针对CVSS(common vulnerability scoring system)方法很少考虑随时间改变的动态指标对脆弱性严重性评估的动态影响,提出一种脆弱性严重性动态综合量化评估方法(dynamic vulnerability severity assessment,DVSA).在CVSS评分的基础上,引入脆弱性代码可利用性和补丁修复等级2个动态指标.安全影响、静态脆弱性可利用性和动态脆弱性可利用性3个脆弱性指标被选取,并进行脆弱性指标量化.该方法可获得每个脆弱性从0到10的严重性量化值,并将脆弱性严重性等级评定为高危、中危和低危3个严重等级.实验结果表明DVSA方法可提高脆弱性严重性评估结果的多样性和准确性.
The vulnerability severity evaluation is rarely considered the dynamic indicator with changing time in the CVSS method, so the paper proposes a method of dynamic vulnerability severity assessment(DVSA).The code exploitability and the patch remediation level of dynamical indexes are introduced based on the CVSS score.Three vulnerability indexes, such as the safety influence attribute, the static vulnerability exploitability attribute and the dynamic vulnerability exploitability attribute, are selected and quantified.The vulnerability severity is evaluated with values from 0 to 10 by using the DVSA method, which can divide vulnerability severity rank into three levels: high, moderate and low.Experimental results showed that this method can more precisely distinguish the difference between vulnerabilities, and improve the diversity and accuracy of the vulnerability severity evaluation.
[1] 中国信息安全测评中心.China national vulnerability database of information security(CNNVD)[EB/OL]. [2017-5-2].http://www.cnnvd.org.cn/.
[2] 高妮.网络安全多维动态风险评估关键技术研究[D].西安:西北大学, 2016. GAO N.The research on key technologies of multi-dimensional and dynamic risk assement of network security[D].Xi’an:Northwest University, 2016.
[3] THE MITRE CORPORATION.Common vulnerabilities and exposures(CVE)[EB/OL].[2017-4-24].http://www.cve.mitre.org/.
[4] NATIONAL INSTITUTE OF STANDARDS AND TECHNOLOGY.National vulnerability database(NVD)[EB/OL]. [2017-1-23].https://nvd.nist.gov/download.cfm.
[5] AHMED M S, AI-SHAER E, KHAN L.A novel quantitative approach for measuring network security[Z].International Conference on Computer Communications, Phoenix, 2008.
[6] DINH T N, YING X, THAI M T, et al.On new approaches of assessing network vulnerability: hardness and approximation[J].IEEE/ACM Transactions on Networking, 2012, 20(2):609-619.
[7] YANG H, ZHANG Y, HU Y, et al.IKE vulnerability discovery based on fuzzing[J].Security & Communication Networks, 2013, 6(7):889-901.
[8] LIU Q, ZHANG Y, KONG Y, et al.Improving VRSS-based vulnerability prioritization using analytic hierarchy process[J].Journal of Systems and Software, 2012, 85(8):1699-1708.
[9] 付志耀, 高岭, 孙骞, 等.基于粗糙集的脆弱性属性约简及严重性评估[J].计算机研究与发展, 2016, 53(5):1009-1017.DOI: 10.7544/issn1000-1239.2016.20150065. FU Z Y, GAO L, SUN Q, et al.Evaluation of vulnerability severity based on rough sets and attributes reduction[J].Journal of Computer Research and Development, 2016, 53(5):1009-1017.DOI: 10.7544/issn1000-1239.2016.20150065.
[10] FREI S, MAY M, FIEDLER U, et al.Large-scale vulnerability analysis[Z].Proceedings of the Workshop on Large-scale Attack Defense, Pisa, 2006:131-138.
