Common Vulnerability Scoring System Research Articles

CyPhyR: a cyber‐physical analysis tool for measuring and enabling resiliency in microgrids

This study presents a tool to study the cyber-physical resiliency (CyPhyR) of critical energy infrastructure system, in particular the effect of cyber attacks on the microgrid's resiliency. The developed tool enables measuring resiliency using data from cyber and physical systems and suggests control decisions for resilient planning and operation of the microgrid. The microgrid resiliency is formulated based on graph theory based indices and cyber-power system characteristics. A Common Vulnerability Scoring System based metric called the Cyber Asset Impact Potential is developed and used in the planning phase, and another metric, Cyber Impact Severity is introduced to study the system performance in the operational phase. The information from these two phases is provided to the operator to make informed and proactive decisions to ensure the resilient operation of the microgrid. The performance of the developed tool has been tested using comprehensive real-time cyber-power testbed for a Consortium for Electric Reliability Technology Solutions microgrid test system.

A Threat Computation Model using a Markov Chain and Common Vulnerability Scoring System and its Application to Cloud Security

Securing cyber infrastructures has become critical because they are increasingly exposed to attackers while accommodating a huge number of IoT devices and supporting numerous sophisticated emerging applications. Security metrics are essential for assessing the security risks and making effective decisions concerning system security. Many security metrics rely on mathematical models, but are mainly based on empirical data, qualitative methods, or compliance checking, and this renders the outcome far from satisfactory. Computing the probability of an attack, or more precisely a threat that materialises into an attack, forms an essential basis for a quantitative security metric. This paper proposes a novel approach to compute the probability distribution of cloud security threats based on a Markov chain and Common Vulnerability Scoring System. Moreover, the paper introduces the method to estimate the probability of security attacks. The use of the new security threat model and its computation is demonstrated through their application to estimating the probabilities of cloud threats and types of attacks.

Vulnerability assessment as a service for fog-centric ICT ecosystems: A healthcare use case

Modern ICT ecosystems such as healthcare environments (hospitals, care-centers etc.), operate in different abstraction layers (cloud, fog, extreme-edge) and comprise large numbers of network entities such as terminals, devices, sensors or even specialized appliances (virtual or physical). It is common in such environments, that several network entities with intermittent connectivity, join and leave the network in an unstructured and unsupervised manner (Wi-Fi access-points, BYOD policies, IoT, etc.). Such devices of frivolous nature, or even trusted devices/terminals, are prone to security vulnerabilities, since they are operated by regular, non-expert users who are not aware of any security aspects whatsoever. To effectively manage and proactively protect such large, complex and multilayered networks, dedicated personnel (system administrators, security specialists etc.) must be employed and specialized appliances must be deployed. On the other hand, modern cyber-warfare has become even more elaborate and insightful. Thus, ICT infrastructures must continuously evolve and adapt to the everchanging cyber-threats, which is a rather cumbersome and expensive task to accomplish. Towards addressing the above-mentioned issues, this paper proposes a cross-layered system, which leverages the Software Defined Networking (SDN) paradigm and the distributed Fog architecture, for network slicing and task offloading to provide dynamic, security-aware Vulnerability-Assessment as a service for large ICT infrastructures. The presented system provides seamless assessment for all existing and newly introduced network entities against all known security vulnerabilities, certifies them through a Common Vulnerability Scoring System (CVSS), classifies them according to the cyber-threat they introduce, and finally assigns them to a connectivity-appropriate VLAN. The presented system was preliminarily evaluated under a controlled-conditions simulation environment.

Colored Petri Net Based Cache Side Channel Vulnerability Evaluation

The cache side channel leakage is a very serious security issue in the information security field. In order to solve this problem, a large number of security mechanisms have been applied to protect the cache. However, there are very limited methods we can choose to evaluate the cache side channel vulnerability, therefore, it is hard to know whether our system configuration or applied security mechanisms make caches more resistant to the cache side channel attacks. In this paper, we proposed a colored Petri net based method to model and score the cache side channel vulnerability. When given a side channel attack and related security mechanisms, our method utilized colored Petri net to model the requirements and the attack steps of cache attacks. Then we calculated the probability of success for each attack step according to the requirements and the computer environment, and the Common Vulnerability Scoring System (CVSS) was used to help us score the attack steps. Based on these probabilities and CVSS scores, we finally obtained a total risk score, which represented the threat level of the cache attacks in a specified computer environment with certain security mechanisms. This paper focused on the typical cache attacks and security mechanisms, and our experiments showed that we can conveniently evaluate and compare the threat level of cache attacks in the computer environment with different security mechanisms.

