Open Science Research Excellence

Open Science Index

Commenced in January 2007 Frequency: Monthly Edition: International Publications Count: 30454


Select areas to restrict search in scientific publication database:
10011009
SVID: Structured Vulnerability Intelligence for Building Deliberated Vulnerable Environment
Abstract:
The diversity and complexity of modern IT systems make it almost impossible for internal teams to find vulnerabilities in all software before the software is officially released. The emergence of threat intelligence and vulnerability reporting policy has greatly reduced the burden on software vendors and organizations to find vulnerabilities. However, to prove the existence of the reported vulnerability, it is necessary but difficult for security incident response team to build a deliberated vulnerable environment from the vulnerability report with limited and incomplete information. This paper presents a structured, standardized, machine-oriented vulnerability intelligence format, that can be used to automate the orchestration of Deliberated Vulnerable Environment (DVE). This paper highlights the important role of software configuration and proof of vulnerable specifications in vulnerability intelligence, and proposes a triad model, which is called DIR (Dependency Configuration, Installation Configuration, Runtime Configuration), to define software configuration. Finally, this paper has also implemented a prototype system to demonstrate that the orchestration of DVE can be automated with the intelligence.
Digital Object Identifier (DOI):

References:

[1] NIST. National vulnerability database. https://nvd.nist.gov/. Retrieved: April 26, 2019.
[2] Lily Hay Newman. Everything we know about Facebook’s massive security breach. https://www.wired.com/story/facebook-security-breach-50-million-accounts/. Retrieved: April 26, 2019.
[3] McAffee Corporation, McAfee Labs - Threat-Report, In: 2017, https://www.mcafee.com/enterprise/en-us/assets/reports/rp-quarterly-threats-sept-2017.pdf.
[4] DOD. Hacking the pentagon. https://www.usds.gov/report-to-congress/2017/fall/hack-the-pentagon/. Retrieved: April 26, 2019.
[5] Taylor Hatmaker. Google’s bug bounty program pays out $3 million, mostly for Android and Chrome exploits. https://techcrunch.com/2017/01/31/googles-bug-bounty-2016/. Retrieved: April 26, 2019.
[6] Tom Warren. Microsoft will now pay up to $250,000 for Windows 10 security bugs. https://www.theverge.com/2017/7/26/16044842/microsoft-windows-bug-bounty-security-flaws-bugs-250k. Retrieved: April 26, 2019.
[7] Mu, Dongliang, Alejandro Cuevas, Limin Yang, Hang Hu, Xinyu Xing, Bing Mao, and Gang Wang. "Understanding the reproducibility of crowd-reported security vulnerabilities." In 27th {USENIX} Security Symposium ({USENIX} Security 18), pp. 919-936. 2018.
[8] Steven Musil. Researcher posts Facebook bug report to Mark Zuckerberg's wall. https://www.cnet.com/news/researcher-posts-facebook-bug-report-to-mark-zuckerbergs-wall/. Retrieved: April 26, 2019.
[9] Menges, Florian, and Günther Pernul. "A comparative analysis of incident reporting formats." Computers & Security 73 (2018): 87-101.
[10] Asgarli, Elchin, and Eric Burger. "Semantic ontologies for cyber threat sharing standards." In 2016 IEEE Symposium on Technologies for Homeland Security (HST), pp. 1-6. IEEE, 2016.
[11] Dong, Y., Guo, W., Chen, Y., Xing, X., Zhang, Y., & Wang, G. Towards the Detection of Inconsistencies in Public Security Vulnerability Reports.
[12] Tounsi, W., & Rais, H. (2018). A survey on technical threat intelligence in the age of sophisticated cyber attacks. Computers & security, 72, 212-233.
[13] CISA. Traffic Light Protocol (TLP) definitions and usage. https://www.us-cert.gov/tlp. Retrieved: April 26, 2019.
[14] Steinberger, J., Sperotto, A., Golling, M., & Baier, H. (2015, May). How to exchange security events? overview and evaluation of formats and protocols. In 2015 IFIP/IEEE International Symposium on Integrated Network Management (IM) (pp. 261-269). IEEE.
