检索结果-内蒙古大学图书馆

A Statistical Relational Learning Approach Towards Products, Software Vulnerabilities and exploits

IEEE TRANSACTIONS ON NETWORK AND SERVICE MANAGEMENT 2023年第3期20卷 3782-3802页

作者： Pereira, Caina Figueiredo Lopes de Oliveira, Joao Gabriel Santos, Rodrigo Azevedo Vieira, Daniel Miranda, Lucas Zaverucha, Gerson de Aguiar, Leandro Pfleger Menasche, Daniel Sadoc Univ Fed Rio de Janeiro Syst & Comp Engn Program BR-21941901 Rio De Janeiro Brazil Mondu GmbH D-10179 Berlin Germany Univ Fed Rio de Janeiro Inst Comp BR-21941901 Rio De Janeiro Brazil Siemens Technol Princeton NJ 08540 USA Amazon Bellevue WA USA

Data on software vulnerabilities, products, and exploits are typically collected from multiple non-structured sources. Valuable information, e.g., on which products are affected by which exploits, is conveyed by matching data from those sources, i.e., through their relations. In this paper, we leverage this simple albeit unexplored observation to introduce a statistical relational learning (SRL) approach for the analysis of vulnerabilities, products, and exploits. In particular, we focus on the problem of determining the existence of an exploit for a given product, given information about the relations between products and vulnerabilities, and vulnerabilities and exploits, focusing on Industrial Control Systems (ICS), the National Vulnerability Database, and ExploitDB. Using RDN-Boost, we were able to reach an AUC ROC of 0.80 and an AUC PR of 0.65 for the problem at hand. To reach that performance, we indicate that it is instrumental to include textual features, e.g., extracted from the description of vulnerabilities, as well as structured information, e.g., about product categories. In addition, using interpretable relational regression trees, we report simple rules that shed insight on factors impacting the weaponization of ICS products.

关键词： Statistical relational learning security exploits

来源：评论

学校读者我要写书评

暂无评论

TriAssetRank: Ranking Vulnerabilities, exploits, and Privileges for Countermeasures Prioritization

引用

IEEE TRANSACTIONS ON INFORMATION FORENSICS AND SECURITY 2024年 19卷 10189-10205页

作者： Bouom, Aymar Le Pere Tchimwa Lienou, Jean-Pierre Geh, Wilson Ejuh Nelson, Frederica Free Shetty, Sachin Kamhoua, Charles Univ Dschang Math & Comp Sci Dept Fac Sci Dschang Cameroon DEVCOM Army Res Lab Adelphi MD 20783 USA Old Dominion Univ Dept Elect & Comp Engn Norfolk VA 23529 USA

Network defence practices have no standardized mechanism for determining the priority of threat events. Prioritization of cyber vulnerabilities intends to make network administrators focus on the most critical points within the system to mitigate potential damages produced by attackers. More likely, in managing vulnerabilities, current approaches always focus on the common vulnerability exposures (CVE), which are not the only existing vulnerabilities in a network. Also, while the Common Vulnerability Scoring System (CVSS) effectively scores individual vulnerabilities, it fails to consider the relationships between them but considers each vulnerability in isolation. Existing research, such as the 'AssetRank' algorithm, has made progress in exploring these relationships. Building on this foundation, in this paper we propose TriAssetRank, a tripartite ranking algorithm that evaluates three key elements within a logical attack graph: vulnerabilities, privileges, and potential attack exploits. Since each node type has its unique characteristics and potential impact on the system's security, we rank them in concert, taking into account the dependencies between nodes in the attack graph. The proposed ranking scheme computes a numerical value for each node based on its type, which is a clear indication of how valuable it is to a potential attacker. Several tests on various model networks have empirically validated the effectiveness of the algorithm, which enables organizations to prioritize countermeasures by identifying the most critical vulnerabilities, exploits, and privilege escalation risks, allowing efficient allocation of resources to mitigate high-impact threats and reduce overall risk exposure effectively.

