An Ontology for Vulnerability Lifecycle

Wita, Ratsameetip; Jiamnapanon, Nattanatch; Teng-amnuay, Yunyong

doi:10.1109/iitsi.2010.141

Cited by 12 publications

(4 citation statements)

References 8 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…One study created a vulnerability management ontology that ranks attacks by security knowledge repositories [18]. Another study defined a framework to prioritize vulnerabilities [19]. Several studies have focused on mining methods and information retrieval for a security knowledge repository [20], [21], [22], [23], [24].…”

Section: Related Workmentioning

confidence: 99%

Tracing CAPEC Attack Patterns from CVE Vulnerability Information using Natural Language Processing Technique

Kanakogi¹,

Washizaki²,

Fukazawa³

et al. 2021

Proceedings of the Annual Hawaii International Conference on System Sciences

View full text Add to dashboard Cite

To effectively respond to vulnerabilities, information must not only be collected efficiently and quickly but also the vulnerability and the attack techniques must be understood. A security knowledge repository can collect such information. The Common Vulnerabilities and Exposures (CVE) provides known vulnerabilities of products, while the Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit known weaknesses. Because the information in these two repositories is not directly related, identifying the related CAPEC attack information from the CVE vulnerability information is challenging. One proposed method traces some related CAPEC-ID from CVE-ID through Common Weakness Enumeration (CWE). However, it is not applicable to all patterns. Here, we propose a method to automatically trace the related CAPEC-IDs from CVE-ID using TF-IDF and Doc2Vec. Additionally, we experimentally confirm that TF-IDF is more accurate than Doc2vec.

show abstract

Section: Related Workmentioning

confidence: 99%

Tracing CAPEC Attack Patterns from CVE Vulnerability Information using Natural Language Processing Technique

Kanakogi¹,

Washizaki²,

Fukazawa³

et al. 2021

Proceedings of the Annual Hawaii International Conference on System Sciences

View full text Add to dashboard Cite

show abstract

“…With the publication of CWE, new CVE entries are manually tagged with corresponding CWE concepts in National Vulnerability Database (NVD) (NIST, 2012). Connecting vulnerability databases with the CWE has numerous advantages as it provides a meaningful classification scheme that enables collection and reporting of security metrics for vulnerability distribution and trend analysis, and prioritization (Christey & Martin, 2007;Christey, 2007;Chang et al, 2011;Wita et al, 2010).…”

Section: Vulnerability Classification and Categorizationmentioning

confidence: 99%

Semi-Automatic Annotation of Natural Language Vulnerability Reports

Gandhi

Siy

2013

International Journal of Secure Software Engineering

View full text Add to dashboard Cite

Those who do not learn from past vulnerabilities are bound to repeat it. Consequently, there have been several research efforts to enumerate and categorize software weaknesses that lead to vulnerabilities. The Common Weakness Enumeration (CWE) is a community developed dictionary of software weakness types and their relationships, designed to consolidate these efforts. Yet, aggregating and classifying natural language vulnerability reports with respect to weakness standards is currently a painstaking manual effort. In this paper, the authors present a semi-automated process for annotating vulnerability information with semantic concepts that are traceable to CWE identifiers. The authors present an information-processing pipeline to parse natural language vulnerability reports. The resulting terms are used for learning the syntactic cues in these reports that are indicators for corresponding standard weakness definitions. Finally, the results of multiple machine learning algorithms are compared individually as well as collectively to semi-automatically annotate new vulnerability reports.

show abstract

“…On the other hand, it is not easy to detect and fix unknown security problems systematically. Activities to test the security of information systems often rely heavily on knowledge and experience of professionals involved in these activities [1][2][3][4][5][6][7].…”

Section: Introductionmentioning

confidence: 99%

A Survey of Security Assessment Ontologies

Rosa¹,

Jino²

2017

Advances in Intelligent Systems and Computing

View full text Add to dashboard Cite

Abstract.A literature survey on ontologies concerning the Security Assessment domain has been carried out to uncover initiatives that aim at formalizing concepts from the "Security Assessment" field of research. A preliminary analysis and a discussion on the selected works are presented. Our main contribution is an updated literature review, describing key characteristics, results, research issues, and application domains of the papers. We have also detected gaps in the Security Assessment literature that could be the subject of further studies in the field. This work is meant to be useful for security researchers who wish to adopt a formal approach in their methods.

show abstract

An Ontology for Vulnerability Lifecycle

Cited by 12 publications

References 8 publications

Tracing CAPEC Attack Patterns from CVE Vulnerability Information using Natural Language Processing Technique

Tracing CAPEC Attack Patterns from CVE Vulnerability Information using Natural Language Processing Technique

Semi-Automatic Annotation of Natural Language Vulnerability Reports

A Survey of Security Assessment Ontologies

Contact Info

Product

Resources

About