Cleaning the NVD: Comprehensive Quality Assessment, Improvements, and Analyses

Abstract

Vulnerability databases are vital sources of information on emergent software security concerns. Security professionals, from system administrators to developers to researchers, heavily depend on these databases to track vulnerabilities and analyze security trends. How reliable and accurate are these databases though?In this paper, we explore this question with the National Vulnerability Database (NVD), the U.S. government's repository of vulnerability information that arguably serves as the industry standard. Through a systematic investigation, we uncover inconsistent or incomplete data in the NVD that can impact its practical uses, affecting information such as the vulnerability publication dates, names of vendors and products affected, vulnerability severity scores, and vulnerability type categorizations. We explore the extent of these discrepancies and identify methods for automated corrections. Finally, we demonstrate the impact that these data issues can pose by comparing analyses using the original and our rectified versions of the NVD. Ultimately, our investigation of the NVD not only produces an improved source of vulnerability information, but also provides important insights and guidance for the security community on the curation and use of such data sources.

A Survey on Data-driven Software Vulnerability Assessment and Prioritization

“…Note that this database has been discontinued since 2016. 6 https://twitter.com 7 https://avast.com/exploit-protection.php. This link was provided by de Sousa et al [41], but it is no longer available.…”

“…For CVSS version 3 [57,58], Chen et al [29,30] and Anwar et al [6] also reported the strong performance of DL-based models (e.g., CNN and graph convolutional neural network [95]). Some other studies did not directly predict severity score from SV descriptions, instead they aggregated the predicted values of the CVSS Exploitability (see section 3) and Impact metrics (see section 4) using the formulas of CVSS version 2 [50,86,171,193], version 3 [50,86,139] and WIVSS [171].…”

“…Thirdly, external sources on NVD/CVE have enabled many studies to obtain richer SV information (e.g., exploitation availability/time [30] or vulnerable code/crashes [181,201]) and extract relationships among multiple SV sources to develop a knowledge graph of SVs (e.g., [72,199]). Despite all the aforementioned advantages, NVD/CVE still suffer from information inconsistencies [6,45] and a poor coverage of relevant external sources (e.g., SV fixing code) [76].…”

Data Preparation for Software Vulnerability Prediction: A Systematic Literature Review

“…Jimenez et al [P12] found that only 75% of vulnerability reports had an associated fix. Vulnerability reports are often incomplete and missing references [9].…”

“…Unfortunately, SV data preparation is not a trivial task [7]. High-quality SV data is notoriously difficult to obtain due to its natural infrequency [8], inconsistent reporting [9], and the unwillingness of organisations to make their sensitive data public [10]. It is widely recognized that data noise can severely impact the quality of an SVP model and eventually negatively impact the validity of the research outcomes [11], [12].…”