Refining Traceability Links Between Vulnerability and Software Component in a Vulnerability Knowledge Graph

Du, Dongdong; Ren, Xingzhang; Yupeng, Wu; Chen, Jien; Wei, Ye; Sun, Jinan; Xi, Xiangyu; Qing, Gao; Zhang, Shikun

doi:10.1007/978-3-319-91662-0_3

Cited by 13 publications

(6 citation statements)

References 12 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…For searching specific vulnerabilities or weaknesses from software repositories, simple keyword searches based on CVE and CWE identifiers seem more robust. These commonly used [4,13,31] domain-specific searches could be augmented by the information retrieval techniques [5], however. In other words: it might be possible to prefer the regular expression searches as a primary retrieval technique and use the information retrieval techniques as a secondary method for retrieving additional content not captured by the keyword-based searches.…”

Section: Discussionmentioning

confidence: 99%

“…1), web crawling could be used to gather a truly massive dataset for text mining. Recent work [4] shows also some promise for web crawling approaches. But the larger the datasets, the coarser the mappings, and the bigger the validity concerns.…”

Section: Discussionmentioning

confidence: 99%

“…As is typical in vulnerability tracking [4,21,30], the Snyk database contains first-order and (online) second-order relations. As illustrated in Fig.…”

Section: Data Sourcesmentioning

confidence: 99%

“…A typical way to tackle the issue is to compare text mining results against labels made by human experts [3]. The same applies in the vulnerability context [4,27]. However, the approach adopted takes a different path: the text mining results are compared against simple but relatively robust regular expression searches.…”

Section: Estimation Subsetmentioning

confidence: 99%

See 3 more Smart Citations

Toward Validation of Textual Information Retrieval Techniques for Software Weaknesses

Ruohonen

Leppänen

2018

Communications in Computer and Information Science

View full text Add to dashboard Cite

This paper presents a preliminary validation of common textual information retrieval techniques for mapping unstructured software vulnerability information to distinct software weaknesses. The validation is carried out with a dataset compiled from four software repositories tracked in the Snyk vulnerability database. According to the results, the information retrieval techniques used perform unsatisfactorily compared to regular expression searches. Although the results vary from a repository to another, the preliminary validation presented indicates that explicit referencing of vulnerability and weakness identifiers is preferable for concrete vulnerability tracking. Such referencing allows the use of keyword-based searches, which currently seem to yield more consistent results compared to information retrieval techniques. Further validation work is required for improving the precision of the techniques, however.

show abstract

Section: Discussionmentioning

confidence: 99%

Section: Discussionmentioning

confidence: 99%

“…As is typical in vulnerability tracking [4,21,30], the Snyk database contains first-order and (online) second-order relations. As illustrated in Fig.…”

Section: Data Sourcesmentioning

confidence: 99%

Section: Estimation Subsetmentioning

confidence: 99%

See 2 more Smart Citations

Toward Validation of Textual Information Retrieval Techniques for Software Weaknesses

Ruohonen

Leppänen

2018

Communications in Computer and Information Science

View full text Add to dashboard Cite

show abstract

“…Just as we are concerned with the vulnerability domain, Syed conceptualized an ontological representation that integrates social media intelligence with official information for the purpose of vulnerability management [13]. Du et al developed a software vulnerability ontology to keep track of links between vulnerabilities and software components, applying two ontology matching techniques [14].…”

Section: Security Domain-specific Kgsmentioning

confidence: 99%