arXivDaily arXiv每日学术速递 周一至周五更新
arXiv 2406.05933cs.CR
收藏

面向网络安全漏洞威胁中心化排序的相关性模型

A Relevance Model for Threat-Centric Ranking of Cybersecurity Vulnerabilities

Corren McCoy, Ross Gore, Michael L. Nelson, Michele C. Weigle

备注：
24 pages, 8 figures, 14 tables
阅读 PDF
arXiv 页面 ↗HTML 原文 ↗

AI总结：

本文提出基于MITRE ATT&CK对手标准构建漏洞管理框架，聚合公开数据生成个性化排序策略，相比CVSS显著提升漏洞优先级识别效果并降低修补成本。

摘要：

跟踪和修复漏洞的持续过程是网络安全专业人员的首要关切。关键挑战在于尝试确定一套符合组织内部目标的修复方案。如果没有策略，结果就是针对大量漏洞应用零散的修复措施，其中任何一个漏洞都可能成为原本强大的防御体系中的失效点。鉴于只有少数漏洞会成为现实世界攻击的重点，一种实用的修复策略是识别可能被利用的漏洞，并优先集中精力修复这些漏洞。本研究的目标是证明：聚合和综合易于获取的公开数据源，为组织提供个性化、自动化的建议，以优化其漏洞管理策略，将比使用通用漏洞评分系统（CVSS）带来显著改进。我们提供了一个漏洞管理框架，专门侧重于利用源自MITRE ATT&CK的对手标准来缓解威胁。我们通过识别与六所大学和四个政府设施相关的软件中的漏洞来测试我们的方法。排序策略的性能使用归一化折损累计增益（nDCG）进行衡量。我们的结果表明，在识别可能被网络威胁行为者瞄准和利用的漏洞方面，平均有71.5%至91.3%的改进。使用我们的策略进行修补的投资回报率（ROI）可节省23.3%至25.5%的年度化成本。我们的结果证明了创建知识图谱以连接大型数据集、促进语义查询并创建数据驱动、灵活的排序策略的有效性。

英文摘要：

The relentless process of tracking and remediating vulnerabilities is a top concern for cybersecurity professionals. The key challenge is trying to identify a remediation scheme specific to in-house, organizational objectives. Without a strategy, the result is a patchwork of fixes applied to a tide of vulnerabilities, any one of which could be the point of failure in an otherwise formidable defense. Given that few vulnerabilities are a focus of real-world attacks, a practical remediation strategy is to identify vulnerabilities likely to be exploited and focus efforts towards remediating those vulnerabilities first. The goal of this research is to demonstrate that aggregating and synthesizing readily accessible, public data sources to provide personalized, automated recommendations for organizations to prioritize their vulnerability management strategy will offer significant improvements over using the Common Vulnerability Scoring System (CVSS). We provide a framework for vulnerability management specifically focused on mitigating threats using adversary criteria derived from MITRE ATT&CK. We test our approach by identifying vulnerabilities in software associated with six universities and four government facilities. Ranking policy performance is measured using the Normalized Discounted Cumulative Gain (nDCG). Our results show an average 71.5% - 91.3% improvement towards the identification of vulnerabilities likely to be targeted and exploited by cyber threat actors. The return on investment (ROI) of patching using our policies results in a savings of 23.3% - 25.5% in annualized costs. Our results demonstrate the efficacy of creating knowledge graphs to link large data sets to facilitate semantic queries and create data-driven, flexible ranking policies.

机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。

↑