NVD漏洞版本数据的可靠性分析--基于Google Chrome漏洞的实证研究
The (Un)Reliability of NVD Vulnerable Versions Data: an Empirical Experiment on Google Chrome Vulnerabilities
摘要：
NVD是研究人员用于对漏洞数据集进行实证研究的最受欢迎的数据库之一。我们最近对NVD报告的Chrome漏洞数据进行了分析，发现数据中存在一个异常现象，几乎所有漏洞都源于第一个版本。这启发了我们的实验来验证NVD脆弱版本数据的可靠性。在这个实验中，我们验证了NVD声称易受攻击的每个Chrome版本实际上都是易受攻击的。该实验揭示了Chrome漏洞数据中的几个错误。此外，我们还分析了这些错误如何影响基础脆弱性实证研究的结论。结果表明，由于数据误差的影响，可能会得出不同的结论。
英文摘要：
NVD is one of the most popular databases used by researchers to conduct empirical research on data sets of vulnerabilities. Our recent analysis on Chrome vulnerability data reported by NVD has revealed an abnormally phenomenon in the data where almost vulnerabilities were originated from the first versions. This inspires our experiment to validate the reliability of the NVD vulnerable version data. In this experiment, we verify for each version of Chrome that NVD claims vulnerable is actually vulnerable. The experiment revealed several errors in the vulnerability data of Chrome. Furthermore, we have also analyzed how these errors might impact the conclusions of an empirical study on foundational vulnerability. Our results show that different conclusions could be obtained due to the data errors.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