Research on Network Security Quantitative Model Based on Probabilistic Attack Graph

In order to identify the threat of computer network security and evaluate its fragility comprehensively, the related factors of network security are studied, and the methods based on attack graph are improved. Based on the attribute attack graph, the probabilistic attack graph model is generated by adding various factors which affect network security. The model uses security equipment performance data, common vulnerability scoring system data and etc. to calculate priori probability, finally obtains the network security index, and carries on the exploratory analysis. The experimental results show that the model is feasible and effective. Compared with other vulnerability assessment methods, the model has the characteristics of comprehensive evaluation and concise calculation.

Mayall: A Framework for Desktop JavaScript Auditing and Post-Exploitation Analysis

Writing desktop applications in JavaScript offers developers the opportunity to create cross-platform applications with cutting-edge capabilities. However, in doing so, they are potentially submitting their code to a number of unsanctioned modifications from malicious actors. Electron is one such JavaScript application framework which facilitates this multi-platform out-the-box paradigm and is based upon the Node.js JavaScript runtime—an increasingly popular server-side technology. By bringing this technology to the client-side environment, previously unrealized risks are exposed to users due to the powerful system programming interface that Node.js exposes. In a concerted effort to highlight previously unexposed risks in these rapidly expanding frameworks, this paper presents the Mayall Framework, an extensible toolkit aimed at JavaScript security auditing and post-exploitation analysis. This paper also exposes fifteen highly popular Electron applications and demonstrates that two-thirds of applications were found to be using known vulnerable elements with high CVSS (Common Vulnerability Scoring System) scores. Moreover, this paper discloses a wide-reaching and overlooked vulnerability within the Electron Framework which is a direct byproduct of shipping the runtime unaltered with each application, allowing malicious actors to modify source code and inject covert malware inside verified and signed applications without restriction. Finally, a number of injection vectors are explored and appropriate remediations are proposed.

IIoT Cybersecurity Risk Modeling for SCADA Systems

Urban critical infrastructure such as electric grids, water networks, and transportation systems are prime targets for cyberattacks. These systems are composed of connected devices which we call the Industrial Internet of Things (IIoT). An attack on urban critical infrastructure IIoT would cause considerable disruption to society. Supervisory control and data acquisition (SCADA) systems are typically used to control IIoT for urban critical infrastructure. Despite the clear need to understand the cyber risk to urban critical infrastructure, there is no data-driven model for evaluating SCADA software risk for IIoT devices. In this paper, we compare non-SCADA and SCADA systems and establish, using cosine similarity tests, that SCADA as a software subclass holds unique risk attributes for IIoT. We then disprove the commonly accepted notion that the common vulnerability scoring system risk metrics of exploitability and impact are not correlated with attack for the SCADA subclass of software. A series of statistical models are developed to identify SCADA risk metrics that can be used to evaluate the risk that a SCADA-related vulnerability is exploited. Based on our findings, we build a customizable SCADA risk prioritization schema that can be used by the security community to better understand SCADA-specific risk. Considering the distinct properties of SCADA systems, a data-driven prioritization schema will help researchers identify security gaps specific to this software subclass that is essential to our society’s operations.

