Authors:
Igor Forain
;
Robson de Oliveira Albuquerque
and
Rafael Timóteo de Sousa Júnior
Affiliation:
Professional Program in Electrical Engineering (PPEE), Dept. of Electrical Engineering (ENE), University of Brasília (UnB), Brasília, Brazil
Keyword(s):
Cybersecurity, Vulnerabilities, Pentest, NVD, CNVD, TOPSIS.
Abstract:
Information security incidents currently affect organizations worldwide. In 2021, thousands of companies suffered cyber attacks, resulting in billions of dollars in losses. Most of these events result from known vulnerabilities in information assets. However, several heterogeneous databases and sources host information about those flaws, turning the risk assessment difficult. This paper proposes a Recommender Exploitation-Vulnerability System (REVS) with the Technique for Order Preference by Similarity to Ideal Solution (TOPSIS) to rank vulnerability-exploit. The REVS is a dual tool that can pinpoint the best exploits to pentest or the most sensitive vulnerabilities to cybersecurity staff. This paper also presents results in the GNS3 emulator leveraging data from the National Vulnerability Database (NVD), the China National Vulnerability Database (CNVD), and Vulners. They reveal that the CNVD, despite data issues, has 23,281 vulnerabilities entries unmapped in the NVD. Moreover, this
work establishes criteria to link heterogeneous vulnerability databases.
(More)