_text_value":"Faculty for Electrical Engineering, Mathematics and Computer Science, University of Twente"},{"subitem_text_value":"Faculty of Environmental, Life, Natural Science and Technology, Okayama University"}]},"item_2_text_4":{"attribute_name":"著者所属(英)","attribute_value_mlt":[{"subitem_text_value":"Graduate School of Engineering, Kobe University","subitem_text_language":"en"},{"subitem_text_value":"Intelligent Systems Laboratory, SECOM CO., LTD.","subitem_text_language":"en"},{"subitem_text_value":"SIOS Technology, Inc.","subitem_text_language":"en"},{"subitem_text_value":"Faculty for Electrical Engineering, Mathematics and Computer Science, University of Twente","subitem_text_language":"en"},{"subitem_text_value":"Faculty of Environmental, Life, Natural Science and Technology, Okayama University","subitem_text_language":"en"}]},"item_language":{"attribute_name":"言語","attribute_value_mlt":[{"subitem_language":"eng"}]},"publish_status":"0","weko_shared_id":-1,"item_file_price":{"attribute_name":"Billing file","attribute_type":"file","attribute_value_mlt":[{"url":{"url":"https://ipsj.ixsq.nii.ac.jp/record/241746/files/IPSJ-JNL6512006.pdf","label":"IPSJ-JNL6512006.pdf"},"date":[{"dateType":"Available","dateValue":"2026-12-15"}],"format":"application/pdf","billing":["billing_file"],"filename":"IPSJ-JNL6512006.pdf","filesize":[{"value":"1.1 MB"}],"mimetype":"application/pdf","priceinfo":[{"tax":["include_tax"],"price":"0","billingrole":"5"},{"tax":["include_tax"],"price":"0","billingrole":"6"},{"tax":["include_tax"],"price":"0","billingrole":"8"},{"tax":["include_tax"],"price":"0","billingrole":"44"}],"accessrole":"open_date","version_id":"b70038f2-f163-40e9-8f03-b39be43f7f81","displaytype":"detail","licensetype":"license_note","license_note":"Copyright (c) 2024 by the Information Processing Society of Japan"}]},"item_2_creator_5":{"attribute_name":"著者名","attribute_type":"creator","attribute_value_mlt":[{"creatorNames":[{"creatorName":"Hiroki, Kuzuno"}],"nameIdentifiers":[{}]},{"creatorNames":[{"creatorName":"Tomohiko, Yano"}],"nameIdentifiers":[{}]},{"creatorNames":[{"creatorName":"Kazuki, Omo"}],"nameIdentifiers":[{}]},{"creatorNames":[{"creatorName":"Jeroen, van der Ham"}],"nameIdentifiers":[{}]},{"creatorNames":[{"creatorName":"Toshihiro, Yamauchi"}],"nameIdentifiers":[{}]}]},"item_2_creator_6":{"attribute_name":"著者名(英)","attribute_type":"creator","attribute_value_mlt":[{"creatorNames":[{"creatorName":"Hiroki, Kuzuno","creatorNameLang":"en"}],"nameIdentifiers":[{}]},{"creatorNames":[{"creatorName":"Tomohiko, Yano","creatorNameLang":"en"}],"nameIdentifiers":[{}]},{"creatorNames":[{"creatorName":"Kazuki, Omo","creatorNameLang":"en"}],"nameIdentifiers":[{}]},{"creatorNames":[{"creatorName":"Jeroen, van der Ham","creatorNameLang":"en"}],"nameIdentifiers":[{}]},{"creatorNames":[{"creatorName":"Toshihiro, Yamauchi","creatorNameLang":"en"}],"nameIdentifiers":[{}]}]},"item_2_source_id_9":{"attribute_name":"書誌レコードID","attribute_value_mlt":[{"subitem_source_identifier":"AN00116647","subitem_source_identifier_type":"NCID"}]},"item_resource_type":{"attribute_name":"資源タイプ","attribute_value_mlt":[{"resourceuri":"http://purl.org/coar/resource_type/c_6501","resourcetype":"journal article"}]},"item_2_publisher_15":{"attribute_name":"公開者","attribute_value_mlt":[{"subitem_publisher":"情報処理学会","subitem_publisher_language":"ja"}]},"item_2_source_id_11":{"attribute_name":"ISSN","attribute_value_mlt":[{"subitem_source_identifier":"1882-7764","subitem_source_identifier_type":"ISSN"}]},"item_2_description_7":{"attribute_name":"論文抄録","attribute_value_mlt":[{"subitem_description":"Open source software (OSS) has gained significant prominence in recent years. The security of OSS is a vital concern within information systems relying on OSS. When