Poster: Analyzing and Correcting Inaccurate CVE-CWE Mappings in the National Vulnerability Database

Poster: Analyzing and Correcting Inaccurate CVE-CWE Mappings in the National Vulnerability Database

연구 분야: Strategies

학회: CCS '24: Proceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security

We conduct a longitudinal study of the National Vulnerability Database (NVD), focusing on the mappings between vulnerabilities (CVEs) and weaknesses (CWEs). Surprisingly, the study reveals that a significant portion of CVEs, fluctuating between 15% and 30% over the years, lack proper CWE mapping, and that almost 40% of the updates are non-informative. We introduce a methodology, based on knowledge graphs, for automating root cause weakness mapping for CVEs and for fixing existing inaccurate mappings. We showcase promising preliminary results toward this end.