Towards Automated Risk Analysis of "One-day" Vulnerabilities - Inria - Institut national de recherche en sciences et technologies du numérique Access content directly
Conference Papers Year : 2019

Towards Automated Risk Analysis of "One-day" Vulnerabilities


Common Vulnerabilities and Exposures (CVE) databases such as Mitre’s CVE List and NIST’s NVD database identify every disclosed vulnerability affecting any public software. However, during the early hours of a vulnerability disclosure, the metadata associated with these vulnerabilities is either missing, wrong, or at best sparse. This creates a challenge for robust automated analysis of new vulnerabilities. We present a new technique based on TF-IDF to map newly disclosed vulnerabilities to the most probably affected software products, formulated as an ordered list of relevant entries in the Common Platform Enumeration (CPE) database. For doing so we rely only on the human readable description of the vulnerability without any need for metadata.


Fichier principal
Vignette du fichier
clement_elbaz_oneday_vulnerabilities_ressi2019_paper.pdf (100.07 Ko) Télécharger le fichier
Origin Files produced by the author(s)

Dates and versions

hal-02267192 , version 1 (19-08-2019)


  • HAL Id : hal-02267192 , version 1


Clément Elbaz, Louis Rilling, Christine Morin. Towards Automated Risk Analysis of "One-day" Vulnerabilities. RESSI 2019 - Rendez-vous de la Recherche et de l'Enseignement de la Sécurité des Systèmes d'Information, Aug 2019, Erquy, France. pp.1-3. ⟨hal-02267192⟩
166 View
232 Download


Gmail Mastodon Facebook X LinkedIn More