0

This question is related to an earlier questions: 1 & 2 about the limitations in web application vulnerability scoring/automated vulnerability scoring. Indeed, scoring vulnerabilities detected in web and REST-based applications is not straight-forward, and challenging to automate. While software packages are scored using the CVSS (e.g. NVD maintains CVE for reported vulnerabilities and assigns appropriate scores), web applications are not scored centrally. However, there are several sources of vulnerability information for web applications which could be leveraged e.g. CWE. Can machine learning approaches e.g. text vectorization be used to solve this challenge since several problems in security have benefitted from machine learning ?

An example : If a detected web application vulnerability is described as "A XSS attack was reflected in a JSON response, this might leave content consumers vulnerable to attack if they don't appropriately handle the data (response)." and assigned CWE Id 79. Can a text matching algorithm grap specified keywords in the description e.g. "XSS attack" and "JSON response" for analysis and compute severity scores using sources e.g. CWE and CVSS ?

A short research leads me to tensorflow's word2vec model, can it potentially solve this challenge ?

I will be happy to hear if such techniques exist within the security community or if this kinds of approaches are limited in certain ways.

Note: I have asked the same question on Data Science and it recives no attention probably because the problem space is very specific.

  • Interesting question but I consider it off-topic with its current focus. I think that you concentrate too much on the technical side. The main question for me is instead if all the information which are needed to create such a score are in the input data in the first place: would a human with enough time but without additional expertise be able to create such score just by using the input data? If not then a machine will not be able to do it either. Once you've made sure that the necessary information are there you can care about the algorithm, but this is more on-topic at Data Science. – Steffen Ullrich Jul 22 '18 at 5:56
  • I have asked the same question on Data Science and it recives no attention probably because the problem space is very specific. – SyCode Jul 22 '18 at 6:01
  • "...probably because the problem space is very specific" - I doubt that this is the case. You are essentially asking if some only broadly described data can be used to learn something specific. It is not even clear from your description if these broadly described data contain the necessary information to learn the expected thing in the first place. Again, first check if a human would be able to create some useful score just based on these data. – Steffen Ullrich Jul 22 '18 at 6:08
  • @Steffen Ullrich thank youfor you comments. Do you think the question should be reframed ? I tried to express that the training data contains some answers in the example, by adding '"for analysis and compute severity scores using sources e.g. CWE and CVSS ? "'. – SyCode Jul 22 '18 at 6:12
  • Maybe more like this: provide a sufficiently large corpus of input data (text) which has already the labels you expect (the score) and then you can ask how and how reliable the score can be derived from the input data. But just giving a small example is not sufficient since it provides no information of the variance contained in the rest of the input data and how many input data you have. The larger the variance the more input you need to derive something useful. – Steffen Ullrich Jul 22 '18 at 6:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.