Advanced user’s guide#
Important
This guide is in the making.
NVD datasets#
Our tool matches certificates to their possible CVEs using datasets downloaded from National Vulnerability Database (NVD). If you’re fully processing the CCDataset
or FIPSDataset
by yourself, you must somehow obtain the NVD datasets.
Our tool can seamlessly download the required NVD datasets when needed. We support two download mechanisms:
Fetching datasets with the NVD API (preferred way).
Fetching snapshots from seccerts.org.
The following two keys control the behaviour:
preferred_source_nvd_datasets: "api" # set to "sec-certs" to fetch them from sec-certs.org
nvd_api_key: null # or the actual key value
If you aim to fetch the sources from NVD, we advise you to get an NVD API key and set the nvd_api_key
setting accordingly. The download from NVD will work even without API key, it will just be slow. No API key is needed when preferred_source_nvd_datasets: "sec-certs"
Inferring inter-certificate reference context#
Important
This is an experimental feature.
We provide a model that can predict the context of inter-certificate references based on the text embedded in the artifacts. The model output is not incorporated into the CCCertificate
instances, but can be dumped into a .csv
file from where it can be correlated with a DataFrame of certificate features.
To train and deploy the model, it should be sufficient to change some paths and run the prediction notebook. The output of this notebook is a prediction.csv
file that can be loaded into the references notebook. This notebook documents the full analysis of references conducted on the Common Criteria certificates. Among others, the notebook generates some further .csv
files that can subsequently be plotted via plotting notebook.