18th Annual FIRST Conference
June 25-30, 2006 - Baltimore, Maryland, United States

Proposal of RSS Extension for Security Information Exchange
Masato Terada†, Shingo Takada
Graduate School of Science and Technology, Keio University.
3-14-1 Hiyoshi, Kohoku, Yokohama, Kanagawa 223-8522, Japan

Junji Fukuzawa
Security Center, Information-technology Promotion Agency (IPA), Japan
Bunkyo Green Court, 2-28-8, Hon-Komagome, Bunkyo-ku, Tokyo 113-6591, Japan
and

Norihisa Doi ‡Graduate School of Science and Engineering, Chuo University.
1-13-27 Kasuga, Bunkyo-ku, Tokyo 112-8551, Japan

Abstract
Unauthorized access intended to distribute malware has
been widely spread across the Internet and causing a lot ofdamage worldwide. In order to eliminate vulnerabilities
that can be exploited by those malware and prevent
unauthorized access, it is necessary to improve the way to
distribute security information about computer softwareand hardware. In this paper, we examines how we canprovide a more efficient security information distribution
service for the security administrators that helps them
reduce their workload related in gathering and grouping
information from various sources and take care ofvulnerabilities and incidents.
We propose JVNRSS (JP Vendor Status Notes RSS) as asecurity information sharing and exchanging specification.
Currently, JPCERT/CC and IPA (Information-technology
Promotion Agency) are promoting a framework to handle
vulnerability information in Japan. They offer JVN (JPVendor Status Notes), a portal site to provide security
information about the domestic computer software andhardware manufactured by the vendors participating in theframework. JVNRSS is one of the methods JVN has beenusing to distribute security information.
JVNRSS is based on RSS 1.0 and uses the"<dc:relation>" field defined in the Dublin Core as a
Relational ID to correlate security information issued byvarious sources. JVNRSS uses the reference URL specified
in a security alert, for example, an URL of the Common
Vulnerability Exposure, CERT Advisory, CERT
Vulnerability Note, US-CERT Technical Alert and CIAC
Bulletin. In this paper, firstly we will explain thespecification and applications of JVNRSS. Secondly, we
will introduce the result of our feasibility study on
JVNRSS and lastly we will propose the RSS Extension for
security information sharing through the Internet.
Keywords: Network Security, Vulnerability, Information
Sharing, Exchange Specification and RSS

1. Introduction
Recently, malware (Viruses, Worms, Trojan Horses etc.)
propagation is widely seen and causing a lot of damage
broadly in various ways. Especially since the havoc
brought by SQL Slammer in January 2003 and MS-Blasterin August 2003, we should promote the countermeasuresthat protect not only the server systems but also the clientsystems. In order to prevent unauthorized access andeliminate the vulnerabilities in the information systems, it isnecessary to improve the security information sharing toenable users to take appropriate actions.
In Japan we hadn’t had a function like the CERT/CC
Vulnerability Notes Database that collected security
information. To improve this situation, the JVN (at thispoint called JPCERT/CC Vender Status Notes Database)[1] was created in February 2003 with the support of the
JPCERT/CC. We designed the JVN as a portal site toprovide information on vulnerabilities in software products
used in Japan. The purpose of the database is to provide thelatest information about the vulnerabilities in the domestic
software products and help users deal with thosevulnerabilities. Although information about vulnerabilities†) Security Center, IPA (Information-technology Promotion Agency, Japan)
JVN WG member, JPCERT/CC
Hitachi Incident Response Team, Hitachi Ltd.
‡) Graduate School of Science and Technology, Keio University

18th Annual FIRST Conference
June 25-30, 2006 - Baltimore, Maryland, United Statesmeans that fragmented information from various websites
are collected and reassembled, and considerable time andefforts are required to reestablish the connections andrelationships among the various bits and pieces of
information. In short, it is necessary to improve the methodof the security information exchange. From the information
provider’s point of view, if information could be publishedin a form more easily processed by a machine, theninformation could be reused much more flexibly andextensively. We propose “JVNRSS”, an RSS based format,
as an approach to solve this problem. JVNRSS is based on
RSS 1.0 [4] and uses the field <dc:relation> of the Dublin
Core as a primary key to group security information. This
paper discusses the specification of JVNRSS and its
applications. At the end, we will introduce RSS extension
for security information exchange.

