N-day 취약점 데이터베이스 개선 및 활용 방안 연구
A Study on the Improvement and Utilization of Public N-Day Vulnerability Databases
0
조회
0
다운로드
2
인용
0
참고문헌
키워드
초록
취약점이 공개된 후 소프트웨어가 업데이트되지 않으면 계속해서 공격을 받을 수 있다. 이로 인해 취약점을 악용하는 공격이 증가하면서 N-day 탐지의 중요성이 커지고 있다. 그러나 공개된 취약점 데이터베이스에서 특정 버전 정보를 찾기 어렵거나 잘못된 버전 혹은 소프트웨어가 출력되는 문제점이 발생한다. 또한 공개된 취약점 데이터베이스 간의 연계가 잘되지 않는다는 한계점이 있다. 본 논문에서는 이러한 한계점을 극복하기 위해 CVE, CPE, Exploit Database와 같은 종합적인 취약점 정보를 포함하는 정보들을 통합된 데이터베이스로 구축하는 방법을 제안한다. 나아가서 본 연구의 결과물로 구축된 통합 데이터베이스 기반 취약점 검색용 웹사이트를 개발함으로써, 특정 소프트웨어의 버전과 Windows 운영체제에서의 취약점을 탐지 및 활용하는데 효용성을 보인다.
Abstract
If the software is not updated after the vulnerability is disclosed, it can continue to be attacked. As a result, the importance of N-day detection is increasing as attacks that exploit vulnerabilities increase. However, there is a problem that it is difficult to find specific version information in the published vulnerability database, or that the wrong version or software is outputted. There is also a limitation in that the connection between the published vulnerability databases is not good. In order to overcome these limitations, this paper proposes a method of building information including comprehensive vulnerability information such as CVE, CPE, and Exploit Database into an integrated database. Furthermore, by developing a website for searching for vulnerabilities based on an integrated database built as a result of this study, it is effective in detecting and utilizing vulnerabilities in specific software versions and Windows operating systems.
참고문헌 (34)
- Bullough, B. L., "Predicting exploitation of disclosed software vulnerabilities using open-source data", Proceedings of the 3rd ACM on International Workshop on Security and Privacy Analytics, pp.45~53 (2017)
- L. Bilge, "Before we knew it: an empirical study of zero-day attacks in the real world", Proceedings of the 2012 ACM Conference on Computer and Communications Security, pp.833~844 (2012)
- 2024 SK shieldus EQST Annual Report, , 11~ (2023)
- "CVE"[URL]
- "SBOM"[URL]
- "CPE"[URL]
- "CPE"[URL]
- "NIST"[URL]
- "NVD"[URL]
- "OpenSource"[URL]
- Ushakov, R., "CPE and CVE based technique for software security risk assessment", 2021 11th IEEE International Conference on Intelligent Data Acquisition and Advanced Computing Systems: Technology and Applications (IDAACS), 1, pp.353~356 (2021)
- Takahashi, Takeshi, "Toward automated vulnerability monitoring using open information and standardized tools", 2016 IEEE International Conference on Pervasive Computing and Communication Workshops (PerCom Workshops) (2016), IEEE
- Cheng, Y., "VERI: a large-scale open-source components vulnerability detection in iot firmware", Computers & Security, 126, pp.103068~ (2023)
- Ecik, Harun, "Comparison of active vulnerability scanning vs. passive vulnerability detection", 2021 International Conference on Information Security and Cryptology (ISCTURKEY) (2021), IEEE
- "QualysFreeScan"[URL]
- "Nexpose Vulnerability Scanner"[URL]
- "OpenVas"[URL]
- "CPE"[URL]
- "CVE-2021-26237"[URL]
- "Data Feeds"[URL]
- Perrone, G., "Unleashing Exploit-Db Data for the Automated Exploitation of Intentionally Vulnerable Docker Containers", ~ (2024)
- Yang, H., "Better not to use vulnerability’s reference for exploitability prediction", Applied Sciences, 10(7), pp.2555~ (2020)
- "CPE"[URL]
- "CPE"[URL]
- "Download"[URL]
- "Exploit-Database"[URL]
- "CVE Search"[URL]
- "CPE Search"[URL]
- "Exploit Database"[URL]
- "OSVDB"[URL]
- "SecurityTracker"[URL]
- "ZeroDium"[URL]
- "Vuldb"[URL]