A New Vulnerability Reporting Framework for Software Vulnerability Databases

Abstract

Cyber security is one of the fundamental research areas of software engineering. The systems that make up today's information systems infrastructure have been developed largely with software support. Security vulnerabilities in the software used in these systems may cause undesirable results. It is very important to manage software vulnerabilities correctly. In addition, an effective communication mechanism and certain standards should be established among those working in this field. The importance of the subject has been understood in recent years and the studies in this area have gradually increased. The use of machine learning algorithms is increasing in recent studies in this area. Although there is a large data set accumulated in vulnerability databases, there is often the problem of unstructured data. Vulnerability databases and security reports are created in natural language that people can understand and interpret. These reports are difficult to read and understand by machines. Our study focuses on the difficulties of this unstructured and natural language system. In order to investigate this problem, firstly, up-to-date and accessible databases used in scientific research were examined and evaluated. Then, a three-stage security framework was proposed, consisting of the use of vulnerabilities by machines to assist experts from the notification stage to the reporting stage. The rules and flow charts of each stage are defined. In order to increase the usability of different databases in their own systems, the framework rules are defined as a guideline containing flexible directions, not rigid items. The point of consideration is not the methods and tools used, but the definition of outputs as common and similar attributes.

Detection of Unknown Insider Attack on Components of Big Data System: A Smart System Application for Big Data Cluster

“…The vulnerability framework proposed in [26] can't detect the vulnerable big data applications submitted by the users of the big data cluster. It needs for new approaches to detect the flaws by processing these vulnerable big data apps and its logs.…”

Risk Forecasting of Data Confidentiality Breach Using Linear Regression Algorithm

“…Various proposed "ontological techniques" are considered, as well as comprehensive analysis of various models to ensure the safety of the cloud environment [4][5][6][7]. Much work has been done to identify and analyze software vulnerabilities, methods for reporting and classifying software security vulnerabilities [8][9][10][11][12]. Specific features of information protection focus on existing methods of localization of anomalies and current hazards in networks, statistical methods are considered as effective methods of detecting anomalies and experimental detection of the chosen method, methods of capturing and analyzing network traffic during passive monitoring of network segment [13][14][15][16][17][18].…”

Estimating Missing Security Vectors in NVD Database Security Reports

“…The main task of NVD staff is to analyze the vulnerability lists published in the CVE dictionary. At this stage, they use all the additional data they can collect the explanations and references found in the CVE [20,21]. As a basis for the data published in the NVD database, associated impact metrics (Common Vulnerability Scoring System -CVSS), vulnerability types (Common Vulnerability Enumeration -CWE), applicability statements (Common Platform Enumeration -CPE) and other relevant metadata are added.…”