Generating software identifier dictionaries from Vulnerability Database

To maintain acceptable levels of security, organizations must manage their IT assets and related vulnerabilities. However, this can be a considerable burden because their resources are often limited. We have been working on a technique and system architecture that monitor the vulnerability of the IT assets on an organization's administrative networks. It uses identifiers of IT assets to locate vulnerability information. The quality of the technique depends on accurate determination of the identifiers. Currently, we determine the identifiers by using an official identifier dictionary, but the success rate of determining identifiers using our current scheme is low. We thus need to improve the scheme to determine the identifiers. In this paper, we introduce two schemes for that purpose. First, we extend the applicability of the dictionary by implementing a version-agnostic identifier determination scheme. Second, we produce operational identifier dictionaries so that they can supplement the official dictionary. We show preliminary experimental results to demonstrate the effectiveness of these schemes for improving the success rate of determining identifiers. We also discuss the direction for further research.