per se has been already disseminated in the form of the
security hole reports put out by many organizations andvendors, the database greatly enhances the usefulness of
the information by also including the updates and the status
reports on the latest efforts by the product venders to deal
with vulnerabilities. The primary purpose of the JVN
Database is to collect and disseminate these information.
In July 2004, the Ministry of Economy, Trade andIndustry (METI) adopted the "Standard for Handling
Software Vulnerability Information" as an official rule, andbegan promoting the "Information Security Early Warning
Partnership" as an implementation framework [2]. The JVN
has become the portal site to provide the security
information about the domestic computer software andhardware manufactured by the vendors registered in theframework [ 3 ]. Launched with the support of the
JPCERT/CC on the basis of its successful feasibility study,
the JVN has become a joint venture by IPA andJPCERT/CC within the official framework. Subsequently,
the name of the organization was changed to "JP Vendor
Status Notes," but the original acronym JVN was retained,
and the portal site for publishing the status of the vendor’seffort dealing with the domestic software vulnerabilities
has also been kept as it was.
2002
2002

2003
2003

2004
2004

2. Related Work
2.1 Security Information Sharing
The related researches on the security information sharing
are the followings:
CVE [5]
Common Vulnerabilities and Exposures (CVE) is a list of
standardized names for vulnerabilities and otherinformation security exposures (ex. CVE-1999-1011). CVE
supports relationship among all publicly known
vulnerabilities and security exposures. Many tools, Web
sites, databases, or services use the CVE name in a waythat allows them to cross-link with other repositories that
also use the CVE name.

2005
2005

2002/06 JVN Project Started
2003/02 jvn.doi.ics.keio.ac.jp
2003/07 JVNRSS channel service
2004/01 TRnotes service

2004/07 jvn.jp
jvn.jp
1st Step (Trial Site)
JVN: JPCERT/CC Vendor Status Notes
February 3, 2003
URL
http://jvn.doi.ics.keio.ac.jp
Email jvn@doi.ics.keio.ac.jp

nd Step
22nd
Step
JVN:
JVN: JPJP Vendor
Vendor Status
Status Notes
Notes
July
July 8,
8, 20042004
URL
http://jvn.jp/
URL
http://jvn.jp/
Email
Email jvn@jvn.jp
jvn@jvn.jp

NIST NVD [6]National Vulnerability Database (NVD) is a comprehensive
cyber security vulnerability database and refers to CVE. It
provides the search capability and directs users tovulnerability and patch information.

Figure 1: JVN History

JVN provides the "Vendor Status Notes (VN)" and the"Status Tracking Notes (TRnotes)". VN is a service
providing information on how to fix vulnerabilities. It issimilar to the “CERT Vulnerability Notes” and follows up
the IPA/JPCERT Vulnerability reports, US-CERT Alerts,
US-CERT Vulnerability Notes and NISCC Advisories.
TRnotes is a service providing a list of incident information
related to vulnerabilities such as the followings:

OSVDB [7]Open Source Vulnerability Database (OSVDB) is avendor-neutral vulnerability database for the information
security community. The goals of the project are topromote a greater and more open collaboration between
companies and individuals, eliminate redundant works andreduce expense inherent in the system and productdevelopment.

When was the exploit code released to the public?
What kind of incidents were they?
What kind of countermeasure was applied to theincidents?

Our approach supports to distribute security information
and build a relationship among these vulnerability
information.

Currently, VN, TRnotes and other security information are
distributed in the form of a HTML-based web page. This2

18th Annual FIRST Conference
June 25-30, 2006 - Baltimore, Maryland, United States

through the JVN website. But in order to reusepublished information, it must be offered in amachine-readable format. This is where RSS comes in.
By using RSS, JVN data can be distributed in thesame way just as the news feeds provided by the news
websites. And because the content is described by
RSS, it can be easily verified if information has been
added to an item or an item has been updated.

2.2 Security information exchange specification
The related researches on the security informationexchange specification are the followings.
EISPP [8]European Information Security Promotion Programme(EISPP) is a project co-funded by the European
Community. EISPP Common Advisory Format Description
enables an easy exchange of advisory data among four
CERTs participating in EISPP. EISPP merges best-practiceinformation regarding security advisories issued by those
CERTs.

More efficient aggregation of information fromproduct vendors
JVN aggregates security information from the productvendors received via e-mail notifications. But in orderto enlist the participation of as many product vendors
as possible, an efficient means of collecting
information other than e-mail must be also set up. Useof RSS will enable information to be collected fromthe product vendor’s website and be automaticallycombined with other security information at the JVN
website.

