Automated Identification of Security-Relevant Configuration Settings Using NLP

Patrick Stöckle; Theresa Wasserer; Bernd Grobauer; Alexander Pretschner

doi:10.1145/3551349.3559499

Automated Identification of Security-Relevant Configuration Settings Using NLP

Patrick Stöckle, Theresa Wasserer, Bernd Grobauer, Alexander Pretschner

Informatics 4 - Chair of Software und Systems Engineering

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › peer-review

3 Scopus citations

Abstract

To secure computer infrastructure, we need to configure all security-relevant settings. We need security experts to identify security-relevant settings, but this process is time-consuming and expensive. Our proposed solution uses state-of-the-art natural language processing to classify settings as security-relevant based on their description. Our evaluation shows that our trained classifiers do not perform well enough to replace the human security experts but can help them classify the settings. By publishing our labeled data sets and the code of our trained model, we want to help security experts analyze configuration settings and enable further research in this area.

Original language	English
Title of host publication	37th IEEE/ACM International Conference on Automated Software Engineering, ASE 2022
Editors	Mario Aehnelt, Thomas Kirste
Publisher	Association for Computing Machinery
ISBN (Electronic)	9781450396240
DOIs	https://doi.org/10.1145/3551349.3559499
State	Published - 19 Sep 2022
Event	37th IEEE/ACM International Conference on Automated Software Engineering, ASE 2022 - Rochester, United States Duration: 10 Oct 2022 → 14 Oct 2022

Publication series

Name	ACM International Conference Proceeding Series

Conference

Conference	37th IEEE/ACM International Conference on Automated Software Engineering, ASE 2022
Country/Territory	United States
City	Rochester
Period	10/10/22 → 14/10/22

Keywords

Hardening
Natural Language Processing
Security Configuration

Access to Document

10.1145/3551349.3559499

Cite this

Stöckle, P., Wasserer, T., Grobauer, B., & Pretschner, A. (2022). Automated Identification of Security-Relevant Configuration Settings Using NLP. In M. Aehnelt, & T. Kirste (Eds.), 37th IEEE/ACM International Conference on Automated Software Engineering, ASE 2022 Article 131 (ACM International Conference Proceeding Series). Association for Computing Machinery. https://doi.org/10.1145/3551349.3559499

@inproceedings{042bd119d03341d4af61a1e6d421b425,

title = "Automated Identification of Security-Relevant Configuration Settings Using NLP",

abstract = "To secure computer infrastructure, we need to configure all security-relevant settings. We need security experts to identify security-relevant settings, but this process is time-consuming and expensive. Our proposed solution uses state-of-the-art natural language processing to classify settings as security-relevant based on their description. Our evaluation shows that our trained classifiers do not perform well enough to replace the human security experts but can help them classify the settings. By publishing our labeled data sets and the code of our trained model, we want to help security experts analyze configuration settings and enable further research in this area.",

keywords = "Hardening, Natural Language Processing, Security Configuration",

author = "Patrick St{\"o}ckle and Theresa Wasserer and Bernd Grobauer and Alexander Pretschner",

note = "Publisher Copyright: {\textcopyright} 2022 ACM.; 37th IEEE/ACM International Conference on Automated Software Engineering, ASE 2022 ; Conference date: 10-10-2022 Through 14-10-2022",

year = "2022",

month = sep,

day = "19",

doi = "10.1145/3551349.3559499",

language = "English",

series = "ACM International Conference Proceeding Series",

publisher = "Association for Computing Machinery",

editor = "Mario Aehnelt and Thomas Kirste",

booktitle = "37th IEEE/ACM International Conference on Automated Software Engineering, ASE 2022",

}

Stöckle, P, Wasserer, T, Grobauer, B & Pretschner, A 2022, Automated Identification of Security-Relevant Configuration Settings Using NLP. in M Aehnelt & T Kirste (eds), 37th IEEE/ACM International Conference on Automated Software Engineering, ASE 2022., 131, ACM International Conference Proceeding Series, Association for Computing Machinery, 37th IEEE/ACM International Conference on Automated Software Engineering, ASE 2022, Rochester, United States, 10/10/22. https://doi.org/10.1145/3551349.3559499

Automated Identification of Security-Relevant Configuration Settings Using NLP. / Stöckle, Patrick; Wasserer, Theresa; Grobauer, Bernd et al.
37th IEEE/ACM International Conference on Automated Software Engineering, ASE 2022. ed. / Mario Aehnelt; Thomas Kirste. Association for Computing Machinery, 2022. 131 (ACM International Conference Proceeding Series).

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › peer-review

TY - GEN

T1 - Automated Identification of Security-Relevant Configuration Settings Using NLP

AU - Stöckle, Patrick

AU - Wasserer, Theresa

AU - Grobauer, Bernd

AU - Pretschner, Alexander

PY - 2022/9/19

Y1 - 2022/9/19

N2 - To secure computer infrastructure, we need to configure all security-relevant settings. We need security experts to identify security-relevant settings, but this process is time-consuming and expensive. Our proposed solution uses state-of-the-art natural language processing to classify settings as security-relevant based on their description. Our evaluation shows that our trained classifiers do not perform well enough to replace the human security experts but can help them classify the settings. By publishing our labeled data sets and the code of our trained model, we want to help security experts analyze configuration settings and enable further research in this area.

AB - To secure computer infrastructure, we need to configure all security-relevant settings. We need security experts to identify security-relevant settings, but this process is time-consuming and expensive. Our proposed solution uses state-of-the-art natural language processing to classify settings as security-relevant based on their description. Our evaluation shows that our trained classifiers do not perform well enough to replace the human security experts but can help them classify the settings. By publishing our labeled data sets and the code of our trained model, we want to help security experts analyze configuration settings and enable further research in this area.

KW - Hardening

KW - Natural Language Processing

KW - Security Configuration

UR - http://www.scopus.com/inward/record.url?scp=85146917162&partnerID=8YFLogxK

U2 - 10.1145/3551349.3559499

DO - 10.1145/3551349.3559499

M3 - Conference contribution

AN - SCOPUS:85146917162

T3 - ACM International Conference Proceeding Series

BT - 37th IEEE/ACM International Conference on Automated Software Engineering, ASE 2022

A2 - Aehnelt, Mario

A2 - Kirste, Thomas

PB - Association for Computing Machinery

T2 - 37th IEEE/ACM International Conference on Automated Software Engineering, ASE 2022

Y2 - 10 October 2022 through 14 October 2022

ER -

Stöckle P, Wasserer T, Grobauer B, Pretschner A. Automated Identification of Security-Relevant Configuration Settings Using NLP. In Aehnelt M, Kirste T, editors, 37th IEEE/ACM International Conference on Automated Software Engineering, ASE 2022. Association for Computing Machinery. 2022. 131. (ACM International Conference Proceeding Series). doi: 10.1145/3551349.3559499

Automated Identification of Security-Relevant Configuration Settings Using NLP

Abstract

Publication series

Conference

Keywords

Access to Document

Other files and links

Fingerprint

Cite this