Algorithms and software solutions for SQL injection vulnerability testing in web applications

Software security gains importance day by day and developers try to secure web applications as much as possible to protect confidentiality, integrity and availability that are described in the fundamental security model so-called CIA triad. SQL injection vulnerability which can violate the confidentiality and integrity principles of the CIA triad is reviewed, and SQL injection attack execution and protection techniques are explained. The common frameworks’ solutions against SQL injection vulnerability were compared, and this comparison shown the most used techniques in this domain. Error-based and time-based detection algorithms for SQL injection’s identification are developed to create a vulnerability scanner that can detect SQL attacks which cause vulnerability in web applications, and these algorithms are represented in form of UML-activity diagrams. In order to discover all possible links and forms to perform SQL injection vulnerability tests in the entire website, a web crawler is needed. Breadth-First Search (BFS) algorithm for developing the web crawler is proposed, and the appropriate pseudo code and activity diagram are provided. Besides, Common Vulnerability Scoring System (CVSS) that is used to measure severity score of attacks that can violate CIA triad principles is reviewed. Qualitative severity score rating scale of CVSS is explained. An example of CVSS calculation is represented. Necessary components of a vulnerability scanner are explained. A vulnerability scanner prototype is developed using explained algorithms. Process results of this vulnerability scanner’s usage for real web applications are represented. Conclusions are made, and goals of future work are defined.

Strict intuitionistic fuzzy entropy and application in network vulnerability evaluation

By analyzing existing construction methods of intuitionistic fuzzy entropy (IFE), the entropies of intuitionistic fuzzy numbers cannot be distinguished when membership function equals non-membership function. The generalization performance of traditional IFE is insufficient. To overcome the limitation of IFE definition, referencing classical mathematic strict comparison operation, an axiomatic definition of strict intuitionistic fuzzy entropy (SIFE) and four constraint requirements are proposed in this paper. Firstly, two SIFE construction methods are proposed and their constraint requirements are certified. Secondly, a general formula is extracted from the novel construction methods. Thirdly, combining vulnerability evaluation model and SIFE theory, IFE is applied in the network information security field. The proposed evaluation model is deployed in the common vulnerability scoring system to evaluate Apache Web Server chunked encoding remote overflow vulnerability. The experiment result shows that the proposed vulnerability evaluation method is a feasible multi-expert evaluation fusing model.

Risk based Security Enforcement in Software Defined Network

Software Defined Network (SDN) paradigm provides intelligent and efficient management of different network control functions (NF) depending on changes in traffic behavior, service providers’ requirements and application context. However, the logical centralization of controllers’ functions opens up challenges towards enforcing security perimeter over the underlying network and the assets involved. In this paper, we propose a risk assessment model for pro-active secure flow control and routing of traffic in SDN. The proposed model determines threat value of different SDN entities by analyzing vulnerability and exposure with respect to Common Vulnerability Scoring System (CVSS). The risk of a given traffic is calculated as cumulative threat values of the SDN entities that guides the flow and routing control functions in generating secure flow rules for the forwarding switches. The efficacy of the proposed model is demonstrated through extensive case studies of an enterprise network.

A Secure, Scalable and Elastic Autonomic Computing Systems Paradigm: Supporting Dynamic Adaptation of Self-* Services from an Autonomic Cloud

Autonomic computing embeds self-management features in software systems using external feedback control loops, i.e., autonomic managers. In existing models of autonomic computing, adaptive behaviors are defined at the design time, autonomic managers are statically configured, and the running system has a fixed set of self-* capabilities. An autonomic computing design should accommodate autonomic capability growth by allowing the dynamic configuration of self-* services, but this causes security and integrity issues. A secure, scalable and elastic autonomic computing system (SSE-ACS) paradigm is proposed to address the runtime inclusion of autonomic managers, ensuring secure communication between autonomic managers and managed resources. Applying the SSE-ACS concept, a layered approach for the dynamic adaptation of self-* services is presented with an online ‘Autonomic_Cloud’ working as the middleware between Autonomic Managers (offering the self-* services) and Autonomic Computing System (requiring the self-* services). A stock trading and forecasting system is used for simulation purposes. The security impact of the SSE-ACS paradigm is verified by testing possible attack cases over the autonomic computing system with single and multiple autonomic managers running on the same and different machines. The common vulnerability scoring system (CVSS metric) shows a decrease in the vulnerability severity score from high (8.8) for existing ACS to low (3.9) for SSE-ACS. Autonomic managers are introduced into the system at runtime from the Autonomic_Cloud to test the scalability and elasticity. With elastic AMs, the system optimizes the Central Processing Unit (CPU) share resulting in an improved execution time for business logic. For computing systems requiring the continuous support of self-management services, the proposed system achieves a significant improvement in security, scalability, elasticity, autonomic efficiency, and issue resolving time, compared to the state-of-the-art approaches.

