arXiv:2508.13364cs.CRcs.LG2025-08被引 1

用实时爬取的威胁数据增强系统风险评估,提前发现未知漏洞。

A Risk Manager for Intrusion Tolerant Systems: Enhancing HAL 9000 with New Scoring and Data Sources

  • 构建实时爬虫抓取安全公告、研究论坛等多源威胁信息
  • 扩展HAL 9000情报库,使新漏洞评估提前30天以上
  • 适合需要快速响应新型攻击的安全团队和防御系统

入侵容错系统(ITS)因多域对手利用多样攻击面而愈发关键。现有方案依赖NVD、ExploitDB等数据库动态调整防御,但需人工分析新漏洞,响应滞后。此前提出的HAL 9000通过机器学习自动评估已知漏洞,并结合30天内漏洞利用概率评分实现主动防护。本工作引入自研爬虫,持续抓取安全公告、研究论坛及实时漏洞证明等多源信息,显著扩展其情报基础,提升对未验证漏洞的早期识别能力。实验表明,融合爬取数据后,HAL 9000在应对新兴威胁时表现大幅提升。本文详述爬虫集成方式、新增信息作用及其对风险管理的影响。

原文摘要 · Abstract (English)

Intrusion Tolerant Systems (ITSs) have become increasingly critical due to the rise of multi-domain adversaries exploiting diverse attack surfaces. ITS architectures aim to tolerate intrusions, ensuring system compromise is prevented or mitigated even with adversary presence. Existing ITS solutions often employ Risk Managers leveraging public security intelligence to adjust system defenses dynamically against emerging threats. However, these approaches rely heavily on databases like NVD and ExploitDB, which require manual analysis for newly discovered vulnerabilities. This dependency limits the system's responsiveness to rapidly evolving threats. HAL 9000, an ITS Risk Manager introduced in our prior work, addressed these challenges through machine learning. By analyzing descriptions of known vulnerabilities, HAL 9000 predicts and assesses new vulnerabilities automatically. To calculate the risk of a system, it also incorporates the Exploitability Probability Scoring system to estimate the likelihood of exploitation within 30 days, enhancing proactive defense capabilities. Despite its success, HAL 9000's reliance on NVD and ExploitDB knowledge is a limitation, considering the availability of other sources of information. This extended work introduces a custom-built scraper that continuously mines diverse threat sources, including security advisories, research forums, and real-time exploit proofs-of-concept. This significantly expands HAL 9000's intelligence base, enabling earlier detection and assessment of unverified vulnerabilities. Our evaluation demonstrates that integrating scraper-derived intelligence with HAL 9000's risk management framework substantially improves its ability to address emerging threats. This paper details the scraper's integration into the architecture, its role in providing additional information on new threats, and the effects on HAL 9000's management.

风险评估漏洞检测实时监控

Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。