一种新型Web应用安全漏洞统一描述语言  

Novel Uniform Vulnerability Description Language of Web Application

作　　者：陈波[1,2] 师惠忠[1] 

机构地区：[1]南京师范大学计算机科学与技术学院,南京210097 [2]江苏省信息安全保密技术工程研究中心,南京210097

出　　处：《小型微型计算机系统》2011年第10期1994-2001,共8页Journal of Chinese Computer Systems

基　　金：江苏省教育厅高校自然科学基金项目(08KJD520017)资助

摘　　要：提出一种基于XML的Web应用安全漏洞统一描述语言UVDL,通过制定包含漏洞信息的结构化XML文件,其中每个漏洞又以树状结构包含漏洞的基本信息、利用、影响、修复以及参考信息等框架文件,并定义各描述子项,来标准化漏洞检测过程.相比已有的漏洞描述语言,UVDL框架文件的插件组织形式更具灵活性和扩展能力,每个漏洞的分框架文件在Web漏洞检测系统的应用中更具可操作性.UVDL在考虑环境与状态错误对Web应用软件造成安全影响的基础上增加了Web漏洞分类、漏洞的严重程度以及利用性等属性信息.UVDL在漏洞评估系统中的应用实验表明,UVDL作为一种统一标准且易操作的漏洞描述语言,能够整合漏洞信息,解决多安全部件的协同工作和兼容性等问题.This paper proposes a Uniform Vulnerability Description Language（UVDL） of Web application based on XML.Vulnerability detection process is standardized by making a structured XML file which including vulnerability information.Each vulnerability is described using XML schema files,such as the basic information,exploitation,impact,solution,and reference information,and the sub items of vulnerability description are defined in them.The plug-in organization form of UVDL schema files is more flexible and scalable compared with the existed vulnerability description language,and the sub schema files of each vulnerability are more operational in the application of Web vulnerability detection system.Considering the circumstance and states errors on the security impact of Web application software,we add the vulnerability classification,severity and exploitation attribution in UVDL.The results of applying UVDL in vulnerability assessment system show that as a unified standard and easy operation vulnerability description language,UVDL could integrate the vulnerability information and address multiple security components cooperative work and compatibility issues and so on.

关 键 词：漏洞 漏洞描述 漏洞评估 WEB安全 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]