Prioritizing CWE/SANS and OWASP Vulnerabilities: A Network-Based Model

Mahmood, Basim

doi:10.12785/ijcds/100137

Cited by 5 publications

(1 citation statement)

References 9 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…In RQ4, we study why existing tools fail to detect certain vulnerabilities. Table VII shows the number of undetected vulnerabilities grouped by CWE and their mapping to OWASP top-10 web security risks (2021) [28]. Of the 957 known vulnerabilities in the dataset, 324 vulnerabilities (33.9%) were not detected by any of the selected tools.…”

Section: Reasons For Missed Detection (Rq4)mentioning

confidence: 99%

Study of JavaScript Static Analysis Tools for Vulnerability Detection in Node.js Packages

et al. 2023

View full text Add to dashboard Cite

With the emergence of the Node.js ecosystem, JavaScript has become a widely used programming language for implementing server-side web applications. In this article, we present the first empirical study of static code analysis tools for detecting vulnerabilities in Node.js code. To conduct a comprehensive tool evaluation, we created the largest known curated dataset of Node.js code vulnerabilities. We characterized and annotated a set of 957 vulnerabilities by analyzing information contained in npm advisory reports. We tested nine different tools and found that many important vulnerabilities appearing in the OWASP top-10 are not detected by any tool. The three best performing tools combined only detect up to 57.6% of all vulnerabilities in the dataset, but at a very low precision of 0.11%. Our curated dataset offers a new benchmark to help characterize existing Node.js code vulnerabilities and foster the development of better vulnerability detection tools for Node.js code.

show abstract

Section: Reasons For Missed Detection (Rq4)mentioning

confidence: 99%

Study of JavaScript Static Analysis Tools for Vulnerability Detection in Node.js Packages

et al. 2023

View full text Add to dashboard Cite

show abstract

Toward a Multidimensional Analysis of the National Vulnerability Database

Singla,

Reddy,

Bettati

et al. 2023

IEEE Access

View full text Add to dashboard Cite

Bring-your-own-device policies, IoT devices, smart appliances are all contributing to increasing diversity of connected devices. It has become imperative to understand the vulnerabilities of these diverse devices (along with traditional compute devices) to appropriately secure their use. In this paper we conduct a detailed analysis of the vulnerabilities reported for the various hardware and software artifacts in the NIST National Vulnerability Database. We analyze the details of vulnerabilities covering the period 2011-2022. We broadly categorize the vulnerabilities into three product categories: networking, IoT, and computing devices. The data is further classified into application, OS, and hardware domains. We analyze the data across the aforementioned categories over four non-overlapping 3-year time periods. The analysis provides insights into salient trends in vulnerabilities across diverse products, and over time. Our work presents interesting findings based on the trends and persistence observed from the analyzed data. Our study points to insights that could lead to improved resource allocation for addressing security concerns.

show abstract

Formally Modeled Common Weakness Enumerations (CWEs)

Koscinski,

Mirakhorli

2024

Proceedings of the 39th IEEE/ACM International Conference on Automated Software Engineering Workshops

View full text Add to dashboard Cite

Prioritizing CWE/SANS and OWASP Vulnerabilities: A Network-Based Model

Cited by 5 publications

References 9 publications

Study of JavaScript Static Analysis Tools for Vulnerability Detection in Node.js Packages

Study of JavaScript Static Analysis Tools for Vulnerability Detection in Node.js Packages

Toward a Multidimensional Analysis of the National Vulnerability Database

Formally Modeled Common Weakness Enumerations (CWEs)

Contact Info

Product

Resources

About