2010 · 124 citations · 14 references
Sql InjectionEngineeringInformation SecurityCommon VulnerabilitySoftware AnalysisVulnerability AnalysisText MiningSecurity ModellingVulnerability Assessment (Computing)Data ScienceRisk ManagementManagementSecurity Trend AnalysisContent AnalysisStatisticsVulnerability ReportsPredictive AnalyticsEpidemiologySecuritySecurity MeasurementThreat ModelData Modeling
The study aims to identify prevalent vulnerability types and emerging trends in CVE reports. It applies topic modeling to the description texts of CVE entries to achieve this. The analysis shows PHP, buffer overflows, and format strings are declining, while SQL injection, XSS, cross‑site request forgery, and application server vulnerabilities are strong or rising.
We study the vulnerability reports in the Common Vulnerability and Exposures (CVE) database by using topic models on their description texts to find prevalent vulnerability types and new trends semi-automatically. In our study of the 39,393 unique CVEs until the end of 2009, we identify the following trends, given here in the form of a weather forecast: PHP: declining, with occasional SQL injection. Buffer Overflows: flattening out after decline. Format Strings: in steep decline. SQL Injection and XSS: remaining strong, and rising. Cross-Site Request Forgery: a sleeping giant perhaps, stirring. Application Servers: rising steeply.
14
David M. Blei, John Lafferty · 2006 · 2.3K citations
Natural Language Processing, Document Clustering, Latent Modeling +15
David M. Blei, Jon McAuliffe · arXiv (Cornell University) · 2010 · 1.3K citations · Full text
Xuerui Wang, Andrew McCallum · 2006 · 1.1K citations