We study the vulnerability reports in the Common Vulnerability and Exposures (CVE) database by using topic models on their description texts to find prevalent vulnerability types and new trends semi-automatically. In our study of the 39,393 unique CVEs until the end of 2009, we identify the following trends, given here in the form of a weather forecast:

PHP: declining, with occasional SQL injection.

Buffer Overflows: flattening out after decline.

Format Strings: in steep decline.

SQL Injection and XSS: remaining strong, and rising.

Cross-Site Request Forgery: a sleeping giant perhaps, stirring.

Application Servers: rising steeply.

PDF file

In  Proceedings of the 21st IEEE International Symposium on Software Reliability Engineering (ISSRE)

Publisher  IEEE
© 2010 IEEE. Personal use of this material is permitted. However, permission to reprint/republish this material for advertising or promotional purposes or for creating new collective works for resale or redistribution to servers or lists, or to reuse any copyrighted component of this work in other works must be obtained from the IEEE. http://www.ieee.org/

Details