• 主题
高级搜索  >
历史搜索 清空历史
首页> 外文会议>IEEE International Symposium on Software Reliability Engineering >SV-AF — A Security Vulnerability Analysis Framework
【24h】

SV-AF — A Security Vulnerability Analysis Framework

机译：SV-AF —安全漏洞分析框架

获取原文
页面导航
  • 摘要
  • 著录项
  • 相似文献
  • 相关主题

摘要

The globalization of the software industry has introduced a widespread use of system components across traditional system boundaries. Due to this global reuse, also vulnerabilities and security concerns are no longer limited in their scope to individual systems but instead can now affect global software ecosystems. While known vulnerabilities and security concerns are reported in specialized vulnerability databases, these repositories often remain information silos. In this research, we introduce a modeling approach, which eliminates these silos by linking security knowledge with other software artifacts to improve traceability and trust in software products. In our approach, we introduce a Security Vulnerabilities Analysis Framework (SV-AF) to support evidence based vulnerability detection. Two case studies are presented to illustrate the applicability of our presented approach. In these case studies, we link the NVD vulnerability databases and the Maven build repository to trace vulnerabilities across repository and project boundaries. In our analysis, we identify that 750 Maven project releases are directly affected by known security vulnerabilities and by considering transitive dependencies, an additional 415604 Maven projects can be identified as potentially affected by these vulnerabilities.
机译：软件行业的全球化已导致跨越传统系统边界的系统组件的广泛使用。由于这种全局重用，漏洞和安全问题的范围也不再局限于单个系统，而是现在可以影响全局软件生态系统。尽管在专用漏洞数据库中报告了已知的漏洞和安全问题，但这些存储库通常仍然是信息孤岛。在这项研究中，我们介绍了一种建模方法，该方法通过将安全性知识与其他软件工件链接在一起来消除这些孤岛，以提高对软件产品的可追溯性和信任度。在我们的方法中，我们引入了安全漏洞分析框架（SV-AF）以支持基于证据的漏洞检测。提出了两个案例研究，以说明我们提出的方法的适用性。在这些案例研究中，我们将NVD漏洞数据库和Maven构建存储库链接在一起，以跨存储库和项目边界跟踪漏洞。在我们的分析中，我们确定了750个Maven项目版本直接受到已知安全漏洞的影响，并且通过考虑传递依赖关系，可以确定另外415604个Maven项目可能受到这些漏洞的影响。

著录项

相似文献

  • 外文文献
  • 中文文献
  • 专利
获取原文

客服邮箱：kefu@zhangqiaokeyan.com

京公网安备：11010802029741号 ICP备案号：京ICP备15016152号-6 六维联合信息科技 (北京) 有限公司©版权所有

  • 客服微信

  • 服务号