Endre søk
RefereraExporteraLink to record
Permanent link

Direct link
Referera
Referensformat
  • apa
  • harvard1
  • ieee
  • modern-language-association-8th-edition
  • vancouver
  • Annet format
Fler format
Språk
  • de-DE
  • en-GB
  • en-US
  • fi-FI
  • nn-NO
  • nn-NB
  • sv-SE
  • Annet språk
Fler språk
Utmatningsformat
  • html
  • text
  • asciidoc
  • rtf
Can the Common Vulnerability Scoring System be Trusted?: A Bayesian Analysis
KTH, Skolan för elektro- och systemteknik (EES), Elkraftteknik. (Software Systems Architecture & Security)ORCID-id: 0000-0002-3293-1681
KTH, Skolan för elektroteknik och datavetenskap (EECS), Nätverk och systemteknik. (Software Systems Architecture & Security)ORCID-id: 0000-0003-3089-3885
KTH, Skolan för elektro- och systemteknik (EES), Elkraftteknik. (Software Systems Architecture & Security)ORCID-id: 0000-0003-3922-9606
SICS.
2018 (engelsk)Inngår i: IEEE Transactions on Dependable and Secure Computing, ISSN 1545-5971, E-ISSN 1941-0018, Vol. 15, nr 6, s. 1002-1015, artikkel-id 7797152Artikkel i tidsskrift (Fagfellevurdert) Published
Abstract [en]

The Common Vulnerability Scoring System (CVSS) is the state-of-the art system for assessing software vulnerabilities. However, it has been criticized for lack of validity and practitioner relevance. In this paper, the credibility of the CVSS scoring data found in five leading databases – NVD, X-Force, OSVDB, CERT-VN, and Cisco – is assessed. A Bayesian method is used to infer the most probable true values underlying the imperfect assessments of the databases, thus circumventing the problem that ground truth is not known. It is concluded that with the exception of a few dimensions, the CVSS is quite trustworthy. The databases are relatively consistent, but some are better than others. The expected accuracy of each database for a given dimension can be found by marginalizing confusion matrices. By this measure, NVD is the best and OSVDB is the worst of the assessed databases.

sted, utgiver, år, opplag, sider
IEEE Press, 2018. Vol. 15, nr 6, s. 1002-1015, artikkel-id 7797152
Emneord [en]
cyber security, software vulnerability, CVSS, information security
HSV kategori
Identifikatorer
URN: urn:nbn:se:kth:diva-200695DOI: 10.1109/TDSC.2016.2644614ISI: 000449980000008Scopus ID: 2-s2.0-85056520813OAI: oai:DiVA.org:kth-200695DiVA, id: diva2:1070329
Forskningsfinansiär
EU, FP7, Seventh Framework Programme, 607109Swedish Civil Contingencies Agency, 2015-6986StandUp
Merknad

QC 20170202

Tilgjengelig fra: 2017-02-01 Laget: 2017-02-01 Sist oppdatert: 2019-03-12bibliografisk kontrollert

Open Access i DiVA

Fulltekst mangler i DiVA

Andre lenker

Forlagets fulltekstScopus

Personposter BETA

Johnson, PontusLagerström, RobertEkstedt, Mathias

Søk i DiVA

Av forfatter/redaktør
Johnson, PontusLagerström, RobertEkstedt, Mathias
Av organisasjonen
I samme tidsskrift
IEEE Transactions on Dependable and Secure Computing

Søk utenfor DiVA

GoogleGoogle Scholar

doi
urn-nbn

Altmetric

doi
urn-nbn
Totalt: 376 treff
RefereraExporteraLink to record
Permanent link

Direct link
Referera
Referensformat
  • apa
  • harvard1
  • ieee
  • modern-language-association-8th-edition
  • vancouver
  • Annet format
Fler format
Språk
  • de-DE
  • en-GB
  • en-US
  • fi-FI
  • nn-NO
  • nn-NB
  • sv-SE
  • Annet språk
Fler språk
Utmatningsformat
  • html
  • text
  • asciidoc
  • rtf