PROJECT TITLE :

xVDB: A High-Coverage Approach for Constructing a Vulnerability Database

ABSTRACT:

When it comes to locating and correcting vulnerabilities discovered in a single day, security patches play a crucial role. However, accumulating a large number of security patches from a variety of data sources is not an easy task to complete. This is the case for two reasons: (1) every data source presents vulnerability information in its own unique fashion, and (2) many security patches cannot be directly collected from information pertaining to Common Vulnerabilities and Exposures (CVE) (for example, references in the National Vulnerability Database, or NVD). In this paper, we propose an approach that tracks multiple data sources in order to collect known security patches. This approach has a high coverage rate. We focused specifically on the following three types of data sources: repositories (such as GitHub), issue trackers (such as Bugzilla), and question and answer websites ( e . g ., Stack Overflow). We collect even security patches that cannot be collected by only considering CVE information from the various data sources ( I . e ., previously untracked security patches). During the course of our research, we gathered a total of 12,432 CVE patches from various repositories and issue trackers, in addition to 12,458 insecure posts from Question and Answer websites. The fact that we were able to collect at least four times as many CVE patches as were collected by other methods demonstrates the effectiveness of the method that we developed. The gathered security patches are uploaded to a public website (in this case, IoTcube) and used there as a database in order to move forward with the detection of vulnerable code clones.