[15] Mavroeidis, V., & Bromander, S. (2017, September). Cyber threat intelligence model: an evaluation of taxonomies, sharing standards, and ontologies within cyber threat intelligence. In 2017 European Intelligence and Security Informatics Conference (EISIC) (pp. 91-98). IEEE.
[16] Cichonski, P., Millar, T., Grance, T., & Scarfone, K. (2012). Computer security incident handling guide. NIST Special Publication, 800(61), 1-147.
[17] The twelve-factor app. https://12factor.net/. Retrieved: April 26, 2019.
[18] GNS3. https://www.gns3.com/. Retrieved: April 26, 2019.
[19] NIST. Official Common Platform Enumeration (CPE) dictionary. https://nvd.nist.gov/Products/CPE. Retrieved: April 26, 2019.
[20] Semantic versioning 2.0.0. https://semver.org/. Retrieved: April 26, 2019.
[21] Rapid7 Corporation. Metasploit. https://www.metasploit.com/. Retrieved: April 26, 2019.
[22] MITRE Corporation. Common weakness enumeration. https://cwe.mitre.org/index.html. Retrieved: April 26, 2019.
[23] MITRE Corporation. Common attack pattern enumeration and classification. https://capec.mitre.org/. Retrieved: April 26, 2019.
[24] CISA. Common Vulnerabilities and Exposures. https://cve.mitre.org/. Retrieved: May 13, 2019.
Vol:14 No:05 2020Vol:14 No:04 2020Vol:14 No:03 2020Vol:14 No:02 2020Vol:14 No:01 2020
Vol:13 No:12 2019Vol:13 No:11 2019Vol:13 No:10 2019Vol:13 No:09 2019Vol:13 No:08 2019Vol:13 No:07 2019Vol:13 No:06 2019Vol:13 No:05 2019Vol:13 No:04 2019Vol:13 No:03 2019Vol:13 No:02 2019Vol:13 No:01 2019
Vol:12 No:12 2018Vol:12 No:11 2018Vol:12 No:10 2018Vol:12 No:09 2018Vol:12 No:08 2018Vol:12 No:07 2018Vol:12 No:06 2018Vol:12 No:05 2018Vol:12 No:04 2018Vol:12 No:03 2018Vol:12 No:02 2018Vol:12 No:01 2018
Vol:11 No:12 2017Vol:11 No:11 2017Vol:11 No:10 2017Vol:11 No:09 2017Vol:11 No:08 2017Vol:11 No:07 2017Vol:11 No:06 2017Vol:11 No:05 2017Vol:11 No:04 2017Vol:11 No:03 2017Vol:11 No:02 2017Vol:11 No:01 2017
Vol:10 No:12 2016Vol:10 No:11 2016Vol:10 No:10 2016Vol:10 No:09 2016Vol:10 No:08 2016Vol:10 No:07 2016Vol:10 No:06 2016Vol:10 No:05 2016Vol:10 No:04 2016Vol:10 No:03 2016Vol:10 No:02 2016Vol:10 No:01 2016
Vol:9 No:12 2015Vol:9 No:11 2015Vol:9 No:10 2015Vol:9 No:09 2015Vol:9 No:08 2015Vol:9 No:07 2015Vol:9 No:06 2015Vol:9 No:05 2015Vol:9 No:04 2015Vol:9 No:03 2015Vol:9 No:02 2015Vol:9 No:01 2015
Vol:8 No:12 2014Vol:8 No:11 2014Vol:8 No:10 2014Vol:8 No:09 2014Vol:8 No:08 2014Vol:8 No:07 2014Vol:8 No:06 2014Vol:8 No:05 2014Vol:8 No:04 2014Vol:8 No:03 2014Vol:8 No:02 2014Vol:8 No:01 2014
Vol:7 No:12 2013Vol:7 No:11 2013Vol:7 No:10 2013Vol:7 No:09 2013Vol:7 No:08 2013Vol:7 No:07 2013Vol:7 No:06 2013Vol:7 No:05 2013Vol:7 No:04 2013Vol:7 No:03 2013Vol:7 No:02 2013Vol:7 No:01 2013
Vol:6 No:12 2012Vol:6 No:11 2012Vol:6 No:10 2012Vol:6 No:09 2012Vol:6 No:08 2012Vol:6 No:07 2012Vol:6 No:06 2012Vol:6 No:05 2012Vol:6 No:04 2012Vol:6 No:03 2012Vol:6 No:02 2012Vol:6 No:01 2012
Vol:5 No:12 2011Vol:5 No:11 2011Vol:5 No:10 2011Vol:5 No:09 2011Vol:5 No:08 2011Vol:5 No:07 2011Vol:5 No:06 2011Vol:5 No:05 2011Vol:5 No:04 2011Vol:5 No:03 2011Vol:5 No:02 2011Vol:5 No:01 2011
Vol:4 No:12 2010Vol:4 No:11 2010Vol:4 No:10 2010Vol:4 No:09 2010Vol:4 No:08 2010Vol:4 No:07 2010Vol:4 No:06 2010Vol:4 No:05 2010Vol:4 No:04 2010Vol:4 No:03 2010Vol:4 No:02 2010Vol:4 No:01 2010
Vol:3 No:12 2009Vol:3 No:11 2009Vol:3 No:10 2009Vol:3 No:09 2009Vol:3 No:08 2009Vol:3 No:07 2009Vol:3 No:06 2009Vol:3 No:05 2009Vol:3 No:04 2009Vol:3 No:03 2009Vol:3 No:02 2009Vol:3 No:01 2009
Vol:2 No:12 2008Vol:2 No:11 2008Vol:2 No:10 2008Vol:2 No:09 2008Vol:2 No:08 2008Vol:2 No:07 2008Vol:2 No:06 2008Vol:2 No:05 2008Vol:2 No:04 2008Vol:2 No:03 2008Vol:2 No:02 2008Vol:2 No:01 2008
Vol:1 No:12 2007Vol:1 No:11 2007Vol:1 No:10 2007Vol:1 No:09 2007Vol:1 No:08 2007Vol:1 No:07 2007Vol:1 No:06 2007Vol:1 No:05 2007Vol:1 No:04 2007Vol:1 No:03 2007Vol:1 No:02 2007Vol:1 No:01 2007