CAIF [9]Common Announcement Interchange Format (CAIF) is an
XML-based format to store and exchange security
announcements in a normalized way. It provides a basic but
comprehensive set of elements that are designed to describe
the main aspects of a security-related issue.
VULDEF [10]The purpose of the "Vulnerability Data Publication Format(VULDEF)/Security Advisory Publication Format" is todefine the data formats for the information related tosecurity advisories typically published by the productvendors and CSIRTs. VULDEF has some elements todescribe the vulnerability, affected items and solutions etc.

3. Specification of JVNRSSRSS is an XML-based format that allows the consolidationof the lists of hyperlinks. The original RSS, version 0.90,
was developed by Netscape as a format for building theportals of headlines for the major news sites. RSS 1.0 was
based on RDF (Resource Description Framework) anddesigned by the original guiding principles of RSS 0.90.
JVNRSS is based on RSS 1.0 and uses the field<dc:relation> of the Dublin Core as a primary key to groupsecurity information (See Table 1) [11]. JVNRSS with theRelational ID in <dc:relation> is shown in Figure 3. RSS
contains a list of items, each of which is identified by a link.
Each item can have any amount of metadata associatedwith it. The most basic metadata supported by RSS
includes a title for the link and a description of it. Our
proposed Relational ID allows the security informationfrom the different websites to correlate with each other.

EISPP, CAIF and VULDEF are the XML formats todescribe the details of security information and JVNRSS is
an XML format based on RSS to describe the overview of
those formatted security information (Figure 2).

Overview Format

JVNRSS

Title
Overview
Affected System
ImpactSolution

Detail Format

VULDEFandothersExploit
Reference<item rdf:about="URL of security information"><title>Title</title><link>URL of security information</link><dscription>Outline of security information</description><dc:publisher>Product vendor name</dc:publisher><dc:creator>Contact point information</dc:creator><dc:identifier>Security information ID</dc:identifier><dc:relation>Relational ID (1) {CVE|CERT-CA|CERT-VU|etc.}</dc:relation><dc:relation>Relational ID (2) {CVE|CERT-CA|CERT-VU|etc.}</dc:relation><dc:relation>::</dc:relation><dc:date>Date last updated</dc:date><dcterms:issued>Date first published</cterms:issued><dcterms:modified>Date last updated</dcterms:modified></item>Figure 2: The classification of JVNRSS and Others.

Making use of JVNRSS is an essential point in the security
information exchange, for this handily resolves thefollowing two basic issues:
Distribution designed to encourage reuse of
information
Our primary objective is to aggregate security
information from the product vendors and provide it

Figure 3: The format of the item part of JVNRSS.
3

18th Annual FIRST Conference
June 25-30, 2006 - Baltimore, Maryland, United States

JVNRSS uses the reference URL specified in a security
alert as Relational ID, for example, an URL of theCommon Vulnerability Exposure, CERT Advisory, CERT
Vulnerability Note, US-CERT Technical Alert and CIAC
Bulletin. These are the best reference for the Internet
security information.

The RSS items with the same Relational ID belong to thesame group. For example, two RSS items in Figure 4 referto the same vulnerability and are related to the US-CERT
Technical Alert TA04-111A, "Vulnerability in TCP". This
relational concept is based on the "Semantic Web" thatdefines and links information in a way that can be
automatically processed by computers using XML and
RDF.

