Security-related vulnerability life cycle analysis - Archive ouverte HAL Accéder directement au contenu
Communication Dans Un Congrès Année : 2012

Security-related vulnerability life cycle analysis

Résumé

This paper deals with the characterization of security-related vulnerabilities based on public data reported in the Open Source Vulnerability Database. We focus on the analysis of vulnerability life cycle events corresponding to the vulnerability discovery, the vulnerability disclosure, the patch release, and the exploit availability. We study the distribution of the time between these events considering different operating systems (Windows, Unix, Mobile OS), and different attributes such as the vulnerability impact on confidentiality, integrity or availability, the access vector reflecting how the vulnerability is exploited, and the complexity of the exploit. The results obtained highlight some interesting trends and behaviours, concerning, e.g. the time between the disclosure of a vulnerability and the availability of a patch or of the exploit, that are sometimes specific to the considered operating system or the vulnerability attributes. The results are also aimed at providing useful inputs to security risk assessment and modelling studies.
Fichier principal
Vignette du fichier
crisis_2012-VachENicometteKaaniche.pdf (1.52 Mo) Télécharger le fichier
Origine : Fichiers produits par l'(les) auteur(s)
Loading...

Dates et versions

hal-00851866 , version 1 (24-08-2013)

Identifiants

Citer

Géraldine Vache Marconato, Vincent Nicomette, Mohamed Kaâniche. Security-related vulnerability life cycle analysis. 7th International Conference on Risk and Security of Internet and Systems (CRiSIS-2012), Oct 2012, Cork, Ireland. pp.1-8, ⟨10.1109/CRISIS.2012.6378954⟩. ⟨hal-00851866⟩
244 Consultations
355 Téléchargements

Altmetric

Partager

Gmail Facebook X LinkedIn More