Towards Automated Risk Analysis of "One-day" Vulnerabilities - Archive ouverte HAL Access content directly
Conference Papers Year :

Towards Automated Risk Analysis of "One-day" Vulnerabilities

(1) , (1) , (1)
1

Abstract

Common Vulnerabilities and Exposures (CVE) databases such as Mitre’s CVE List and NIST’s NVD database identify every disclosed vulnerability affecting any public software. However, during the early hours of a vulnerability disclosure, the metadata associated with these vulnerabilities is either missing, wrong, or at best sparse. This creates a challenge for robust automated analysis of new vulnerabilities. We present a new technique based on TF-IDF to map newly disclosed vulnerabilities to the most probably affected software products, formulated as an ordered list of relevant entries in the Common Platform Enumeration (CPE) database. For doing so we rely only on the human readable description of the vulnerability without any need for metadata.

Keywords

Fichier principal
Vignette du fichier
clement_elbaz_oneday_vulnerabilities_ressi2019_paper.pdf (100.07 Ko) Télécharger le fichier
Origin : Files produced by the author(s)
Loading...

Dates and versions

hal-02267192 , version 1 (19-08-2019)

Identifiers

  • HAL Id : hal-02267192 , version 1

Cite

Clément Elbaz, Louis Rilling, Christine Morin. Towards Automated Risk Analysis of "One-day" Vulnerabilities. RESSI 2019 - Rendez-vous de la Recherche et de l'Enseignement de la Sécurité des Systèmes d'Information, Aug 2019, Erquy, France. pp.1-3. ⟨hal-02267192⟩
147 View
182 Download

Share

Gmail Facebook Twitter LinkedIn More