Towards a Theory of Software Diversity for Security By

Although many have recognized that software monocultures are a major impediment to improving security, it is currently unclear how much and what kind of diversity is needed to counteract this problem. This thesis provides a framework for investigating software diversity in the context of security. We propose a simple model of a software ecosystem using sets of hosts and vulnerabilities represented as a bipartite graph, and we exhibit a few examples of software security problems formulated precisely enough in this model to admit rigorous analysis. We propose software diversity metrics using entropy, illustrate a calculation using real world data, and analyse six popular defence techniques for their effect on inhibiting large scale attacks. We then employ game theory to understand why computer host owners would choose to diversify and propose a slight variation of the popular security game Capture the Flag to determine users ’ underlying utility functions. ii Acknowledgement