SOSK Tools for Software Security
Phong Minh Vu, Tung Thanh Nguyen
Journal of Information Security Research, Vol. 15, No. 4, 2024.
DOI: https://doi.org/10.6025/jisr/2024/15/4/131-137
Link: https://www.dline.info/jisr/fulltext/v15n4/jisrv15n4_1.pdf
Abstract:
Software security incidents occur everyday and thousands of software security
reports are announced each month. Thus, it is difficult for software security
researchers, engineers, and other stakeholders to follow software security topics
of their interests in real-time. In this paper, we propose, SOSK, a novel tool for
this problem. SOSK allows a user to import a collection of software security
reports. It pre-processes and extracts the most important keywords from the
textual description of the reports. Based on the similarity of embedding vectors of
keywords, SOSK can expand and/or refine a keyword set from a much smaller set
of their interests userprovided keywords. Thus, SOSK allows users to define any
topic of their nterests and retrieve security reports relevant to that topic
effectively.Our preliminary evaluation shows that SOSK can expand keywords
and retrieve reports relevant to user requests.