Exploring Attack Graphs for Security Risk Assessment: A Probabilistic Approach

The attack graph methodology can be used to identify the potential attack paths that an attack can propagate. A risk assessment model based on Bayesian attack graph is presented in this paper. Firstly, attack graphs are generated by the MULVAL (Multi-host, Multistage Vulnerability Analysis) tool according to sufficient information of vulnerabilities, network configurations and host connectivity on networks. Secondly, the probabilistic attack graph is established according to the causal relationships among sophisticated multi-stage attacks by using Bayesian Networks. The probability of successful exploits is calculated by combining index of the Common Vulnerability Scoring System, and the static security risk is assessed by applying local conditional probability distribution tables of the attribute nodes. Finally, the overall security risk in a small network scenario is assessed. Experimental results demonstrate our work can deduce attack intention and potential attack paths effectively, and provide effective guidance on how to choose the optimal security hardening strategy.

TO STUDY AND ANALYZE THE IMPACT OF CONFIDENTIALITY, INTEGRITY, AND AVAILABILITY (CIA) ON COMMON VULNERABILITY SCORING SYSTEM (CVSS) BASE SCORE

The Common Vulnerability Exposure (CVE) is a dictionary of publically known vulnerabilities. The Common Vulnerability Scoring System (CVSS) is a standard vulnerability severity scoring system to assign scores to vulnerabilities identified under CVE. The CVSS is calculated based on three metrics viz. Base metric, Temporal metric, and Environmental metric. The base metric defines the fundamental characteristics of the vulnerability. The temporal metrics define the characteristics of vulnerability which change over the time and the environmental metrics define the characteristics of the vulnerability specific to particular user’s or organization’s environment. The CVSS base score is available, in CVE dictionary and it can be refined by calculating and adding temporal and environmental metric score. In this paper, our objective is to compare and analyze the CVSS base score with an adjusted base score generated after adding user context requirement for CIA. To achieve this objective we have selected Google Android as a platform and apply CIA requirement in user context in various combinations of score viz. High, Low and Medium. The generated adjusted based score was analyzed and compared with existing base score to understand the impact of CIA on vulnerability severity score.

A Vulnerability Assessment Method in Industrial Internet of Things Based on Attack Graph and Maximum Flow

To solve the low attack path quantification degree and complex path finding in the industrial Internet of Things, a vulnerability assessment method based on attack graph and maximum flow is proposed. The method takes into account the factors influencing the attack behavior and relationship between network nodes. The attack risk is calculated by common vulnerability scoring system, which increases the attack path quantification degree. The maximum loss flow describes the attack path, evaluates the network vulnerability by maximum loss flow and loss saturation and represents the vulnerability relevance. Avoiding the repeat calculation and obtaining the potential key vulnerability path fast, the augmented road algorithm is used to find optimal attack path within global path. The result shows that the method is feasible and can evaluate the vulnerability and risk path objectively.

A look at the time delays in CVSS vulnerability scoring

This empirical paper examines the time delays that occur between the publication of Common Vulnerabilities and Exposures (CVEs) in the National Vulnerability Database (NVD) and the Common Vulnerability Scoring System (CVSS) information attached to published CVEs. According to the empirical results based on regularized regression analysis of over eighty thousand archived vulnerabilities, (i) the CVSS content does not statistically influence the time delays, which, however, (ii) are strongly affected by a decreasing annual trend. In addition to these results, the paper contributes to the empirical research tradition of software vulnerabilities by a couple of insights on misuses of statistical methodology.

Analysis and Security Evaluation of Security Threat on Broadcasting Service

This paper defines and maps all possible threats to broadcasting services. Viewers currently use various types of broadcasting services—including cable TV, IPTV, and mobile TV, among others—and broadcast business operators are now developing the appropriate security mechanisms for each medium to safely and reliably provide broadcasting services to their audiences. Unlike mobile TV, which uses of a public network as in an over-the-top configuration, cable TV and IPTV are basically closed networks in terms of network security. However, they also link with external networks to provide additional services (bidirectional services or commerce-related services). Therefore, broadcast business operators of with various types of broadcast media are susceptible to security threats from which their broadcasting services may come to a halt or may be abused by hackers, such as with well-developed APT attacks, as well as other common external attacks. The common vulnerability scoring system for IT security is used to conduct a quantitative evaluation of the risk to security threats for broadcasting services. We also derive the results of a penetration test for the STB through the results presented with respect to a security threat. This result will help address potential security vulnerabilities in broadcasting services.

