Browse > Article

An Automatic Network Vulnerability Analysis System using Multiple Vulnerability Scanners  

Yoon, Jun (한국정보보호진흥원 인터넷침해사고대응지원센터)
Sim, Won-Tae (한국정보보호진흥원 인터넷침해사고대응지원센터)
Publication Information
Journal of KIISE:Computing Practices and Letters / v.14, no.2, 2008 , pp. 246-250 More about this Journal
Abstract
This paper presents the design of network vulnerability analysis system which can integrate various vulnerability assessment tools to improve the preciseness of the vulnerability scan result. Manual checking method performed by a security expert is the most precise and safe way. But this is not appropriate for the large-scale network which has a lot of systems and network devices. Therefore automatic scanning tool is recommended for fast and convenient use. The scanning targets may be different according to the kind of vulnerability scanners, or otherwise even for the same scanning target, the scanning items and the scanning results may be different by each vulnerability scanner, Accordingly, there are the cases in which various scanners, instead of a single scanner, are simultaneously utilized with the purpose of complementing each other. However, in the case of simultaneously utilizing various scanners on the large-scale network, the integrative analysis and relevance analysis on vulnerability information by a security manager becomes time-consumable or impossible. The network vulnerability analysis system suggested in this paper provides interface which allows various vulnerability assessment tools to easily be integrated, common policy which can be applied for various tools at the same time, and automated integrative process.
Keywords
integrative vulnerability analysis; multiple vulnerability scanners; vulnerability relevance analysis;
Citations & Related Records
연도 인용수 순위
  • Reference
1 C. Ying, A. Tsai, and H. Yu, 'Vulnerability assessment system (VAS),' In Proceedings IEEE 37th Annual 2003 International Carnahan Conference, October 2003
2 Cert advisory, http://www.cert.org/advisories/, Page last updated: 30-Jan-07
3 M. Rohse, Vulnerability naming schemes and description languages: CVE, Bugtraq, AVDL and VulnXML, GSEC Practical Version 1.4b(1) Apr 22, 2003
4 이수형, 방효찬, 장범환, 나중찬, 효과적인 보안상황 분석을 위한 보안이벤트 처리, 전자통신동향분석 제22권 제1호, 2007년 2월
5 Microsoft security bulletin, http://www.microsoft. com/technet/security/current.aspx, Page last updated: 3-Apr-07
6 Common Vulnerabilities and Exposures, http://cve. mitre.org/, Page last updated: 29-Mar-07
7 Bugtraq, http://www.securityfocus.com/vulnerabilities, Page last updated: 6-Apr-07