Please use this identifier to cite or link to this item:

VULNERLIZER: Cross-analysis Between Vulnerabilities and Software Libraries

File Size Format  
0686.pdf 445.63 kB Adobe PDF View/Open

Item Summary

Title:VULNERLIZER: Cross-analysis Between Vulnerabilities and Software Libraries
Authors:Pekaric, Irdin
Felderer, Michael
Steinmüller, Philipp
Keywords:Cybersecurity and Software Assurance
data mining
software library analysis
software security
software vulnerability prediction
show 1 morevulnerability analysis
show less
Date Issued:05 Jan 2021
Abstract:The identification of vulnerabilities is a continuous challenge in software projects. This is due to the evolution of methods that attackers employ as well as the constant updates to the software, which reveal additional issues. As a result, new and innovative approaches for the identification of vulnerable software are needed. In this paper, we present VULNERLIZER, which is a novel framework for cross-analysis between vulnerabilities and software libraries. It uses CVE and software library data together with clustering algorithms to generate links between vulnerabilities and libraries. In addition, the training of the model is conducted in order to reevaluate the generated associations. This is achieved by updating the assigned weights. Finally, the approach is then evaluated by making the predictions using the CVE data from the test set. The results show that the VULNERLIZER has a great potential in being able to predict future vulnerable libraries based on an initial input CVE entry or a software library. The trained model reaches a prediction accuracy of 75% or higher.
Pages/Duration:10 pages
Rights:Attribution-NonCommercial-NoDerivatives 4.0 International
Appears in Collections: Cybersecurity and Software Assurance

Please email if you need this content in ADA-compliant format.

This item is licensed under a Creative Commons License Creative Commons