NDLI: Using Software Structure to Predict Vulnerability Exploitation Potential

Content Provider	IEEE Xplore Digital Library
Author	Younis, A.A. Malaiya, Y.K.
Copyright Year	2014
Description	Author affiliation: Comput. Sci. Dept., Colorado State Univ., Fort Collins, CO, USA (Younis, A.A.; Malaiya, Y.K.)
Abstract	Most of the attacks on computer systems are due to the presence of vulnerabilities in software. Recent trends show that number of newly discovered vulnerabilities still continue to be significant. Studies have also shown that the time gap between the vulnerability public disclosure and the release of an automated exploit is getting smaller. Therefore, assessing vulnerabilities exploitability risk is critical as it aids decision-makers prioritize among vulnerabilities, allocate resources, and choose between alternatives. Several methods have recently been proposed in the literature to deal with this challenge. However, these methods are either subjective, requires human involvement in assessing exploitability, or do not scale. In this research, our aim is to first identify vulnerability exploitation risk problem. Then, we introduce a novel vulnerability exploitability metric based on software structure properties viz.: attack entry points, vulnerability location, presence of dangerous system calls, and reachability. Based on our preliminary results, reachability and the presence of dangerous system calls appear to be a good indicator of exploitability. Next, we propose using the suggested metric as feature to construct a model using machine learning techniques for automatically predicting the risk of vulnerability exploitation. To build a vulnerability exploitation model, we propose using Support Vector Machines (SVMs). Once the predictor is built, given unseen vulnerable function and their exploitability features the model can predict whether the given function is exploitable or not.
Sponsorship	IEEE Reliability Soc.
Starting Page	13
Ending Page	18
File Size	447646
Page Count	6
File Format	PDF
ISBN	9781479958436
DOI	10.1109/SERE-C.2014.17
Language	English
Publisher	Institute of Electrical and Electronics Engineers, Inc. (IEEE)
Publisher Date	2014-06-30
Publisher Place	USA
Access Restriction	Subscribed
Rights Holder	Institute of Electrical and Electronics Engineers, Inc. (IEEE)
Subject Keyword	Support vector machines Measurement Software Vulnerability Risk Assessment Software Security Metrics Predictive models Feature extraction Software Attack Surface Security Software measurement Machine Learning
Content Type	Text
Resource Type	Article

Sl.	Authority	Responsibilities	Communication Details
1	Ministry of Education (GoI), Department of Higher Education	Sanctioning Authority	https://www.education.gov.in/ict-initiatives
2	Indian Institute of Technology Kharagpur	Host Institute of the Project: The host institute of the project is responsible for providing infrastructure support and hosting the project	https://www.iitkgp.ac.in
3	National Digital Library of India Office, Indian Institute of Technology Kharagpur	The administrative and infrastructural headquarters of the project	Dr. B. Sutradhar bsutra@ndl.gov.in
4	Project PI / Joint PI	Principal Investigator and Joint Principal Investigators of the project	Dr. B. Sutradhar bsutra@ndl.gov.in Prof. Saswat Chakrabarti will be added soon
5	Website/Portal (Helpdesk)	Queries regarding NDLI and its services	support@ndl.gov.in
6	Contents and Copyright Issues	Queries related to content curation and copyright issues	content@ndl.gov.in
7	National Digital Library of India Club (NDLI Club)	Queries related to NDLI Club formation, support, user awareness program, seminar/symposium, collaboration, social media, promotion, and outreach	clubsupport@ndl.gov.in
8	Digital Preservation Centre (DPC)	Assistance with digitizing and archiving copyright-free printed books	dpc@ndl.gov.in
9	IDR Setup or Support	Queries related to establishment and support of Institutional Digital Repository (IDR) and IDR workshops	idr@ndl.gov.in

Using Attack Surface Entry Points and Reachability Analysis to Assess the Risk of Software Vulnerability Exploitability

Password Strength Prediction Using Supervised Machine Learning Techniques

An Approach to Predict Hot Methods using Support Vector Machines

Decision Fusion of Machine Learning Models to Predict Radiotherapy-Induced Lung Pneumonitis

GenderPredictor: A Method to Predict Gender of Customers from E-commerce Website

Using Software Structure to Predict Vulnerability Exploitation Potential

Facial expression recognition using active shape models and support vector machines

Modeling syllable duration in Indian languages using support vector machines

Anomaly Detection Using an Ensemble of Feature Models

Using Software Structure to Predict Vulnerability Exploitation Potential

Similar Documents

Using Attack Surface Entry Points and Reachability Analysis to Assess the Risk of Software Vulnerability Exploitability

Password Strength Prediction Using Supervised Machine Learning Techniques

An Approach to Predict Hot Methods using Support Vector Machines

Decision Fusion of Machine Learning Models to Predict Radiotherapy-Induced Lung Pneumonitis

GenderPredictor: A Method to Predict Gender of Customers from E-commerce Website

Using Software Structure to Predict Vulnerability Exploitation Potential

Facial expression recognition using active shape models and support vector machines

Modeling syllable duration in Indian languages using support vector machines

Anomaly Detection Using an Ensemble of Feature Models

Using Software Structure to Predict Vulnerability Exploitation Potential