关键词： Security Risk management Wireless communication Protocols Organizations Cyberattack Servers Internet of Things Domain Name System Databases Tripartite graph ranking vulnerabilities privileges exploits attack graphs multi-partite graphs

来源：评论

学校读者我要写书评

暂无评论

A Bayesian network model for likelihood estimations of acquirement of critical software vulnerabilities and exploits

引用

INFORMATION AND SOFTWARE TECHNOLOGY 2015年第Feb.期58卷 304-318页

作者： Holm, Hannes Korman, Matus Ekstedt, Mathias Royal Inst Technol Dept Ind Informat & Control Syst S-10044 Stockholm Sweden

Context: Software vulnerabilities in general, and software vulnerabilities with publicly available exploits in particular, are important to manage for both developers and users. This is however a difficult matter to address as time is limited and vulnerabilities are frequent. Objective: This paper presents a Bayesian network based model that can be used by enterprise decision makers to estimate the likelihood that a professional penetration tester is able to obtain knowledge of critical vulnerabilities and exploits for these vulnerabilities for software under different circumstances. Method: Data on the activities in the model are gathered from previous empirical studies, vulnerability databases and a survey with 58 individuals who all have been credited for the discovery of critical software vulnerabilities. Results: The proposed model describes 13 states related by 17 activities, and a total of 33 different datasets. Conclusion: Estimates by the model can be used to support decisions regarding what software to acquire, or what measures to invest in during software development projects. (C) 2014 Elsevier B.V. All rights reserved.

关键词： Cyber security Vulnerabilities exploits Statistical model Security metrics

来源：评论

学校读者我要写书评

暂无评论

TestREx: a framework for repeatable exploits

引用

INTERNATIONAL JOURNAL ON SOFTWARE TOOLS FOR TECHNOLOGY TRANSFER 2019年第1期21卷 105-119页

作者： Dashevskyi, Stanislav dos Santos, Daniel Ricardo Massacci, Fabio Sabetta, Antonino Univ Trento Trento Italy Fdn Bruno Kessler Trento Italy SAP Labs Sophia Antipolis France

Web applications are the target of many well-known exploits and also a fertile ground for the discovery of security vulnerabilities. Yet, the success of an exploit depends both on the vulnerability in the application source code and the environment in which the application is deployed and run. As execution environments are complex (application servers, databases and other supporting applications), we need to have a reliable framework to test whether known exploits can be reproduced in different settings, better understand their effects, and facilitate the discovery of new vulnerabilities. In this paper, we present TestRExa framework that allows for highly automated, easily repeatable exploit testing in a variety of contexts, so that a security tester may quickly and efficiently perform large-scale experiments with vulnerability exploits. It supports packing and running applications with their environments, injecting exploits, monitoring their success, and generating security reports. We also provide a corpus of example applications, taken from related works or implemented by us.

关键词： Software vulnerabilities exploits Security testing Experimentation

来源：评论

学校读者我要写书评

暂无评论

Software Vulnerabilities, Products and exploits: A Statistical Relational Learning Approach

Software Vulnerabilities, Products and Exploits: A Statistic...

引用

IEEE International Conference on Cyber Security and Resilience (IEEE CSR)

作者： Figueiredo, Caina Lopes, Joao Gabriel Azevedo, Rodrigo Zaverucha, Gerson Menasche, Daniel Sadoc de Aguiar, Leandro Pfleger Univ Fed Rio de Janeiro Rio De Janeiro RJ Brazil Siemens Technol Princeton NJ USA

ISBN: (纸本)9781665402859

Data on software vulnerabilities, products and exploits is typically collected from multiple non-structured sources. Valuable information, e.g., on which products are affected by which exploits, is conveyed by matching data from those sources, i.e., through their relations. In this paper, we leverage this simple albeit unexplored observation to introduce a statistical relational learning (SRL) approach for the analysis of vulnerabilities, products and exploits. In particular, we focus on the problem of determining the existence of an exploit for a given product, given information about the relations between products and vulnerabilities, and vulnerabilities and exploits, focusing on Industrial Control Systems (ICS), the National Vulnerability Database and ExploitDB. Using RDN-Boost, we were able to reach an AUC ROC of 0.83 and an AUC PR of 0.69 for the problem at hand. To reach that performance, we indicate that it is instrumental to include textual features, e.g., extracted from the description of vulnerabilities, as well as structured information, e.g., about product categories. In addition, using interpretable relational regression trees we report simple rules that shed insight on factors impacting the weaponization of ICS products.

