The CVE Wayback Machine: Measuring Coordinated Disclosure from Exploits against Two Years of Zero-Days
The CVE Wayback Machine: Measuring Coordinated Disclosure from Exploits against Two Years of Zero-Days
复制标题
CVE 回溯机器：衡量针对两年零日漏洞的协调披露
DOI：
10.1145/3618257.3624810
复制
发表时间：
2023
期刊：
影响因子：
--
通讯作者：
McDaniel, Patrick
中科院分区：
文献类型：
--
作者：
Pauley, Eric;Barford, Paul;McDaniel, Patrick
软件安全依赖于研究人员的协调漏洞披露（CVD），这是一个社区不断寻求衡量和改进的过程。然而，CVD实践的有效性取决于告知他们的数据。在本文中，我们使用DScope，一个基于云的交互式互联网望远镜，建立脆弱性生命周期的统计模型，弥合了20多年来CVD研究的数据差距。通过分析两年来的应用层互联网扫描流量，我们确定了63种威胁的实际利用时间表。我们将这些数据与六个额外的数据集结合在一起，以构建这些漏洞的完整出生到死亡模型，这是迄今为止对漏洞生命周期的最完整分析。我们的分析得出了三个关键建议：（1）不同供应商的CVD显示出比以前认为的更低的有效性，（2）入侵检测系统未被充分利用来为关键漏洞提供保护，以及（3）CVD的现有数据源可以通过新的互联网测量方法来增强。通过这种方式，我们的Vantage为改进CVD过程提供了新的机会，从而在实践中实现更安全的软件生态系统。
Software security depends on coordinated vulnerability disclosure (CVD) from researchers, a process that the community has continually sought to measure and improve. Yet, CVD practices are only as effective as the data that informs them. In this paper, we use DScope, a cloud-based interactive Internet telescope, to build statistical models of vulnerability lifecycles, bridging the data gap in over 20 years of CVD research. By analyzing application-layer Internet scanning traffic over two years, we identify real-world exploitation timelines for 63 threats. We bring this data together with six additional datasets to build a complete birth-to-death model of these vulnerabilities, the most complete analysis of vulnerability lifecycles to date. Our analysis reaches three key recommendations: (1) CVD across diverse vendors shows lower effectiveness than previously thought, (2) intrusion detection systems are underutilized to provide protection for critical vulnerabilities, and (3) existing data sources of CVD can be augmented by novel approaches to Internet measurement. In this way, our vantage point offers new opportunities to improve the CVD process, achieving a safer software ecosystem in practice.
影响因子：
2.2
作者：
W. Arbaugh;William L. Fithen;John McHugh
通讯作者：
W. Arbaugh;William L. Fithen;John McHugh
DOI：
--
发表时间：
2008
期刊：
影响因子：
--
作者：
J. Kouns
通讯作者：
J. Kouns