Table 1: The definition of the item part of JVNRSS.
Element
item

title

link

description

dc:publisher

dc:creator

dc:identifier

dc:relation

dc:datedcterms:issued

dcterms:modified

Description
Syntax: <item rdf:about="{item_uri}">
Requirement: >= 1
Required Attribute(s): rdf:about
Model: (title, link, description?, dc:publisher, dc:identifier?,
dc:relation, dc:date, dcterms:issued?, dcterms:modified?)
Definition: A security information headline. {item_uri} must
be unique with respect to any other rdf:about attributes
in the JVNRSS document and is a URI which identifies
the item.
Syntax: <title>{item_title}</title>
Requirement: Required
Model: (#PCDATA)
Definition: The item's title for security information.
Syntax: <link>{item_link}</link>
Requirement: Required
Model: (#PCDATA)
Definition: The item's URL for security information.
Syntax: <description>{item_description}</description>
Requirement: Optional
Model: (#PCDATA)
Definition: A brief description/abstract of the item forsecurity information.
Syntax: <dc:publisher>{Product vendor name}</dc:publisher>
Requirement: Required
Model: (#PCDATA)
Definition: A product vendor name, an organization name,or a site name for the item for security information.
Syntax: <dc:creator>{Contact point information}</dc:creator>
Requirement: Optional
Model: (#PCDATA)
Definition: An entity primarily responsible for making thecontent of the resource. Typically, the name of a Creator
should be email address for contact.
Syntax: <dc:identifier>{Security information ID}</dc:identifier>Requirement: Optional
Model: (#PCDATA)
Definition: A unique identifier assigned by vendor.
Syntax: <dc:relation>{Relational ID}</dc:relation>
Requirement: Required
Model: (#PCDATA)
Definition: A best reference URI (CVE, CERT Advisory,
CERT Vulnerability Note, US-CERT Technical Alert etc.)
to a related security information.
Comment: NULL when there is no reference URI.
Syntax: <dc:date>{Date last updated}</dc:date>Requirement: Required
Model: (#PCDATA) [W3CDTF]
Definition: Its value is a date, indicating when the item waslast updated.
Recommendation: Complete date plus hours and minutes:
YYYY-MM-DDThh:mmTZD (eg 1997-07-16T19:20+01:00)
Syntax: <dcterms:issued>{Date first published}</dcterms:issued>
Requirement: Optional
Model: (#PCDATA) [W3CDTF]
Definition: Its value is a date, indicating when the item was
first published.
Syntax: <dcterms:modified>{Date last updated}</dcterms:modified>Requirement: Required
Model: (#PCDATA) [W3CDTF]
Definition: Its value is a date, indicating when the item waslast updated.

<item rdf:about="http://jvn.jp/cert/JVNTA04-111A"><title>Potential Reliability Issue in TCP</title><link>http://jvn.jp/cert/JVNTA04-111A</link><description /><dc:publisher>JVN</dc:publisher><dc:identifier>JVNTA04-111A</dc:identifier><dc:relation>http://www.us-cert.gov/cas/techalerts/TA04-111A.html</dc:relation><dc:date>2005-04-01T18:00+09:00</dc:date><dcterms:issued>2004-04-21T06:45+09:00</dcterms:issued><dcterms:modified>2005-04-01T18:00+09:00</dcterms:modified></item><item rdf:about="http://www.hitachi.co.jp/Prod/comp/network/notice/TCP.html"><title>GR2000/GR4000/GS4000/GS3000 Vulnerability Issues in TCP</title><link>http://www.hitachi.co.jp/Prod/comp/network/notice/TCP.html</link><description /><dc:publisher>Hitachi Ltd.</dc:publisher><dc:identifier /><dc:relation>http://www.us-cert.gov/cas/techalerts/TA04-111A.html</dc:relation><dc:relation>http://jvn.jp/cert/JVNTA04-111A</dc:relation><dc:date>2004-04-26</dc:date><dcterms:issued>2004-04-26</dcterms:issued><dcterms:modified>2004-04-26</dcterms:modified></item>Figure 4: An example of item part of JVNRSS.

jvnboxjvnticker
Figure 5: An example of a visualized JVNRSS for VN.

4

18th Annual FIRST Conference
June 25-30, 2006 - Baltimore, Maryland, United States

RSS format used by the major news sites. Then, once
security information is in the JVNRSS format, an
RSS-aware program can check the feed for changes andreact to the changes in an appropriate way. When security
information is machine-readable, many Internet sites can
reduce the cost of information gathering and grouping. Ourgathering and grouping approach using the JVNRSS format
has three steps, which are shown in Figure 8.

4. Applications of JVNRSSThis chapter describes the applications of JVNRSS.
4.1 Visualized JVNRSS(1) Visualized JVNRSSJVN provides not only an HTML-based information and
JVNRSS feed of the "Vendor Status Notes (VN)", but also
a visualized JVNRSS, which is an information box or
ticker for JVNRSS using FLASH [12]. The visualized
JVNRSS is shown in Figure 5. The purpose of thevisualized JVNRSS feed is to supply the summary of the
JVN articles through other websites.

(1) Gathering of the security information
The gathering module periodically checks changes in
JVNRSS feeds on other Web sites and extracts the
JVNRSS items upon change.
(2) Grouping of the security information
The grouping module extracts the Relational ID from theJVNRSS feed <item>. This module checks otherJVNRSS feed items using Relational ID as the searchkey.

