Request for Data

[139381512412]

Hi,
My name is Mike Lawler and I am a grad student at UTSA. I am in an introductory Data Mining Class and we were tasked with locating a dataset for use in a term project. I have worked with vulnerabilities before and was interested in trying to identify trends in a vulnerability dataset, which resulted in this project being suggested by my instructor.

I am trying to find a dataset (preferably in CSV format) to use in this project. I am hoping to identify trends in areas such as:
Are technologies associated with specific phases of the attack lifecycle more prone to vulnerability discovery?
What are the trends in specific platforms and vulnerability severity?
Where do higher severity scores appear in the dataset?
and others as I am able to explore.

Hopefully your project can provide a dataset that I can use for this study. It is a class project, and not a larger funded effort, so it is just me working on this.

Kind Regards,
Mike

[jess-lowe]

Hey Mike, we regularly export all of our vulnerability data to a GCS bucket containing a zip file called 'all.zip' that might be what you are looking for.

Just FYI w.r.t the questions you are looking to answer,

Are technologies associated with specific phases of the attack lifecycle more prone to vulnerability discovery?

I'm not sure how easy this would be to discover. Our data is an aggregation of primarily open source vulnerability advisories, so contain mainly an identifier, the project that is affected, which versions of the project that is affected, and sometimes a description. Which is to say, we don't have a lot of data on what and where the vulnerability necessarily is beyond just the package and versions that are affected, so finding what phase of the attack lifestyle it's in might be difficult. Also, vulnerabilities aren't necessarily always components of an attack,

What are the trends in specific platforms and vulnerability severity?

This is probably doable? But it would be more a comparison of ecosystems than platforms. Git might be an outlier too because it will have a lot of everything. Also note that there are a form of duplicates - there might be multiple advisories for the same vuln across different Linux distributions and ecosystems, and some distros like Ubuntu provide us with their own tracker of a CVE as well as the security notice (USN) of the fix.

Where do higher severity scores appear in the dataset?

This should definitely be doable, but I would note that there are currently 4 different severity types, and severity scores are in general a bit controversial.

Hopefully that data will be useful to you and happy to discuss more details if you're still interested in using our data. Feel free to have a read through our docs and FAQ for a better insight into the project, our scope, and how they might be of use to you. Otherwise, an interesting rabbit hole that I'm currently looking into is the variety of quality amongst CVE records on the NVD and CVEList. They also have a larger scope of vulnerabilities (including closed source) but they're not exactly super machine readable (which is partially why OSV exists).

Hope this helps!