关键词： Statistical relational learning security exploits

来源：评论

学校读者我要写书评

暂无评论

Locating Zero-day exploits With Course-Grained Forensics 14

Locating Zero-day Exploits With Course-Grained Forensics

引用

14th European Conference on Cyber Warfare and Security (ECCWS)

作者： Kuhn, Stephen Taylor, Stephen Dartmouth Coll Hanover NH 03755 USA

ISBN: (纸本)9781910810293

This paper describes a novel coarse-grained forensics capability for locating zero-day exploits by recording and correlating on-host actions with network packets, with no discernible impact on user experience. The capability provides an alternative to fine-grained techniques, such as memory taint tracking, that are intractable approaches for typical high volume internet facing servers. Two associated network attack scenarios are described, based upon typical website designs, to illustrate how the technique can be used. These have been implemented and tested to verify the capability. Many government and businesses entities already record large volumes of network traffic for regulatory compliance and security analysis;specialized, high-performance hardware appliances are now available to support this activity. To augment this store, the course-grain forensics capability utilizes a small-footprint (i.e. attack surface) custom hypervisor with built in virtual machine introspection (VMI) mechanisms. These mechanisms allow forensic observation to extract exploits by observing the running micro-kernel's process creation, communications and network activities. This allows recorded network events to be directly correlated with on host actions. A custom micro-kernel has been developed to explore the core ideas which, in common with other designs such as Minix, uses a message passing for inter-process communication. This communication model enables strict enforcement of process interactions, which must pass through the kernel, creating a natural observation point for events of interest. Recording only process interactions minimizes the storage requirements to a manageable level - sixteen bytes per event. This imparts minimal performance impact - less than six micro seconds to record each event on host, enables recording of the process communication ontology in a computationally efficient manner. The process history allows an analyst to observe the past actions taken by a malic

关键词： security virtualization forensics exploits

来源：评论

学校读者我要写书评

暂无评论

Data Modelling for Predicting exploits 23rd

Data Modelling for Predicting Exploits

引用

23rd Nordic Conference on Secure IT Systems (NordSec)

作者： Reinthal, Alexander Filippakis, Eleftherios Lef Almgren, Magnus Chalmers Univ Technol Gothenburg Sweden

ISBN: (纸本)9783030036386;9783030036379

Modern society is becoming increasingly reliant on secure computer systems. Predicting which vulnerabilities are more likely to be exploited by malicious actors is therefore an important task to help prevent cyber attacks. Researchers have tried making such predictions using machine learning. However, recent research has shown that the evaluation of such models require special sampling of training and test sets, and that previous models would have had limited utility in real world settings. This study further develops the results of recent research through the use of their sampling technique for evaluation in combination with a novel data model. Moreover, contrary to recent research, we find that using open web data can help in making better predictions about exploits, and that zero-day exploits are detrimental to the predictive powers of the model. Finally, we discovered that the initial days of vulnerability information is sufficient to make the best possible model. Given our findings, we suggest that more research should be devoted to develop refined techniques for building predictive models for exploits. Gaining more knowledge in this domain would not only help preventing cyber attacks but could yield fruitful insights in the nature of exploit development.

关键词： exploits Machine learning Concept drift Vulnerability management

来源：评论

学校读者我要写书评

暂无评论

Predicting Cyber Vulnerability exploits with Machine Learning 13

Predicting Cyber Vulnerability Exploits with Machine Learnin...

引用

13th Scandinavian Conference on Artificial Intelligence

作者： Edkrantz, Michel Said, Alan Recorded Future AB Gothenburg Sweden

ISBN: (纸本)9781614995890;9781614995883

For an information security manager it can be a daunting task to keep up and assess which new cyber vulnerabilities to prioritize patching first. Every day numerous new vulnerabilities and exploits are reported for a wide variety of different software configurations. We use machine learning to make automatic predictions for unseen vulnerabilities based on previous exploit patterns. As sources for historic vulnerability data, we use the National Vulnerability Database (NVD) and the Exploit Database (EDB). Our work shows that common words from the vulnerability descriptions, external references, and vendor products, are the most important features to consider. Common Vulnerability Scoring System (CVSS) scores and categorical parameters, and Common Weakness Enumeration (CWE) numbers are redundant when a large number of common words are used, since this information is often contained within the vulnerability description. Using machine learning algorithms, it is possible to get a prediction accuracy of 83% for binary classification. In comparison, the performance differences between some of the algorithms are marginal with respect to metrics such as accuracy, precision, and recall. The best classifier with respect to both performance metrics and execution time is a linear time Support Vector Machine (SVM) algorithm. We conclude that in order to get better predictions the data quality must be enhanced.

