공개 취약점 정보를 활용한 소프트웨어 취약점 위험도 스코어링 시스템
Risk Scoring System for Software Vulnerability Using Public Vulnerability Information
0
조회
0
다운로드
4
인용
0
참고문헌
키워드
초록
소프트웨어 취약점의 수가 해마다 증가함에 따라 소프트웨어에 대한 공격 역시 많이 발생하고 있다. 이에 따라 보안 관리자는 소프트웨어에 대한 취약점을 파악하고 패치 해야 한다. 그러나 모든 취약점에 대한 패치는 현실적으로어렵기 때문에 패치의 우선순위를 정하는 것이 중요하다. 본 논문에서는 NIST(National Institute ofStandards and Technology)에서 제공하는 취약점 자체 정보와 더불어, 공격 패턴이나 취약점을 유발하는 약점에 대한 영향을 추가적으로 고려하여 취약점의 위험도 평가 척도를 확장한 스코어링 시스템을 제안하였다. 제안하는스코어링 시스템은 CWSS의 평가 척도를 기반으로 확장했으며, 어느 기업에서나 용이하게 사용할 수 있도록 공개된 취약점 정보만을 활용하였다. 이 논문에서 실험을 통해 제안한 자동화된 시스템을 소프트웨어 취약점에 적용함으로써, 공격 패턴과 약점에 의한 영향을 고려한 확장 평가 척도가 유의미한 값을 보이는 것을 확인하였다.
Abstract
As the number of software vulnerabilities grows year by year, attacks on software are also taking place a lot. As aresult, the security administrator must identify and patch vulnerabilities in the software. However, it is important to prioritizethe patches because patches for all vulnerabilities are realistically hard. In this paper, we propose a scoring system thatexpands the scale of risk assessment metric by taking into consideration attack patterns or weaknesses cause vulnerabilitieswith the vulnerability information provided by the NIST(National Institute of Standards and Technology). The proposedscoring system is expanded based on the CWSS and uses only public vulnerability information to utilize easily for anycompany. In this paper, we applied the automated scoring system to software vulnerabilities, and showed the expandedmetrics with consideration for influence of attack pattern and weakness are meaningful.
참고문헌 (23)
- "2017 Year End Vulnerability QuickView Report" (2018)[URL]
- "Top Cybersecurity Threats In 2018" (2017)[URL]
- "Under the Hoodie: 2018" (2018)[URL]
- Ashish Arora, "An empirical analysis of software vendors’patch release behavior: impact of vulnerability disclosure", Information Systems Research, 21(1), pp.115~132 (2010)
- Mengmeng Ge, "Evaluating security and availability of multiple redundancy designs when applying security patches", Dependable Systems and Networks Workshop (DSN-W), 2017 47th Annual IEEE, 2017, ~[DOI]
- "Common Vulnerability Scorin g System(CVSS)"[URL]
- "Common Weakness Scoring System(CWSS)"[URL]
- Stefan Frei, "Large-scale vulnerability analysis", Proceedings of the 2006 SIGCOMM workshop on Large-scale attack defense (2006), ACM
- Christian Frühwirth, "Improving CVSS-based vulnerability prioritization and response with context information", Proceedings of the 2009 3rd international Symposium on Empirical Software Engineering and Measurement (2009), IEEE Computer Society
- Laurent Gallon, "On the impact of env ironmental metrics on CVSS scores", Social Computing (SocialCom), 2010 IEEE Second International Conference on (2010), IEEE
- Ruyi Wang, "An improved CVSS-based vulnerability scoring mechanism", Multimedia Information Networking and Security (MINES), 2011 Third International Conference on (2011), IEEE
- Anshu Tripathi, "On prioritization of vulnerability categories based on CVSS scores", Computer Sciences and Convergence Information Technology (ICCIT), 2011 6th International Conference on (2011), IEEE
- Umesh Kumar Singh, "Quantitative security risk evaluation using CVSS metrics by estimati on of frequency and maturity of exploit", Proceedings of the World Congress on Engineering and Computer Science, 1 (2016)
- Umesh Kumar Singh, "Quantifying security risk by critical network vulnerabilities assessment", International Journal of Computer Applications, 156(13), pp.26~33 (2016)
- Siv Hilde Houmb, "Estimating ToE risk level using CVSS", Availability, Reliability and Security, 2009, ARES’09, International Conference on (2009), IEEE
- CandaceSuh-Lee, "Quantifying security risk by measuring network risk conditions", Computer and Information Science (ICIS), 2015 IEEE, 2015, ~[DOI]
- Young Hoon Moon, "Hybrid attack path enumeration system based on reputation scores", Computer and Information Technology (CIT), 2016 IEEE International Conference on, pp.241~248 (2016), IEEE
- 안준선, "보안취약점 중요도 정량 평가 체계 연구", 정보보호학회논문지, 25(4), pp.921~932 (2015), 한국정보보호학회[DOI]
- Yeu-Pong Lai, "Using the vulnerability information of computer systems to improve the network security", Computer Communications, 30(9), pp.2032~2047 (2007)
- Thanassis Avgerinos, "Automatic Exploit Generation", Communications of the ACM, 57(2), pp.74~84 (2014)
- "Operating System Market Share Worldwide – July 2018" (2018)[URL]
- "TIOBE Index for August 2018" (2018)[URL]
- "Global Enterprise Software Market Size, Share, Trends and Forecast by 2022 – Market Research Report 2017" (2017)[URL]