A General Framework to Understand Vulnerabilities in Information Systems

IEEE Access

Haoran Xie¹  Minghao Zhu²  Hongkai Shao²  Hao Yang²  Xiong Zhang² 

[1] Department of Computing and Decision Sciences, Lingnan University, Hong Kong;School of Economics and Management, Beijing Jiaotong University, Beijing, China;

关键词: Classification;    information security;    risk-level prediction;    topic analysis;    vulnerability;   

DOI  :  10.1109/ACCESS.2020.3006361

来源: DOAJ

【 摘 要 】

Firms and organizations are increasingly facing security issues related to vulnerabilities in their information systems. Firms, especially small and medium-sized enterprises, usually have very limited security resources and thus have difficulty understanding vulnerabilities and fixing them accordingly. This study aims to build a general framework that can help firms understand the characteristics of vulnerabilities in information systems: for instance, what category a specific vulnerability belongs to, what potential risks it poses, and what the key clues are to addressing it. To this end, we collect data on real vulnerabilities that have emerged in firms' information systems from a popular vulnerability report platform. Features are extracted at four different levels, namely, the word, phrase, topic, and record levels. The experimental results show that the general framework helps characterize the modes and patterns of various types of vulnerabilities. This study contributes to the security literature by providing a deeper understanding of the characteristics of vulnerabilities and their related suggested solutions. Firms can apply this framework to ensure information security.

【 授权许可】

Unknown