Improving Discovery of Known Software Vulnerability For Enhanced Cybersecurity

TL;DR

This paper introduces a method to improve the accuracy of identifying known software vulnerabilities by standardizing CPE strings through sanitization and fuzzy matching, significantly enhancing cybersecurity defenses.

Contribution

It proposes a novel multi-layered sanitization and fuzzy matching approach to address CPE string inconsistencies, improving vulnerability detection accuracy.

Findings

Detection accuracy improved by 40%

Effective handling of non-standardized CPE strings

Enhanced vulnerability identification process

Abstract

Software vulnerabilities are commonly exploited as attack vectors in cyberattacks. Hence, it is crucial to identify vulnerable software configurations early to apply preventive measures. Effective vulnerability detection relies on identifying software vulnerabilities through standardized identifiers such as Common Platform Enumeration (CPE) strings. However, non-standardized CPE strings issued by software vendors create a significant challenge. Inconsistent formats, naming conventions, and versioning practices lead to mismatches when querying databases like the National Vulnerability Database (NVD), hindering accurate vulnerability detection. Failure to properly identify and prioritize vulnerable software complicates the patching process and causes delays in updating the vulnerable software, thereby giving attackers a window of opportunity. To address this, we present a method to enhance CPE string consistency by implementing a multi-layered sanitization process combined with a fuzzy matching algorithm on data collected using Osquery. Our method includes a union query with priority weighting, which assigns relevance to various attribute combinations, followed by a fuzzy matching process with threshold-based similarity scoring, yielding higher confidence in accurate matches. Comparative analysis with open-source tools such as FleetDM demonstrates that our approach improves detection accuracy by 40%.