关键词： Machine Learning SVM cyber security information security exploits vulnerability prediction data mining

来源：评论

学校读者我要写书评

暂无评论

Markets for Zero-Day exploits: Ethics and Implications 13

Markets for Zero-Day Exploits: Ethics and Implications

引用

New Security Paradigms Workshop (NSPW)

作者： Egelman, Serge Herley, Cormac van Oorschot, Paul C. Univ Calif Berkeley Berkeley CA 94720 USA Microsoft Res Redmond WA USA Carleton Univ Ottawa ON K1S 5B6 Canada

ISBN: (纸本)9781450325820

A New Security Paradigms Workshop (2013) panel discussed the topic of ethical issues and implications related to markets for zero-day exploits, i.e., markets facilitating the sale of previously unknown details on how to exploit software vulnerabilities in target applications or systems. The related topic of vulnerability rewards programs ("bug bounties" offered by software vendors) was also discussed. This note provides selected background material submitted prior to the panel presentation, and summarizes discussion resulting from the input of both the panelists and NSPW participants.

关键词： Vulnerabilities exploits Security Economics

来源：评论

学校读者我要写书评

暂无评论

No Spring Chicken: Quantifying the Lifespan of exploits in IoT Malware Using Static and Dynamic Analysis 22

No Spring Chicken: Quantifying the Lifespan of Exploits in I...

引用

17th ACM ASIA Conference on Computer and Communications Security 2022 (ACM ASIACCS)

作者： Al Alsadi, Arwa Abdulkarim Sameshima, Kaichi Bleier, Jakob Yoshioka, Katsunari Lindorfer, Martina van Eeten, Michel Ganan, Carlos H. Delft Univ Technol Delft Netherlands Yokohama Natl Univ Yokohama Kanagawa Japan TU Wien Vienna Austria

ISBN: (纸本)9781450391405

The Internet of things (IoT) is composed by a wide variety of software and hardware components that inherently contain vulnerabilities. Previous research has shown that it takes only a few minutes from the moment an IoT device is connected to the Internet to the first infection attempts. Still, we know little about the evolution of exploit vectors: Which vulnerabilities are being targeted in the wild, how has the functionality changed over time, and for how long are vulnerabilities being targeted? Understanding these questions can help in the secure development, and deployment of IoT networks. We present the first longitudinal study of IoT malware exploits by analyzing 17,720 samples collected from three different sources from 2015 to 2020. Leveraging static and dynamic analysis, we extract exploits from these binaries to then analyze them along the following four dimensions: (1) evolution of infection vectors over the years, (2) exploit lifespan, vulnerability age, and the time-to-exploit of vulnerabilities, (3) functionality of exploits, and (4) targeted IoT devices and manufacturers. Our descriptive analysis uncovers several patterns: IoT malware keeps evolving, shifting from simply leveraging brute force attacks to including dozens of device-specific exploits. Once exploits are developed, they are rarely abandoned. The most recent binaries still target (very) old vulnerabilities. In some cases, new exploits are developed for a vulnerability that has been known for years. We find that the mean time-to-exploit after vulnerability disclosure is around 29 months, much longer than for malware targeting other environments.

关键词： Static Analysis Dynamic Analysis exploits Vulnerabilities Infection Vectors Malware IoT

来源：评论

学校读者我要写书评

暂无评论

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

请选择保存的检索档案：

请选择收藏分类：

通借通还

建议与咨询 留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

请选择保存的检索档案： 新增检索档案 确定 取消

请选择收藏分类： 新增自定义分类 确定 取消

通借通还

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

请选择保存的检索档案：

请选择收藏分类：