Automatically Locating Mitigation Information for Security Vulnerabilities
Automatically Locating Mitigation Information for Security Vulnerabilities
复制标题
自动定位安全漏洞缓解信息
DOI：
--
复制
发表时间：
2020
期刊：
影响因子：
--
通讯作者：
Qinghua Li
中科院分区：
文献类型：
--
作者：
Kylie McClanahan;Qinghua Li
软件漏洞对系统构成重大安全风险。通常，补丁可以修复漏洞，但补丁并不总是可用的，并且在许多情况下，由于高开销和潜在的服务中断，补丁并不是首选，这对于电力行业尤其如此。然后，需要其他缓解策略来缓解安全漏洞。有关缓解策略的信息可能很难找到，通常只在供应商或第三方网站上报告。在目前的实践中，这种信息是由安全操作员手动定位的，这导致了很高的延迟和操作成本。我们认为这个问题在电力行业，这具有特殊的重要性和挑战，因为它的监管要求。我们建议为电力公司提供自动定位的缓解信息将有助于他们克服时间负担，更及时地缓解漏洞。特别是，我们开发了三种方法来自动检索缓解信息从供应商或第三方网站。实验结果表明，这三种方法都具有较高的性能。
Software vulnerabilities pose significant security risks to systems. Usually patching can fix vulnerabilities, but patches are not always available, and in many cases patching is not preferred due to high overhead and potential service interruptions which is especially true for the electric industry. Then, other mitigation strategies are needed to mitigate security vulnerabilities. Information about mitigation strategies can be difficult to find and is typically only reported on vendor or third-party websites. In the current practice, such information is manually located by security operators, which induces high delays and operation cost. We consider this problem within the electric industry, which has particular importance and challenges because of its regulatory requirements. We propose that providing electric utilities with automatically-located mitigation information will help them overcome the time burden and mitigate vulnerabilities more timely. In particular, we develop three methods for automatically retrieving mitigation information from vendor or third-party websites. Experiment results show high performance with all the three methods.
动态风险感知补丁调度
DOI：
10.1109/cns48642.2020.9162225
发表时间：
2020
期刊：
IEEE Conference on Communications and Network Security (CNS
影响因子：
--
作者：
Zhang, Fengli;Li, Qinghua
通讯作者：
Li, Qinghua
基于机器学习的自动漏洞修复分析方法
DOI：
10.1109/cns48642.2020.9162309
发表时间：
2020
期刊：
IEEE Conference on Communications and Network Security (CNS
影响因子：
--
作者：
Zhang, Fengli;Huff, Philip;McClanahan, Kylie;Li, Qinghua
通讯作者：
Li, Qinghua