Security Trend Analysis with CVE Topic Models

Authors:
Stephan Neuhaus;Thomas Zimmermann
Affiliations:
-;-
Venue:
ISSRE '10 Proceedings of the 2010 IEEE 21st International Symposium on Software Reliability Engineering
Year:
2010

Citing 0
Cited 3

Security versus performance bugs: a case study on Firefox

Proceedings of the 8th Working Conference on Mining Software Repositories
Modeling the evolution of topics in source code histories

Proceedings of the 8th Working Conference on Mining Software Repositories
Quo vadis? a study of the evolution of input validation vulnerabilities in web applications

FC'11 Proceedings of the 15th international conference on Financial Cryptography and Data Security

Quantified Score

Hi-index	0.00

Visualization

Abstract

We study the vulnerability reports in the Common Vulnerability and Exposures (CVE) database by using topic models on their description texts to find prevalent vulnerability types and new trends semi-automatically. In our study of the 39,393 unique CVEs until the end of 2009, we identify the following trends, given here in the form of a weather forecast: PHP: declining, with occasional SQL injection. Buffer Overflows: flattening out after decline. Format Strings: in steep decline. SQL Injection and XSS: remaining strong, and rising. Cross-Site Request Forgery: a sleeping giant perhaps, stirring. Application Servers: rising steeply.