Representativeness in the Benchmark for Vulnerability Analysis Tools - - PowerPoint PPT Presentation

▶

Oct 05, 2022 423 likes •565 views

Representativeness in the Benchmark for Vulnerability Analysis Tools ( B-VAT ) Kayla Afanador (Keen) Cynthia Irvine Preliminary Work Paper Naval Postgraduate School Naval Postgraduate School Length: Short Start Visualizations (CVE)

SLIDE 1

Representativeness

in the Benchmark for Vulnerability Analysis Tools (B-VAT)

Kayla Afanador (Keen)

Naval Postgraduate School

Cynthia Irvine

Naval Postgraduate School

Preliminary Work Paper

Length: Short

SLIDE 2

Too many vulnerabilities to rely on manual analysis alone. VATs compliment the analysis process, but there are a lot of tools… No standard method (benchmark) to compare the tools. Vulnerability types disproportionately represented

Start Crawl CWE Analyze CVEs Additional CWE’s? Yes Yes Additional CVE’s? No No Create cwe.json Create cve.csv combined.json Analyze Vuln. databases Create datasets.csv Create dataset.json Create dataset.json Create dataset.json Create dataset.json Create dataset.json (CWE) Weakness Types (CVE) Vulnerability Instances Existing Datasets Visualizations

The Problem: No benchmark to compare VATs

SLIDE 3

Relevant

problems representative of reality

Repeatable

results should be consistently reproduced when the benchmark is run with the same tool

Usable

able to be used in multiple operating environments, and run with a variety of tools

Fair

not be partial to any particular tool

Verifiable

confidence that benchmark results are accurate

The Solution: B-VAT

SLIDE 4

CVE’s as vulnerability instances

A dictionary of publicly known vulnerability and exposure instances

1999-2020 over 160k CVEs

SLIDE 5

Over half, 93,056, of all CVE entries published between 2014-2019 (75k accepted).

A dictionary of publicly known vulnerability and exposure instances

CVE’s as vulnerability instances

SLIDE 6

Crawled over 1k CWE pages to create tree data structures for each of the ten CWE Pillars. Use root node (1000) to create single rooted tree

Community developed list of weaknesses with security ramifications

CWE’s as Weakness Types

SLIDE 7

55,128 CVEs with associated CWE ID Trace each CVE to 1 of 10 CWE pillars (the most abstract weakness types)

Use existing CVE/CWE correlation to classify vulnerability instances by associated weakness type

Pillar Node CWE-1000

CVE’s&CWE’s to create a representative set

SLIDE 8

Pillar node CWE-664 represent 45% of CVE’s from 2014-2019

a subset of test cases that adequately represents the larger set of known vulnerability instances and types

CVE’s&CWE’s to create a representative set

Pillar Node CWE-1000

Representative Set:

SLIDE 9

Coming Soon

The representative set

Existing datasets may not be representative

Juliet C/C++ Juliet Java CGC Corpus OWASP Benchmark Stonesoup B-VAT

SLIDE 10

55,128 2,301

Allows sub-groups or “strata” to be proportionately represented Provides a representative sample of a larger population Preserves the relative proportions of each pillar Random sampling results in the misrepresentation of vulnerability instances and weakness types

Identifying a representative subset for B-VAT

Stratified Sample:

SLIDE 11

Relevant

problems representative of reality

Repeatable

results should be consistently reproduced when the benchmark is run with the same tool

Usable

able to be used in multiple operating environments, and run with a variety of tools

Fair

not be partial to any particular tool

Verifiable

confidence that benchmark results are accurate

Recap & Next Steps

SLIDE 12

Special thanks to Dr. Lyn Whitaker for the valuable discussions

Thank you

Kayla Afanador (Keen)

knkeen@nps.edu

Cynthia Irvine

irvine@nps.edu