A Recommender System for Tracking Vulnerabilities
A Recommender System for Tracking Vulnerabilities
复制标题
DOI：
10.1145/3465481.3470039
复制
发表时间：
2021-08
期刊：
影响因子：
--
通讯作者：
P. Huff;Kylie McClanahan;Thao Le;Qinghua Li
中科院分区：
文献类型：
--
作者：
P. Huff;Kylie McClanahan;Thao Le;Qinghua Li
减轻软件中的漏洞需要首先用组织的软件资产识别漏洞。这个看似微不足道的任务涉及维护来自无数软件发布者、编码项目和第三方包管理器的硬件和软件包的拼凑的供应商产品漏洞通知。另一方面，软件漏洞数据库通常以干净、标准的格式一致地报告和分类，并整齐地与通用软件产品枚举器（即CPE）联系在一起。目前，对于组织的网络安全分析师来说，将他们的硬件和软件包库存匹配到目标cpe是一项繁重的工作。这阻碍了组织获取新漏洞的通知和识别可应用的漏洞。在本文中，我们提出了一个推荐系统来自动识别软件名称的最小候选cpe集，以提高漏洞识别和警报的准确性。推荐系统使用自然语言处理、模糊匹配和机器学习的管道，大大减少了软件产品漏洞匹配所需的人力。
Mitigating vulnerabilities in software requires first identifying the vulnerabilities with an organization’s software assets. This seemingly trivial task involves maintaining vendor product vulnerability notification for a kludge of hardware and software packages from innumerable software publishers, coding projects, and third-party package managers. On the other hand, software vulnerability databases are often consistently reported and categorized in clean, standard formats and neatly tied to a common software product enumerator (i.e., CPE). Currently it is a heavy workload for cybersecurity analysts at organizations to match their hardware and software package inventory to target CPEs. This hinders organizations from getting notifications for new vulnerabilities, and identifying applicable vulnerabilities. In this paper, we present a recommender system to automatically identify a minimal candidate set of CPEs for software names to improve vulnerability identification and alerting accuracy. The recommender system uses a pipeline of natural language processing, fuzzy matching, and machine learning to significantly reduce the human effort needed for software product vulnerability matching.