Quantifying Cross-Release Vulnerability Discovery in Software: A Multi-Release Modeling Approach

Software Vulnerability Discovery Models (VDMs) help understand how security flaws are identified in software after release. Traditionally, most models focus on a single release and assume vulnerabilities are discovered independently. However, modern software often exists in multiple versions that share a significant portion of code. This shared structure means that discovering a vulnerability in one version can also help identify similar issues in other versions: a phenomenon referred to as cross-discovery. In this paper, the author extends the traditional VDM framework to model multiple software releases simultaneously, enabling interaction between versions via cross-discovery. Unlike existing multi-release models that use constant values for shared-code influence, the author proposes a new model that introduces time-dependent cross-discovery coefficients. These functions reflect how the influence between software versions changes over time, making the model more realistic. The author applies the proposed model to real-world data from two popular Windows operating system versions, Windows XP and Windows Vista. The proposed model accurately captures both within-release discoveries and those triggered by interaction with the other version. The author estimates parameters, validates results using statistical measures, and visualizes predicted and actual trends. The results show that the proposed approach provides deeper insights into how vulnerabilities are found across multiple software releases, supporting better software maintenance and security planning.