TU Darmstadt / ULB / TUbiblio

A Vulnerability's Lifetime: Enhancing Version Information in CVE Databases

Glanz, Leonid and Schmidt, Sebastian and Wollny, Sebastian and Hermann, Ben :
A Vulnerability's Lifetime: Enhancing Version Information in CVE Databases.
[Online-Edition: http://doi.acm.org/10.1145/2809563.2809612]
In: Proceedings of the 15th International Conference on Knowledge Technologies and Data-driven Business, New York, NY, USA. In: i-KNOW '15 . ACM , New York, NY, USA
[Conference or Workshop Item] , (2015)

Official URL: http://doi.acm.org/10.1145/2809563.2809612

Abstract

The National Vulnerability Database (NVD) is a rich source of information for system administrators, software engineers, IT security consultants, and researchers in software security. Relevant information is provided in machine readable form and hence can be used for automated software security management. However, we discovered that information on affected software versions and fix information is not always available in structured form. We therefore propose to enrich the NVD database with this information and use a rule-based approach to extract this information from the informal vulnerability description. Such information is useful in software development to exchange or avoid vulnerable components as well as in security research for directed cause analysis.

Item Type: Conference or Workshop Item
Erschienen: 2015
Creators: Glanz, Leonid and Schmidt, Sebastian and Wollny, Sebastian and Hermann, Ben
Title: A Vulnerability's Lifetime: Enhancing Version Information in CVE Databases
Language: English
Abstract:

The National Vulnerability Database (NVD) is a rich source of information for system administrators, software engineers, IT security consultants, and researchers in software security. Relevant information is provided in machine readable form and hence can be used for automated software security management. However, we discovered that information on affected software versions and fix information is not always available in structured form. We therefore propose to enrich the NVD database with this information and use a rule-based approach to extract this information from the informal vulnerability description. Such information is useful in software development to exchange or avoid vulnerable components as well as in security research for directed cause analysis.

Series Name: i-KNOW '15
Place of Publication: New York, NY, USA
Publisher: ACM
Uncontrolled Keywords: information extraction, knowledge discovery, vulnerabilities
Divisions: 18 Department of Electrical Engineering and Information Technology
18 Department of Electrical Engineering and Information Technology > Institute of Computer Engineering
18 Department of Electrical Engineering and Information Technology > Institute of Computer Engineering > Multimedia Communications
Department of Computer Science
Department of Computer Science > Software Technology
Event Title: Proceedings of the 15th International Conference on Knowledge Technologies and Data-driven Business
Event Location: New York, NY, USA
Date Deposited: 23 Nov 2015 15:09
Official URL: http://doi.acm.org/10.1145/2809563.2809612
Export:

Optionen (nur für Redakteure)

View Item View Item