Beyond heuristics: Learning to classify vulnerabilities and predict exploits

Proceedings of the ACM SIGKDD International Conference on Knowledge Discovery and Data Mining

Volumn , Issue , 2010, Pages 105-113

  Bozorgi, Mehran ^a   Saul, Lawrence K ^a   Savage, Stefan ^a   Voelker, Geoffrey M ^a  

^a UNIVERSITY OF CALIFORNIA   (United States)

Author keywords

Exploits; Supervised learning; SVM; Vulnerabilities

Indexed keywords

BUFFER OVERFLOW ERRORS; ENTERPRISE IS; EXPERT KNOWLEDGE; EXPLOITS; HIGH DIMENSIONAL FEATURE; SIDE EFFECT; SOFTWARE SYSTEMS; SOFTWARE VULNERABILITIES; SVM; SYSTEM ADMINISTRATION; SYSTEMS ADMINISTRATOR; TEXT FIELDS; TIME STAMPS; VULNERABILITIES; VULNERABILITY DISCLOSURE;

FEATURE EXTRACTION; FORECASTING; SUPERVISED LEARNING;

CLASSIFIERS;

EID: 77956214438     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1145/1835804.1835821     Document Type: Conference Paper

References (22)

1. W. A. Arbaugh, W. L. Fithen, and J. McHugh. Windows of vulnerability: A case study analysis. Computer, 33(12):52-59, 2000.
2. A. Arora, A. Nandkumar, and R. Telang. Does information security attack frequency increase with vulnerability disclosure? an empirical analysis. Information Systems Frontiers, 8(5), 2006.
3. A. Arora, R. Telang, and H. Xu. Optimal policy for software vulnerability disclosure. In Workshop on Economics and Information Security (WEIS'04), 2004.
4. S. M. Bellovin. On the Brittleness of Software and the Infeasibility of Security Metrics. IEEE Security and Privacy, 4(4), July 2006.
5. Cisco. Risk Assessment: Risk Triage for Security Vulnerability Announcements. Cisco Whitepaper, Accessed September, 2009. http://www.cisco.com/ web/about/security/intelligence/vulnerability-risk%-triage.html.
6. CVE Editorial Board. Common Vulnerabilities and Exposures: The Standard for Information Security Vulnerability Names. http://cve.mitre.org/.
7. C. Dougherty. Vulnerability metric, Updated on July 24, 2008. https://www.securecoding.cert.org/confluence/display/seccode/ Vulnerabil%ity+Metric.
8. R.-E. Fan, K.-W. Chang, C.-J. Hsieh, X.-R. Wang, and C.-J. Lin. LIBLINEAR - A Library for Large Linear Classification. http://www.csie.ntu.edu.tw/~cjlin/ liblinear/.
9. Forum of Incident Response and Security Teams (FIRST). Common Vulnerabilities Scoring System (CVSS). http://www.first.org/cvss/.
10. S. Frei, D. Schatzmann, B. Plattner, and B. Trammel. Modeling the Security Ecosystem - The Dynamics of (In)Security. In Proc. of the Workshop on the Economics of Information Security (WEIS), June 2009.
11. IBM. IBM Internet Security Systems X-Force 2008 Trend and Risk Report. White paper, Jan. 2009. http://www-935.ibm.com/services/us/iss/xforce/ trendreports/xforce-2008-%annual-report.pdf.
12. D. Lewis. Naive (Bayes) at Forty: The Independence Assumption in Information Retrieval. In Proceedings of ECML-98, the 10th European Conference on Machine Learning, pages 4-15, 1998.
13. P. Mell, K. Scarfone, and S. Romanosky. A complete guide to the common vulnerability scoring system version 2.0, June, 2007. http://www.first.org/cvss/ cvss-guide.html.
14. Microsoft TechNet Security Team. Microsoft Security Bulletin. http://www.microsoft.com/technet/security/current.aspx.
15. D. Moore, C. Shannon, and k. claffy. Code-red: a case study on the spread and victims of an internet worm. In Proceedings of the 2nd ACM SIGCOMM Workshop on Internet measurment, pages 273-284, 2002.
16. D. Nizovtsev and M. Thursby. Economic analysis of incentives to disclose software vulnerabilities. In Proc. of the Workshop on the Economics of Information Security, 2005.
17. OSVDB. The Open Source Vulnerability Database. http://osvdb.org/.
18. A. Ozment. The likelihood of vulnerability rediscovery and the social utility of vulnerability hunting. In Proc. of the Workshop on the Economics of Information Security, 2005.
19. E. Rescorla. Security holes⋯ who cares? In Proc. of the 12th conference on USENIX Security Symposium, 2003.
20. Secunia Corporation. Secunia Advisories. http://secunia.com.
21. Symantec Corporation. Security Focus. http://www.securityfocus.com.
22. V. Vapnik. Statistical Learning Theory. John Wiley & Sons, New York, NY, 1998.