Beyond heuristics: learning to classify vulnerabilities and predict exploits

摘要: The security demands on modern system administration are enormous and getting worse. Chief among these demands, administrators must monitor the continual ongoing disclosure of software vulnerabilities that have potential to compromise their systems in some way. Such include buffer overflow errors, improperly validated inputs, other unanticipated attack modalities. In 2008, over 7,400 new were disclosed--well 100 per week. While no enterprise is affected by all disclosures, commonly face many outstanding across they manage. Vulnerabilities can be addressed patches, reconfigurations, workarounds; however, actions may incur down-time or unforeseen side-effects. Thus, a key question for which prioritize. From publicly available databases document past vulnerabilities, we show how train classifiers predict whether soon vulnerability likely exploited. As input, our operate high dimensional feature vectors extract from text fields, time stamps, cross references, entries existing reports. Compared current industry-standard heuristics based expert knowledge static formulas, much more accurately individual