vulnerabilities are identified in OSS projects, previous security research has suggested approaches such as vulnerability classification, risk estimation, and exploitability analysis. Evaluating whether these vulnerabilities and the associated risks in the OSS development process pose security threats remains a complex challenge. In this study, through an interview survey on existing vulnerability management, we have determined the need for ongoing and automated countermeasures against attacks by comprehending OSS security risks based on the survey findings. We then evaluated the effectiveness of these countermeasures and proposed a security risk indicator for OSS to address these issues. The proposed method measures OSS security risk indicators by integrating vulnerability information with the development status of OSS. The suggested security risk indicator for OSS serves as a benchmark for security measures in the operation of information systems. In our evaluation, we evaluated the effectiveness of the proposed OSS security risk indicator in identifying threats from multiple OSS and assessed the computational cost associated with calculating OSS security risk indicators.\n------------------------------\nThis is a preprint of an article intended for publication Journal of\nInformation Processing(JIP). This preprint should not be cited. This\narticle should be cited as: Journal of Information Processing Vol.32(2024) (online)\nDOI　http://dx.doi.org/10.2197/ipsjjip.32.1090\n------------------------------","subitem_description_type":"Other"}]},"item_2_description_8":{"attribute_name":"論文抄録(英)","attribute_value_mlt":[{"subitem_description":"Open source software (OSS) has gained significant prominence in recent years. The security of OSS is a vital concern within information systems relying on OSS. When vulnerabilities are identified in OSS projects, previous security research has suggested approaches such as vulnerability classification, risk estimation, and exploitability analysis. Evaluating whether these vulnerabilities and the associated risks in the OSS development process pose security threats remains a complex challenge. In this study, through an interview survey on existing vulnerability management, we have determined the need for ongoing and automated countermeasures against attacks by comprehending OSS security risks based on the survey findings. We then evaluated the effectiveness of these countermeasures and proposed a security risk indicator for OSS to address these issues. The proposed method measures OSS security risk indicators by integrating vulnerability information with the development status of OSS. The suggested security risk indicator for OSS serves as a benchmark for security measures in the operation of information systems. In our evaluation, we evaluated the effectiveness of the proposed OSS security risk indicator in identifying threats from multiple OSS and assessed the computational cost associated with calculating OSS security risk indicators.\n------------------------------\nThis is a preprint of an article intended for publication Journal of\nInformation Processing(JIP). This preprint should not be cited. This\narticle should be cited as: Journal of Information Processing Vol.32(2024) (online)\nDOI　http://dx.doi.org/10.2197/ipsjjip.32.1090\n------------------------------","subitem_description_type":"Other"}]},"item_2_biblio_info_10":{"attribute_name":"書誌情報","attribute_value_mlt":[{"bibliographic_titles":[{"bibliographic_title":"情報処理学会論文誌"}],"bibliographicIssueDates":{"bibliographicIssueDate":"2024-12-15","bibliographicIssueDateType":"Issued"},"bibliographicIssueNumber":"12","bibliographicVolumeNumber":"65"}]},"relation_version_is_last":true,"weko_creator_id":"44499"},"id":241746,"links":{}}