一句话:构建覆盖 17 个漏洞数据源的统一数据集 VulZoo,并提供源间关联与自动化数据处理工具。
软件漏洞是重要的安全与风险问题,已有大量技术用于漏洞评估与优先级排序,但研究者通常只能从有限数据源自行构造数据集,既缺乏对广泛漏洞情报的全局视图,又因重复的数据准备工作而难以评估新方案。为此,作者提出 VulZoo:一个覆盖 17 个漏洞数据源的综合性漏洞情报数据集,并在这些数据源之间建立关联,使不同任务能更直接地进行配置与适配。VulZoo 还提供实用脚本,支持数据自动同步与清洗、关系挖掘以及统计信息生成。该数据集已公开并提供增量维护更新。作者认为 VulZoo 可作为漏洞评估与优先级排序研究的重要输入,其视频与数据集仓库均已公开。
Software vulnerabilities pose critical security and risk concerns. Many techniques are proposed to assess and prioritize vulnerabilities. To evaluate their performance, researchers often craft datasets from limited data sources, lacking a global overview of broad vulnerability intelligence. The repetitive data preparation process complicates the evaluation of new solutions. To solve this issue, we propose VulZoo, a comprehensive vulnerability intelligence dataset that covers 17 vulnerability data sources. We also construct connections among these sources, enabling more straightforward configuration and adaptation for different tasks. VulZoo provides utility scripts for automatic data synchronization and cleaning, relationship mining, and statistics generation. We make VulZoo publicly available and maintain it with incremental updates. We believe that VulZoo serves as a valuable input to vulnerability assessment and prioritization studies. The video is at https://youtu.be/EvoxQmUAHtw. The dataset is at https://github.com/NUS-Curiosity/VulZoo.