一句话:提出面向 Web 漏洞的受影响/未受影响版本精确自动分析,以改善公共漏洞库版本信息质量。
Web 应用因流行且漏洞众多而成为攻击目标,漏洞的受影响版本是缓解威胁的重要信息。然而,要准确维护该信息非常困难:确认某个版本是否受影响需要安全专业知识与大量人力,而通常有数百个版本待检查,导致几乎所有公共漏洞数据库中的版本信息质量偏低。本文研究面向 Web 漏洞的精确受影响/未受影响版本分析,目标是提供一种能自动且精确地将大量软件版本判定为受影响或未受影响的工具。摘要强调该工具可处理很大一部分(即使不是全部)版本,从而提升漏洞影响范围信息的自动化与准确性;具体方法与评估细节未在摘要中展开。
Web applications are attractive attack targets given their popularity and large number of vulnerabilities. To mitigate the threat of web vulnerabilities, an important piece of information is their affected versions. However, it is non-trivial to build accurate affected version information because confirming a version as affected or unaffected requires security expertise and huge efforts, while there are usually hundreds of versions to examine. As a result, such information is maintained in a low-quality manner in almost every public vulnerability database. Therefore, it is extremely useful to have a tool that can automatically and precisely examine a large part (even if not all) of the software versions as affected or unaffected.