Fuzzy classification metrics for scanner assessment and vulnerability reporting

Authors:
Peter Kok Keong Loh;Deepak Subramanian
Affiliations:
Computer Security Laboratory, Nanyang Technological University, Singapore, Singapore;Computer Security Laboratory, Nanyang Technological University, Singapore, Singapore
Venue:
IEEE Transactions on Information Forensics and Security
Year:
2010

Citing 5
Cited 0

Common Vulnerability Scoring System

IEEE Security and Privacy
Estimating Software Vulnerabilities

IEEE Security and Privacy
Are evolutionary rule learning algorithms appropriate for malware detection?

Proceedings of the 11th Annual conference on Genetic and evolutionary computation
Fuzzy Logic, Soft Computing, and Applications

IWANN '09 Proceedings of the 10th International Work-Conference on Artificial Neural Networks: Part I: Bio-Inspired Systems: Computational and Ambient Intelligence
Fuzzy Heuristic Design for Diagnosis of Web-Based Vulnerabilities

ICIMP '09 Proceedings of the 2009 Fourth International Conference on Internet Monitoring and Protection

Quantified Score

Hi-index	0.00

Visualization

Abstract

In information security, web application scanners detect and provide some diagnoses for specific vulnerabilities. However, scanner performance as well as the damage potential of different vulnerabilities varies. This undermines the development of effective remediation solutions and the reliable sharing of vulnerability information. This paper describes an approach based on soft computing technology for the development of metrics that are used to grade web application scanners and vulnerabilities so that scanner performance can be evaluated and confidence levels can be computed for vulnerability reports. These metrics help derive a level of assurance that will support security management decisions, enhance effective remediation efforts, and could serve as security tool design metrics.