Automated Identification of Security-Relevant Configuration Settings Using NLP

To secure computer infrastructure, we need to configure all security-relevant settings. We need security experts to identify security-relevant settings, but this process is time-consuming and expensive. Our proposed solution uses state-of-the-art natural language processing to classify settings as s...

Full description

Saved in:
Bibliographic Details
Published in:arXiv.org 2022-09
Main Authors: Stöckle, Patrick, Wasserer, Theresa, Grobauer, Bernd, Pretschner, Alexander
Format: Article
Language:English
Subjects:
Classification
Configurations
Natural language processing
Security
Online Access:Get full text
Tags: Add Tag
No Tags, Be the first to tag this record!
Description
Summary:To secure computer infrastructure, we need to configure all security-relevant settings. We need security experts to identify security-relevant settings, but this process is time-consuming and expensive. Our proposed solution uses state-of-the-art natural language processing to classify settings as security-relevant based on their description. Our evaluation shows that our trained classifiers do not perform well enough to replace the human security experts but can help them classify the settings. By publishing our labeled data sets and the code of our trained model, we want to help security experts analyze configuration settings and enable further research in this area.
ISSN:2331-8422
DOI:10.48550/arxiv.2209.08853