{'fraction_non_alphanumeric': 0.011502516175413372, 'fraction_numerical': 0.0, 'mean_word_length': 5.597156398104265, 'pattern_counts': {'":': 0, '<': 0, '<?xml version=': 0, '>': 0, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
A Quest for a Framework to Improve Software Security : Vulnerability Black Markets Scenario

The discovery and management of software vulnerabilities after a product is released to the public is an important element of improving software quality and stability. The discovery of vulnerabilities enables exploitation and stimulates the development of patches or other protections, which in turn may or may not be deployed by product users. Various approaches have been developed to facilitate discovery and reduce vulnerabilities, including mechanisms for secret reporting, full-disclosure, responsible disclosure, and market-driven approaches. Our research focuses on the development of vulnerability black market which emerged as Internet-enabled communication among malicious hackers as a means to sell exploits and malware that take advantage of software flaws. The model in this paper draws on empirical observation on black markets and theories of market-based activity to generate a dynamic simulation model of vulnerability black market structure and behavior over time The model results suggest that efficient legal markets may attract malicious hackers to enter the legal markets and may reduce their likelihood to be involved in vulnerability black markets. We also find that adopting better patching management on the vendor side may mitigate the abuse of software vulnerabilities.