Skip to main content
SpringerLink
Log in

A Security Vulnerability Threat Classification Method

  • Conference paper
  • First Online:
Advances on Broad-Band Wireless Computing, Communication and Applications (BWCCA 2017)

Part of the book series: Lecture Notes on Data Engineering and Communications Technologies ((LNDECT,volume 12))

Abstract

In the management and assessment of security vulnerabilities, it is always involving the task of threat classification. The traditional method requires the professional security management personnel to assess the vulnerability by analyzing the factors of access paths, the complexity, influence degree (confidentiality, integrity, availability) and the others. Due to the huge number and constantly generated security vulnerabilities, it needs a lot of professionals to manage, so that it may be due to the different subjective judgment criteria, judgment mistakes, lacking knowledge, etc., which caused the inconsistent, incorrect and inaccurate classification result of security vulnerabilities. In this paper, a GBDT based security vulnerability threat classification method is proposed, and effective features are extracted from semi-structured vulnerability description. In the experimental part, the supervised classification experiment was carried out by using the CNNVD (China National Vulnerability Database) from 1988 to the present which was manually annotated. The experimental results show that the proposed method has a good practical effect.

This is a preview of subscription content, log in via an institution to check access.

Access this chapter

Log in via an institution
Chapter
USD 29.95
Price excludes VAT (USA)
  • Available as PDF
  • Read on any device
  • Instant download
  • Own it forever
eBook
USD 169.00
Price excludes VAT (USA)
  • Available as EPUB and PDF
  • Read on any device
  • Instant download
  • Own it forever
Softcover Book
USD 219.99
Price excludes VAT (USA)
  • Compact, lightweight edition
  • Dispatched in 3 to 5 business days
  • Free shipping worldwide - see info

Tax calculation will be finalised at checkout

Purchases are for personal use only

Institutional subscriptions

References

  1. Liu, Q.X., Zhang, C.B., Zhang, Y.Q., et al.: Research on key technology of vulnerability threat classification. J. Commun. (2012)

    Google Scholar 

  2. Kostopoulos, G.: Cyberspace and cybersecurity. CRC Press (2012)

    Google Scholar 

  3. Grance, T., Kuhn, R., Landau, S.: Common vulnerability scoring system. IEEE Secur. Priv. 4(6), 85–89 (2007)

    Google Scholar 

  4. Schiffman, M., Eschelbeck, G., Ahmad, D., et al.: CVSS: a common vulnerability scoring system. National Infrastructure Advisory Council (NIAC) (2004)

    Google Scholar 

  5. Mell, P., Scarfone, K., Romanosky, S.: A Complete Guide to the Common Vulnerability Scoring System (CVSS) Version 2.0 (2007)

    Google Scholar 

  6. NVD CVSS Support (2017), http://nvd.nist.gov/cvss.cfm

  7. Fruhwirth, C., Mannisto, T.: Improving CVSS-based vulnerability prioritization and response with context information. In: International Symposium on Empirical Software Engineering and Measurement, pp. 535–544. IEEE Computer Society (2009)

    Google Scholar 

  8. Wang, L., Jajodia, S., Singhal, A., et al.: k-zero day safety: measuring the security risk of networks against unknown attacks. Lect. Notes Comput. Sci. 11(1), 573–587 (2010)

    Article  Google Scholar 

  9. Bhatt, S., Horne, W., Rao, P.: On computing enterprise IT risk metrics. In: Future Challenges in Security and Privacy for Academia and Industry. Springer, Heidelberg, pp. 271–280 (2013)

    Google Scholar 

  10. Liu, Q., Zhang, Y.: VRSS: A new system for rating and scoring vulnerabilities ☆. Comput. Commun. 34(3), 264–273 (2011)

    Article  Google Scholar 

  11. Zhang, Y.Q., Shu-Ping, W.U., Liu, Q.X., et al.: Design and implementation of national security vulnerability database. J. Commun. 32(6), 93–100 (2011)

    Google Scholar 

  12. Gradient_boosting (2017), https://en.wikipedia.org/wiki/Gradient_boosting

  13. Friedman, J.H.: Greedy function approximation: a gradient boosting machine. Ann. Stat. 29(5), 1189–1232 (2001)

    Article  MathSciNet  MATH  Google Scholar 

  14. Bowers, S., Bowers, S., Bowers, S., et al.: Practical lessons from predicting clicks on ads at Facebook. In: Eighth International Workshop on Data Mining for Online Advertising, pp. 1–9. ACM (2014)

    Google Scholar 

Download references

Acknowledgments

Thanks to the China Information Technology Security Evaluation Center for this experiment to provide data and technical support.

Author information

Authors and Affiliations

  1. China Information Technology Security Evaluation Center, Beijing, 100085, China

    Yuanwei Hou & Yongle Hao

  2. School of Software and Microelectronics, Peking University, Beijing, 100871, China

    Yuanwei Hou, Xingzhang Ren, Tong Mo & Weiping Li

Authors
  1. Yuanwei Hou
    View author publications

    You can also search for this author in PubMed Google Scholar

  2. Xingzhang Ren
    View author publications

    You can also search for this author in PubMed Google Scholar

  3. Yongle Hao
    View author publications

    You can also search for this author in PubMed Google Scholar

  4. Tong Mo
    View author publications

    You can also search for this author in PubMed Google Scholar

  5. Weiping Li
    View author publications

    You can also search for this author in PubMed Google Scholar

Corresponding author

Correspondence to Yuanwei Hou .

Editor information

Editors and Affiliations

  1. Faculty of Information Engineering, Department of Information and Communication Engineering, Fukuoka Institute of Technology, Fukuoka, Japan

    Leonard Barolli

  2. Technical University of Catalonia, Barcelona, Spain

    Fatos Xhafa

  3. Open University of Catalonia, Barcelona, Spain

    Jordi Conesa

Rights and permissions

Reprints and permissions

Copyright information

© 2018 Springer International Publishing AG

About this paper

Check for updates. Verify currency and authenticity via CrossMark

Cite this paper

Hou, Y., Ren, X., Hao, Y., Mo, T., Li, W. (2018). A Security Vulnerability Threat Classification Method. In: Barolli, L., Xhafa, F., Conesa, J. (eds) Advances on Broad-Band Wireless Computing, Communication and Applications. BWCCA 2017. Lecture Notes on Data Engineering and Communications Technologies, vol 12. Springer, Cham. https://doi.org/10.1007/978-3-319-69811-3_38

Download citation

  • DOI: https://doi.org/10.1007/978-3-319-69811-3_38

  • Published:

  • Publisher Name: Springer, Cham

  • Print ISBN: 978-3-319-69810-6

  • Online ISBN: 978-3-319-69811-3

  • eBook Packages: EngineeringEngineering (R0)

Publish with us

Policies and ethics

Search

Navigation