论文标题
Web应用程序弱点基于漏洞数据
Web Application Weakness Ontology Based on Vulnerability Data
论文作者
论文摘要
Web应用程序变得越来越普遍。现在连接了各种物理设备，并且通常具有各种Web应用程序和Web Interfaces。 Web应用程序的这种扩散伴随着报告的软件漏洞的增加。对脆弱性数据分析的目的是了解报告的Web应用程序缺陷的当前格局。沿着这些渠道，这项工作回顾了国家漏洞数据库中的十年（2011-2020）漏洞数据。基于这些数据，确定了最常见的Web应用程序弱点并显示其概况。开发了一个弱点来捕获这些弱点的属性。这些包括它们的攻击方法和攻击向量。还描述了弱点对软件质量属性的影响。此外，提出了容易受到每个弱点的技术，包括编程语言，框架，通信协议和数据格式。
Web applications are becoming more ubiquitous. All manner of physical devices are now connected and often have a variety of web applications and web-interfaces. This proliferation of web applications has been accompanied by an increase in reported software vulnerabilities. The objective of this analysis of vulnerability data is to understand the current landscape of reported web application flaws. Along those lines, this work reviews ten years (2011 - 2020) of vulnerability data in the National Vulnerability Database. Based on this data, most common web application weaknesses are identified and their profiles presented. A weakness ontology is developed to capture the attributes of these weaknesses. These include their attack method and attack vectors. Also described is the impact of the weaknesses to software quality attributes. Additionally, the technologies that are susceptible to each weakness are presented, they include programming languages, frameworks, communication protocols, and data formats.
