Toward Validation of Textual Information Retrieval Techniques for Software Weaknesses

Abstract

This paper presents a preliminary validation of common textual information retrieval techniques for mapping unstructured software vulnerability information to distinct software weaknesses. The validation is carried out with a dataset compiled from four software repositories tracked in the Snyk vulnerability database. According to the results, the information retrieval techniques used perform unsatisfactorily compared to regular expression searches. Although the results vary from a repository to another, the preliminary validation presented indicates that explicit referencing of vulnerability and weakness identifiers is preferable for concrete vulnerability tracking. Such referencing allows the use of keyword-based searches, which currently seem to yield more consistent results compared to information retrieval techniques. Further validation work is required for improving the precision of the techniques, however.

An Empirical Analysis of Vulnerabilities in Python Packages for Web Applications

“…The following cut JSON (JavaScript Object Notation) excerpt can be used to illustrate a rather typical entry in Safety DB: As can be seen, the advisory field provides a brief textual description for each vulnerability archived to the database. These descriptions follow the typically terse prose used for describing vulnerabilities [12]. (It is also worth remarking that the textual advisories in Safety DB are mostly plagiarized directly from NVD and related sources.)…”

“…These limitations have prompted a new branch of research for examining vulnerabilities in software repositories. While packages used in Linux distributions have been a common target [10], the more recent research has focused on languagespecific repositories such as npm for JavaScript [11], [12]. This is the research domain to which this paper contributes by presenting the supposedly first study on vulnerabilities in the Python's PyPI repository and advancing the understanding on release-based time series analysis of software vulnerabilities.…”

Predicting the Amount of GDPR Fines

“…In addition to the stopwords supplied in the library, the twelve most frequent tokens were used as custom excluded stopwords: data, article, personal, protection, processing, company, authority, regulation, information, case, art, and page. After this pre-processing, the token-based term frequency (TF) and term frequency inverse document frequency (TF-IDF) were calculated from the whole corpus constructed (for the exact formulas used see, e.g., [19]). These common information retrieval statistics are used for evaluating the other part in Q 2 .…”

Tracing CAPEC Attack Patterns from CVE Vulnerability Information using Natural Language Processing Technique

“…Another study defined a framework to prioritize vulnerabilities [19]. Several studies have focused on mining methods and information retrieval for a security knowledge repository [20], [21], [22], [23], [24]. These papers mined each repository using their relationships.…”