Comparative Evaluation of NLP-Based Approaches for Linking CAPEC Attack Patterns from CVE Vulnerability Information-猫眼课题宝

DOI：

10.3390/app12073400

发表时间：

2022-03

期刊：

Applied Sciences

影响因子：

通讯作者：

中科院分区：

文献类型：

作者：

Kenta Kanakogi;H. Washizaki;Y. Fukazawa;Shinpei Ogata;T. Okubo;Takehisa Kato;Hideyuki Kanuka;A. Hazeyama;Nobukazu Yoshioka

必须收集漏洞和攻击信息，以评估漏洞的严重性，并快速准确地确定应对网络攻击的对策的优先顺序。常见漏洞和暴露是列出漏洞和事件的词典，而常见攻击模式枚举和分类是攻击模式词典。很难从常见的漏洞和暴露中直接识别常见攻击模式的列举和分类，因为它们并不总是直接相关的。在这里，提出了一种直接找到这些词典之间的公共链接的方法。然后，使用该方法对几种模式进行了实验评估，这些模式是相似性度量和常用算法的组合，如词频倒置文档频率、通用句子编码器和句子ERT。具体地说，使用两个度量：召回率和平均倒数等级，来评估与常见漏洞和暴露的61个标识符相关联的常见攻击模式枚举和分类标识符的可追溯性。实验证明，词频-逆文档频率算法具有最好的整体性能。

Vulnerability and attack information must be collected to assess the severity of vulnerabilities and prioritize countermeasures against cyberattacks quickly and accurately. Common Vulnerabilities and Exposures is a dictionary that lists vulnerabilities and incidents, while Common Attack Pattern Enumeration and Classification is a dictionary of attack patterns. Direct identification of common attack pattern enumeration and classification from common vulnerabilities and exposures is difficult, as they are not always directly linked. Here, an approach to directly find common links between these dictionaries is proposed. Then, several patterns, which are combinations of similarity measures and popular algorithms such as term frequency–inverse document frequency, universal sentence encoder, and sentence BERT, are evaluated experimentally using the proposed approach. Specifically, two metrics, recall and mean reciprocal rank, are used to assess the traceability of the common attack pattern enumeration and classification identifiers associated with 61 identifiers for common vulnerabilities and exposures. The experiment confirms that the term frequency–inverse document frequency algorithm provides the best overall performance.

Comparative Evaluation of NLP-Based Approaches for Linking CAPEC Attack Patterns from CVE Vulnerability Information

文献摘要

相似文献