Can the Common Vulnerability Scoring System be Trusted? A Bayesian Analysis

The Common Vulnerability Scoring System (CVSS) is the state-of-the art system for assessing software vulnerabilities. However, it has been criticized for lack of validity and practitioner relevance. In this paper, the credibility of the CVSS scoring data found in five leading databases-NVD, X-Force, OSVDB, CERT-VN, and Cisco-is assessed. A Bayesian method is used to infer the most probable true values underlying the imperfect assessments of the databases, thus circumventing the problem that ground truth is not known. It is concluded that with the exception of a few dimensions, the CVSS is quite trustworthy. The databases are relatively consistent, but some are better than others. The expected accuracy of each database for a given dimension can be found by marginalizing confusion matrices. By this measure, NVD is the best and OSVDB is the worst of the assessed databases.

Predicting Exploitations of Information Systems Vulnerabilities Through Attackers’ Characteristics

The main goal of proactive security is to prevent attacks before they happen. In modern information systems it largely depends on the vulnerability management process, where prioritization is one of the key steps. A widely used prioritization policy based only upon a common vulnerability scoring system (CVSS) score is frequently criticised for bad effectiveness. The main reason is that the CVSS score alone is not a good predictor of vulnerability exploitation in the wild. Therefore, the aim of the research in this field is to determine in what way we can improve our prediction abilities. Clearly, software vulnerabilities are commodities used by attackers. Hence, it makes sense considering their characteristics in vulnerability prioritization. In contrast, one should be able to measure and compare the effectiveness of various policies. Therefore, an important goal of this paper was to develop an evaluation model, which would allow such comparisons. For this purpose, we developed an agent-based simulation model which measures the exposure of information system to exploitable vulnerabilities. Besides, some policies which take into account human threats were defined and then compared with the most popular existing methods. Experimental results imply that the proposed policy, which is based on CVSS vectors and attacker characteristics, achieves the highest effectiveness among existing methods.

Quantitative Method for Network Security Situation Based on Attack Prediction

Multistep attack prediction and security situation awareness are two big challenges for network administrators because future is generally unknown. In recent years, many investigations have been made. However, they are not sufficient. To improve the comprehensiveness of prediction, in this paper, we quantitatively convert attack threat into security situation. Actually, two algorithms are proposed, namely, attack prediction algorithm using dynamic Bayesian attack graph and security situation quantification algorithm based on attack prediction. The first algorithm aims to provide more abundant information of future attack behaviors by simulating incremental network penetration. Through timely evaluating the attack capacity of intruder and defense strategies of defender, the likely attack goal, path, and probability and time-cost are predicted dynamically along with the ongoing security events. Furthermore, in combination with the common vulnerability scoring system (CVSS) metric and network assets information, the second algorithm quantifies the concealed attack threat into the surfaced security risk from two levels: host and network. Examples show that our method is feasible and flexible for the attack-defense adversarial network environment, which benefits the administrator to infer the security situation in advance and prerepair the critical compromised hosts to maintain normal network communication.

Cybersecurity: A Stochastic Predictive Model to Determine Overall Network Security Risk Using Markovian Process

There are several security metrics developed to protect the computer networks. In general, common security metrics focus on qualitative and subjective aspects of networks lacking formal statistical models. In the present study, we propose a stochastic model to quantify the risk associated with the overall network using Markovian process in conjunction with Common Vulnerability Scoring System (CVSS) framework. The model we developed uses host access graph to represent the network environment. Utilizing the developed model, one can filter the large amount of information available by making a priority list of vulnerable nodes existing in the network. Once a priority list is prepared, network administrators can make software patch decisions. Gaining in depth understanding of the risk and priority level of each host helps individuals to implement decisions like deployment of security products and to design network topologies.