一句话：提出 VDocScan，从规格文档抽取关键词提前预测漏洞，以便在设计阶段集成安全机制。
该论文针对现有漏洞识别主要依赖源码静态/动态分析、难以在架构设计早期集成安全机制的问题，提出 VDocScan：在开发前从产品规格文档中抽取关键词并预测漏洞。作者将 CVE 漏洞报告映射到 3600 多份产品文档构建数据集，使用可解释白盒分类器，并结合关键词相关性提升、类别不平衡处理、按操作系统/Web 应用/硬件等产品类别划分以及随机森林等黑盒集成模型。在 8 个 CWE 漏洞支柱上，白盒方法最高达到 61.1% 精确率和 78% 召回率；改进后达到 96% 精确率和 91.1% 召回率。结果表明可在设计阶段提前预判产品生命周期中的漏洞并规划安全机制，且对架构/设计引入型漏洞表现稳定。
Software development companies heavily invest both time and money to provide post-production support to fix security vulnerabilities in their products. Current techniques identify vulnerabilities from source code using static and dynamic analyses. However, this does not help integrate security mechanisms early in the architectural design phase. We develop VDocScan, a technique for predicting vulnerabilities based on specification documents, even before the development stage. We evaluate VDocScan using an extensive dataset of CVE vulnerability reports mapped to over 3600 product documentations. An evaluation of 8 CWE vulnerability pillars shows that even interpretable whitebox classifiers predict vulnerabilities with up to 61.1% precision and 78% recall. Further, using strategies to improve the relevance of extracted keywords, addressing class imbalance, segregating products into categories such as Operating Systems, Web applications, and Hardware, and using blackbox ensemble models such as the random forest classifier improves the performance to 96% precision and 91.1% recall. The high precision and recall shows that VDocScan can anticipate vulnerabilities detected in a product's lifetime ahead of time during the Design phase to incorporate necessary security mechanisms. The performance is consistently high for vulnerabilities with the mode of introduction: architecture and design.
@inproceedings{PoozhitharaAL23,
title = {Keyword Extraction From Specification Documents for Planning Security Mechanisms},
author = {Jeffy Jahfar Poozhithara and Hazeline U. Asuncion and Brent Lagesse},
booktitle = {ICSE},
year = {2023},
doi = {10.1109/icse48619.2023.00143}
}