Určení dopadu zneužití zranitelnosti na systém

Bc. Lukáš Sadlek

Bachelor's thesis

Vulnerability Exploit Effect Categorization

Abstract:

Táto bakalárska práca sa zaoberá kategorizáciou dopadu zneužitia zraniteľnosti na základe dát z National Vulnerability Database. Najprv predstavujeme zdroje informácií o zraniteľnostiach a s témou súvisiace pojmy, ktoré boli použité v našom výskume - Common Vulnerabilities and Exposures, Common Weakness Enumeration, Common Vulnerability Scoring System, Common Platform Enumeration a National Vulnerability Database. Ďalej popisujeme získanie dát a analýzy vykonané na týchto dátach. Taktiež predstavujeme taxonómiu, ktorú využíva kategorizátor, ako sme otestovali spoľahlivosť nástroja na kategorizáciu zraniteľností a samotný kategorizačný algoritmus.

Abstract:

In this bachelor’s thesis, we propose a way how to categorize an effect of a vulnerability exploit based on the vulnerability data from the National Vulnerability Database. At first, we describe the vulnerability information sources and topic-related terms that were used in our research – the Common Vulnerabilities and Exposures, the Common Weakness Enumeration, the Common Vulnerability Scoring System, the Common Platform Enumeration and the National Vulnerability Database. Then we describe how we obtained our data and the analysis that we performed upon these data. We also introduce the taxonomy used by the categorizer, how we tested the reliability of our categorization tool and the categorization algorithm itself. iii

Keywords

CVE, CWE, CPE, CVSS, vulnerability categorization

Language used: English

Date on which the thesis was submitted / produced: 28. 5. 2018

Thesis defence

• Date of defence: 25. 6. 2018
• Supervisor: RNDr. Jana Komárková
• Reader: Mgr. Martin Laštovička

Masaryk University

Faculty of Informatics

Bachelor programme / field:
Informatics / Computer Systems and Data Processing