Fighting N-Day Vulnerabilities with Automated CVSS Vector Prediction at Disclosure - INRIA - Institut National de Recherche en Informatique et en Automatique Accéder directement au contenu
Communication Dans Un Congrès Année : 2020

Fighting N-Day Vulnerabilities with Automated CVSS Vector Prediction at Disclosure

Résumé

The Common Vulnerability Scoring System (CVSS) is the industry standard for describing the characteristics of a software vulnerability and measuring its severity. However, during the first days after a vulnerability disclosure, the initial human readable description of the vulnerability is not available as a machine readable CVSS vector yet. This situation creates a period of time when only expensive manual analysis can be used to react to new vulnerabilities because no data is available for cheaper automated analysis yet. We present a new technique based on linear regression to automatically predict the CVSS vector of newly disclosed vulnerabilities using only their human readable descriptions, with a strong emphasis on decision explicability. Our experimental results suggest real world applicability.
Fichier principal
Vignette du fichier
HAL_fighting_ndays_vulnerabilities_with_automated_cvss_vector_prediction.pdf.pdf (840.84 Ko) Télécharger le fichier
Origine : Fichiers produits par l'(les) auteur(s)
Loading...

Dates et versions

hal-02895913 , version 1 (10-07-2020)

Identifiants

  • HAL Id : hal-02895913 , version 1

Citer

Clément Elbaz, Louis Rilling, Christine Morin. Fighting N-Day Vulnerabilities with Automated CVSS Vector Prediction at Disclosure. ARES 2020 - International Conference on Availability, Reliability and Security, Aug 2020, Virtual Event, Ireland. pp.1-10. ⟨hal-02895913⟩
495 Consultations
783 Téléchargements

Partager

Gmail Facebook X LinkedIn More