NDLI: VRank: A Context-Aware Approach to Vulnerability Scoring and Ranking in SOA

Content Provider	IEEE Xplore Digital Library
Author	Jiang, Jianchun Ding, Liping Zhai, Ennan Yu, Ting
Copyright Year	2012
Abstract	With the rapid adoption of the concepts of Service Oriented Architecture (SOA), sophisticated business processes and tasks are increasingly realized through composing distributed software components offered by different providers. Though such practices offer advantages in terms of cost-effectiveness and flexibility, those components are not immune to vulnerabilities. It is therefore important for the administrator of some composed service to evaluate the threats of such vulnerabilities accordingly within limited available information. Since almost all the existing efforts (e.g., CVSS) fail to consider specific context-aware information which is the specific character of SOA, they could not be adopted into SOA for scoring vulnerabilities. In this paper, we present VRank, a novel framework for the scoring and ranking of vulnerabilities in SOA. Different from existing efforts, for a given vulnerability, VRank not only considers its intrinsic properties (e.g., exploitability), but also takes into account the contexts of the services having this vulnerability, e.g., what roles they play in the composed service and how critical it is to the security objective of the service. The resulting scoring and ranking of vulnerabilities are thus highly relevant and meaningful to the composed service. We present the detailed design of VRank, and compare it with CVSS. Our experiments indicate VRank is able to provide much more useful ranking lists of vulnerabilities for complex composed services.
Starting Page	61
Ending Page	70
File Size	542311
Page Count	10
File Format	PDF
ISBN	9781467320672
DOI	10.1109/SERE.2012.16
Language	English
Publisher	Institute of Electrical and Electronics Engineers, Inc. (IEEE)
Publisher Date	2012-06-20
Publisher Place	USA
Access Restriction	Subscribed
Rights Holder	Institute of Electrical and Electronics Engineers, Inc. (IEEE)
Subject Keyword	Context Availability Databases Service oriented architecture Ranking and Scoring Security Vulnerabilities Service-Oriented Architecture Business
Content Type	Text
Resource Type	Article

Sl.	Authority	Responsibilities	Communication Details
1	Ministry of Education (GoI), Department of Higher Education	Sanctioning Authority	https://www.education.gov.in/ict-initiatives
2	Indian Institute of Technology Kharagpur	Host Institute of the Project: The host institute of the project is responsible for providing infrastructure support and hosting the project	https://www.iitkgp.ac.in
3	National Digital Library of India Office, Indian Institute of Technology Kharagpur	The administrative and infrastructural headquarters of the project	Dr. B. Sutradhar bsutra@ndl.gov.in
4	Project PI / Joint PI	Principal Investigator and Joint Principal Investigators of the project	Dr. B. Sutradhar bsutra@ndl.gov.in Prof. Saswat Chakrabarti will be added soon
5	Website/Portal (Helpdesk)	Queries regarding NDLI and its services	support@ndl.gov.in
6	Contents and Copyright Issues	Queries related to content curation and copyright issues	content@ndl.gov.in
7	National Digital Library of India Club (NDLI Club)	Queries related to NDLI Club formation, support, user awareness program, seminar/symposium, collaboration, social media, promotion, and outreach	clubsupport@ndl.gov.in
8	Digital Preservation Centre (DPC)	Assistance with digitizing and archiving copyright-free printed books	dpc@ndl.gov.in
9	IDR Setup or Support	Queries related to establishment and support of Institutional Digital Repository (IDR) and IDR workshops	idr@ndl.gov.in

Understanding the Vulnerabilities of a SOA Platform - A Case Study

Detecting Vulnerabilities in Service Oriented Architectures

On a Classification Approach for SOA Vulnerabilities

The design of the unified Vulnerability Scanning system based on SOA

A goal question metric approach for evaluating security in a service oriented architecture context.

A Governance Model for SOA

SOA-Based Security Governance Middleware

Context aware SOA based discovery in mobile environment by bi-matchmaking technique

The Architecture of a Secure Business-Process-Management System in Service-Oriented Environments

VRank: A Context-Aware Approach to Vulnerability Scoring and Ranking in SOA

Similar Documents

Understanding the Vulnerabilities of a SOA Platform - A Case Study

Detecting Vulnerabilities in Service Oriented Architectures

On a Classification Approach for SOA Vulnerabilities

The design of the unified Vulnerability Scanning system based on SOA

A goal question metric approach for evaluating security in a service oriented architecture context.

A Governance Model for SOA

SOA-Based Security Governance Middleware

Context aware SOA based discovery in mobile environment by bi-matchmaking technique

The Architecture of a Secure Business-Process-Management System in Service-Oriented Environments

VRank: A Context-Aware Approach to Vulnerability Scoring and Ranking in SOA