Paper Info
Title
Refining Traceability Links Between Vulnerability and Software Component in a Vulnerability Knowledge Graph.
Abstract
Software vulnerabilities and their corresponding software components information are usually stored in different locations with different representations. Building accurate traceability links between them to form a unified knowledge graph can be very helpful for vulnerability spreading analysis, component dependency management, and relationship inference. In this paper, we first propose a software vulnerability knowledge graph model which integrates CVE (Common Vulnerabilities and Exposures) information, Java Component metadata in Maven repository and project collaboration data on Github. To construct the knowledge graph, we then propose two ontology matching approaches. The first one links Maven project and Github project in a URL text-matching way. The second one introduces random forests algorithm to link CVE project version and Maven project version based on 16 well-defined features. Experimental results show that matching between CVE project version and Maven project version are highly promising with an accuracy rate as high as 99.8%. The traceability links between vulnerabilities and software components can be more accurate based on our approach.
Year
Venue
Field
2018
ICWE
Ontology alignment,Common Vulnerabilities and Exposures,Data mining,Metadata,Vulnerability (computing),Software engineering,Computer science,Software,Component-based software engineering,Java,Traceability
DocType
Citations 
PageRank 
Conference
1
0.35
References 
Authors
7
9
Name
Order
Citations
PageRank
Dongdong Du121.70
Xingzhang Ren221.72
Yupeng Wu310.35
Jien Chen410.35
Wei Ye523.40
Jinan Sun623.40
Xiangyu Xi713.39
Qing Gao8973.69
Shikun Zhang95521.40