The Vulnerability Instantiation Methodology prototype

Abstract

This report describes the Vulnerability Instantiation Methodology developed by NPL and a prototype that implements the methodology. The prototype takes the output from system security vulnerability detection tools and, using the system security policy, determines which vulnerabilities found by the tools constitute a real threat to the system. The methodology is based around a database of how vulnerabilities can be combined to attack the security of the system.