Toward a Multidimensional Analysis of the National Vulnerability Database
Toward a Multidimensional Analysis of the National Vulnerability Database
复制标题
DOI：
10.1109/access.2023.3309850
复制
发表时间：
2023
期刊：
影响因子：
3.9
通讯作者：
Rishabh Singla;N. Reddy;R. Bettati;Hussein Alnuweiri
中科院分区：
文献类型：
--
作者：
Rishabh Singla;N. Reddy;R. Bettati;Hussein Alnuweiri
自带设备政策、物联网(IoT)设备和智能家电都在推动互联设备的日益多样化。了解这些不同设备(以及传统计算设备)的漏洞以适当保护其使用已成为当务之急。在本文中，我们对国家标准与技术研究所(NIST)国家漏洞数据库(NVD)中各种硬件和软件制品报告的漏洞进行了详细的分析。我们分析了2011-2022年期间漏洞的详细信息。我们将漏洞大致分为三个产品类别：网络、物联网和计算设备。数据进一步分为应用程序、操作系统(OS)和硬件领域。我们在四个非重叠的3年时间段内分析上述类别的数据。该分析提供了对各种产品以及随时间推移的漏洞的显著趋势的洞察。我们的工作基于从分析数据中观察到的趋势和持续性，提出了有趣的发现。我们的研究指出了一些见解，这些见解可能会改善资源分配，以解决安全问题。
Bring-your-own-device policies, Internet of Things (IoT) devices, and smart appliances are all contributing to the increasing diversity of connected devices. It has become imperative to understand the vulnerabilities of these diverse devices (along with traditional compute devices) to appropriately secure their use. In this paper, we conduct a detailed analysis of the vulnerabilities reported for the various hardware and software artifacts in the National Institute of Standards and Technology (NIST) National Vulnerability Database (NVD). We analyze the details of vulnerabilities covering the period 2011-2022. We broadly categorize the vulnerabilities into three product categories: networking, IoT, and computing devices. The data is further classified into application, Operating System (OS), and hardware domains.We analyze the data across the aforementioned categories over four non-overlapping 3-year time periods. The analysis provides insights into salient trends in vulnerabilities across diverse products, and over time. Our work presents interesting findings based on the trends and persistence observed from the analyzed data. Our study points to insights that could lead to improved resource allocation for addressing security concerns.