xVDB: A High-Coverage Approach for Constructing a Vulnerability Database
Security patches play an important role in detecting and fixing one-day vulnerabilities. However, collecting abundant security patches from diverse data sources is not a simple task. This is because (1) each data source provides vulnerability information in a different way and (2) many security patc...
| Main Authors: | , , , , |
|---|---|
| Format: | Article |
| Language: | English |
| Published: |
IEEE
2022-01-01
|
| Series: | IEEE Access |
| Subjects: | |
| Online Access: | https://ieeexplore.ieee.org/document/9853545/ |
| _version_ | 1818486408852013056 |
|---|---|
| author | Hyunji Hong Seunghoon Woo Eunjin Choi Jihyun Choi Heejo Lee |
| author_facet | Hyunji Hong Seunghoon Woo Eunjin Choi Jihyun Choi Heejo Lee |
| author_sort | Hyunji Hong |
| collection | DOAJ |
| description | Security patches play an important role in detecting and fixing one-day vulnerabilities. However, collecting abundant security patches from diverse data sources is not a simple task. This is because (1) each data source provides vulnerability information in a different way and (2) many security patches cannot be directly collected from Common Vulnerabilities and Exposures (CVE) information (<italic>e</italic>. <italic>g</italic>., National Vulnerability Database (NVD) references). In this paper, we propose a high-coverage approach that collects known security patches by tracking multiple data sources. Specifically, we considered the following three data sources: repositories (<italic>e</italic>. <italic>g</italic>., GitHub), issue trackers (<italic>e</italic>. <italic>g</italic>., Bugzilla), and Q&A sites (<italic>e</italic>. <italic>g</italic>., Stack Overflow). From the data sources, we gather even security patches that cannot be collected by considering only CVE information (<italic>i</italic>. <italic>e</italic>., previously untracked security patches). In our experiments, we collected 12,432 CVE patches from repositories and issue trackers, and 12,458 insecure posts from Q&A sites. We could collect at least four times more CVE patches than those collected in existing approaches, which demonstrates the efficacy of our approach. The collected security patches serves as a database on a public website (<italic>i</italic>. <italic>e</italic>., IoTcube) to proceed with the detection of vulnerable code clones. |
| first_indexed | 2024-12-10T16:22:35Z |
| format | Article |
| id | doaj.art-5fbbcab8a56f4b5f830284aa569009a0 |
| institution | Directory Open Access Journal |
| issn | 2169-3536 |
| language | English |
| last_indexed | 2024-12-10T16:22:35Z |
| publishDate | 2022-01-01 |
| publisher | IEEE |
| record_format | Article |
| series | IEEE Access |
| spelling | doaj.art-5fbbcab8a56f4b5f830284aa569009a02022-12-22T01:41:46ZengIEEEIEEE Access2169-35362022-01-0110850508506310.1109/ACCESS.2022.31977869853545xVDB: A High-Coverage Approach for Constructing a Vulnerability DatabaseHyunji Hong0https://orcid.org/0000-0003-0600-606XSeunghoon Woo1https://orcid.org/0000-0002-5455-0804Eunjin Choi2Jihyun Choi3https://orcid.org/0000-0002-3071-6726Heejo Lee4https://orcid.org/0000-0002-5831-0787Department of Computer Science and Engineering, Korea University, Seoul, South KoreaDepartment of Computer Science and Engineering, Korea University, Seoul, South KoreaDepartment of Computer Science and Engineering, Korea University, Seoul, South KoreaDepartment of Computer Science and Engineering, Korea University, Seoul, South KoreaDepartment of Computer Science and Engineering, Korea University, Seoul, South KoreaSecurity patches play an important role in detecting and fixing one-day vulnerabilities. However, collecting abundant security patches from diverse data sources is not a simple task. This is because (1) each data source provides vulnerability information in a different way and (2) many security patches cannot be directly collected from Common Vulnerabilities and Exposures (CVE) information (<italic>e</italic>. <italic>g</italic>., National Vulnerability Database (NVD) references). In this paper, we propose a high-coverage approach that collects known security patches by tracking multiple data sources. Specifically, we considered the following three data sources: repositories (<italic>e</italic>. <italic>g</italic>., GitHub), issue trackers (<italic>e</italic>. <italic>g</italic>., Bugzilla), and Q&A sites (<italic>e</italic>. <italic>g</italic>., Stack Overflow). From the data sources, we gather even security patches that cannot be collected by considering only CVE information (<italic>i</italic>. <italic>e</italic>., previously untracked security patches). In our experiments, we collected 12,432 CVE patches from repositories and issue trackers, and 12,458 insecure posts from Q&A sites. We could collect at least four times more CVE patches than those collected in existing approaches, which demonstrates the efficacy of our approach. The collected security patches serves as a database on a public website (<italic>i</italic>. <italic>e</italic>., IoTcube) to proceed with the detection of vulnerable code clones.https://ieeexplore.ieee.org/document/9853545/Open source softwaresoftware securityvulnerability database |
| spellingShingle | Hyunji Hong Seunghoon Woo Eunjin Choi Jihyun Choi Heejo Lee xVDB: A High-Coverage Approach for Constructing a Vulnerability Database IEEE Access Open source software software security vulnerability database |
| title | xVDB: A High-Coverage Approach for Constructing a Vulnerability Database |
| title_full | xVDB: A High-Coverage Approach for Constructing a Vulnerability Database |
| title_fullStr | xVDB: A High-Coverage Approach for Constructing a Vulnerability Database |
| title_full_unstemmed | xVDB: A High-Coverage Approach for Constructing a Vulnerability Database |
| title_short | xVDB: A High-Coverage Approach for Constructing a Vulnerability Database |
| title_sort | xvdb a high coverage approach for constructing a vulnerability database |
| topic | Open source software software security vulnerability database |
| url | https://ieeexplore.ieee.org/document/9853545/ |
| work_keys_str_mv | AT hyunjihong xvdbahighcoverageapproachforconstructingavulnerabilitydatabase AT seunghoonwoo xvdbahighcoverageapproachforconstructingavulnerabilitydatabase AT eunjinchoi xvdbahighcoverageapproachforconstructingavulnerabilitydatabase AT jihyunchoi xvdbahighcoverageapproachforconstructingavulnerabilitydatabase AT heejolee xvdbahighcoverageapproachforconstructingavulnerabilitydatabase |