Journal of Hebei University(Natural Science Edition) >

2017 , Vol. 37 >Issue 4: 405 - 410

DOI: https://doi.org/10.3969/j.issn.1000-1565.2017.04.012脆弱性严重性动态综合量化评估方法

A dynamic and comprehensive quantitative scoring method of vulnerability severity

  • GAO Ni ,
  • HE Yiyue ,
  • CHANG Yanshuo ,
  • WANG Mengyang
Expand
  • 1.School of Information, Xi’an University of Finance and Economics, Xi’an 710100, China; 2.School of Economics and Management, Northwest University, Xi’an 710127, China; 3.People's Bank of China Xi’an Branch, Xi’an 710075, China

Received date: 2016-08-22

  Online published: 2017-07-25

Fold

Abstract

The vulnerability severity evaluation is rarely considered the dynamic indicator with changing time in the CVSS method, so the paper proposes a method of dynamic vulnerability severity assessment(DVSA).The code exploitability and the patch remediation level of dynamical indexes are introduced based on the CVSS score.Three vulnerability indexes, such as the safety influence attribute, the static vulnerability exploitability attribute and the dynamic vulnerability exploitability attribute, are selected and quantified.The vulnerability severity is evaluated with values from 0 to 10 by using the DVSA method, which can divide vulnerability severity rank into three levels: high, moderate and low.Experimental results showed that this method can more precisely distinguish the difference between vulnerabilities, and improve the diversity and accuracy of the vulnerability severity evaluation.

Key words： vulnerability; vulnerability severity evaluation; the code exploitability of vulnerability

Cite this article

GAO Ni , HE Yiyue , CHANG Yanshuo , WANG Mengyang . A dynamic and comprehensive quantitative scoring method of vulnerability severity[J]. Journal of Hebei University(Natural Science Edition), 2017 , 37(4) : 405 -410 . DOI: 10.3969/j.issn.1000-1565.2017.04.012脆弱性严重性动态综合量化评估方法

References

[1] 中国信息安全测评中心.China national vulnerability database of information security(CNNVD)[EB/OL]. [2017-5-2].http://www.cnnvd.org.cn/.
[2] 高妮.网络安全多维动态风险评估关键技术研究[D].西安:西北大学, 2016. GAO N.The research on key technologies of multi-dimensional and dynamic risk assement of network security[D].Xi’an:Northwest University, 2016.
[3] THE MITRE CORPORATION.Common vulnerabilities and exposures(CVE)[EB/OL].[2017-4-24].http://www.cve.mitre.org/.
[4] NATIONAL INSTITUTE OF STANDARDS AND TECHNOLOGY.National vulnerability database(NVD)[EB/OL]. [2017-1-23].https://nvd.nist.gov/download.cfm.
[5] AHMED M S, AI-SHAER E, KHAN L.A novel quantitative approach for measuring network security[Z].International Conference on Computer Communications, Phoenix, 2008.
[6] DINH T N, YING X, THAI M T, et al.On new approaches of assessing network vulnerability: hardness and approximation[J].IEEE/ACM Transactions on Networking, 2012, 20(2):609-619.
[7] YANG H, ZHANG Y, HU Y, et al.IKE vulnerability discovery based on fuzzing[J].Security & Communication Networks, 2013, 6(7):889-901.
[8] LIU Q, ZHANG Y, KONG Y, et al.Improving VRSS-based vulnerability prioritization using analytic hierarchy process[J].Journal of Systems and Software, 2012, 85(8):1699-1708.
[9] 付志耀, 高岭, 孙骞, 等.基于粗糙集的脆弱性属性约简及严重性评估[J].计算机研究与发展, 2016, 53(5):1009-1017.DOI: 10.7544/issn1000-1239.2016.20150065. FU Z Y, GAO L, SUN Q, et al.Evaluation of vulnerability severity based on rough sets and attributes reduction[J].Journal of Computer Research and Development, 2016, 53(5):1009-1017.DOI: 10.7544/issn1000-1239.2016.20150065.
[10] FREI S, MAY M, FIEDLER U, et al.Large-scale vulnerability analysis[Z].Proceedings of the Workshop on Large-scale Attack Defense, Pisa, 2006:131-138.
Options
Outlines

/

〈 〉