计算机工程与应用 ›› 2015, Vol. 51 ›› Issue (2): 103-107.

• 网络、通信、安全 • 上一篇    下一篇

一种自动优化CVSSv2.0漏洞指标的评估方法

廖  丹,周  明,刘  丹,田  忠   

  1. 电子科技大学 电子科学技术研究院,成都 611731
  • 出版日期:2015-01-15 发布日期:2015-01-12

Assessment method of automatic optimizing CVSS v2.0 vulnerability indicators

LIAO Dan, ZHOU Ming, LIU Dan, TIAN Zhong   

  1. Research Institute Electronic Science and Technology, University of Electronic Science and Technology of China, Chengdu 611731, China
  • Online:2015-01-15 Published:2015-01-12

摘要: 针对CVSS v2.0主观性强、操作性差,建立自动化评估模型困难的问题,提出在CVSS v2.0评估体系的基础上,改进其评价指标体系,把评价指标分为主客观两类;使用BP神经网络自学习原理再次优化评价因子;并建立基于BP神经网络的自动化评估模型,快速地对输入指标的特征做逼近实效的量化。通过MATLAB仿真验证了该方法的有效性、准确性与可行性。

关键词: 通用漏洞评估系统(CVSS), 指标量化, 反向传播(BP)神经网络, 评估模型, MATLAB

Abstract: Considering that there are several drawbacks included in CVSS 2.0, such as strongly subjectivity, inefficient maneuverability, the difficulty to create automated assessment model, the evaluation index system is improved based on CVSS 2.0 evaluation system. And the evaluation index system is divided into two parts which are objective category and subjective category. It optimizes evaluation factor with principles of BP neural network self-learning and builds an automation evaluation model based on BP neural network, then quantizes the input indicators characteristic into approximation of effectiveness rapidly. Finally the effectiveness, accuracy and feasibility of the method are proved by MATLAB simulation.

Key words: Common Vulnerability Scoring System(CVSS), indicator quantified, Back Propagation(BP) neural network, evaluation model, MATLAB