(2) Visualized TRnotes
We should cooperate with other Internet websites toeliminate security incidents and event information sharing
is important to accomplish it. The purpose of TRnotes is toshare the timeline of the events, which include thediscovered date of a vulnerability, a published date of any
advisories, a released date of exploit codes and a confirmed
date of any worms on the vulnerability. The each web pageconsists of the overview, impact, the timeline of the eventsand related information. An example of the HTML-based
TRnotes is shown in Figure 6. The characteristics ofTRnotes are the followings:
The event time is marked hourly
The state is marked hourly, not daily, which is shownin Figure 6. In case of a mailing list, the sent or
received time becomes the event time. And in case ofa website, the Last-Modified in the header information
defined by the HTTP protocol is used as the event
time.
The event information is based on public
information
It is important that the security administrators for any
organizations share the same event information toeliminate the incidents on the Internet. The public
information has no restriction such as non-disclosure
policy and is possible to share information among
more security administrators.

Figure 6: An example of HTML based TRnotes.

TRnotes has the event list organized by the timeline andeach event entry of TRnotes is equivalent to the item partof JVNRSS. We can make the formatted and visualized
TRnotes by JVNRSS such as Figure 7. The purpose of thevisualized TRnotes is to arrange all events by time, whichis accomplished by the FLASH tool that sorts the items by<dcterms:issued>.
4.2 Security information gathering systemJVNRSS format is based on RSS 1.0, which is the same

Figure 7: Visualized TRnotes with JVNRSS format.

5

18th Annual FIRST Conference
June 25-30, 2006 - Baltimore, Maryland, United States(3) Convert XML to HTMLWeb Sites
CA-2003-04- Vendor A- Vendor B- News X:

HTMLHyperlink

CVE-2004-0230
TA04-111A
XF15886
VU#415294
BID10183JVNRSS(1) Gathering of
the security information

Convert moduleGrouping
modulemapping DB
Vendor A Site
Microsoft SQL Slammer Worm

Gathering
moduleCA-2003-20
CIAC Bulletin N-133
JPCERT-AT-2003-0005
JPCERT-AT-2003-0006

News X Site
SQL Slammer worm information

Mapping DB
CERT-CACVE etc

ArchiveDB

JVNRSS<item rdf:about="http://VendorA/sec01.html"><title>Vulnerability Issues in TCP</title><link>http://VendorA/sec01.html</link><dc:relation>TA04-111A</dc:relation></item><item rdf:about="http://NewsX/sec99.html"><title>Potential Reliability Issue in TCP</title><link>http://NewsX/sec99.html</link><dc:relation>VU#415294</dc:relation></item>Figure 9: Relational ID and Mapping DB.

(2) Grouping of
the security information

Figure 8: Overview of the gathering and grouping
approach by JVNRSS.

When the module finds <item> with the same Relational
ID, it makes these <items> into a group (Figure 12).
When this module does not find any item with the same
Relational ID, it will try to find a matching Relational ID
using the Mapping DB (Figure 13). The Mapping DB of
the Relational IDs is shown in Figure 9. The upper groupin the mapping DB shows the vulnerability information
related to the TCP stack and the lower group shows theincident information about the MS-Blaster worm. The
items on the right, which refer to the same vulnerability
or incident, belong to the same group. In case the feed
<items> have a different Relational ID yet refer to thesame vulnerability, the mapping DB traces therelationship between those Relational IDs.

Figure 10: Visualized CVE with the security
information of Japanese Vendors.

(3) Convert XML to HTMLThe Convert module transforms XML documents into a
HTML form to present security information.

<item rdf:about="http://www.us-cert.gov/cas/techalerts/TA04-111A.html"><title>Vulnerabilities in TCP</title><link>http://www.us-cert.gov/cas/techalerts/ TA04-111A.html</link><description>Most implementations of the BGP ...</description><dc:publisher>US-CE RT</dc:publisher><dc:identifier> TA04-111A</dc:identifier><dc:date>2005-09-09</dc:date><sec:item><item rdf:about="http://jvn.jp/cert/JV NTA04-111A"><title>Potential Reliability Issue in TCP</title><link> http://jvn.jp/cert/JV NTA04-111A</link><dc:publisher> JVN</dc:publisher><dc:identifier>JV NTA04-111A</dc:identifier><dc:relation>http://www.us-cert.gov/cas/techalerts/TA 04-111A.html</dc:relation><dc:date>2005-04-21T18:00+09:00</dc:date><sec:item><item rdf:about="http://www.hitachi.co.jp/Prod/comp/net work/notice/TCP.html"><title>GR2000/GR4000/GS4000/GS 3000 Vulnerability Issues in TCP</title><link>http://www.hitachi.co.jp/Prod/comp/network/notice/ TCP.html </link><dc:publisher>Hitachi</dc:publisher><dc:identifier /><dc:relation>http://jvn.jp/cert/JVNTA04-111A</dc:relation><dc:date>2004-04-22</dc:date></item></sec:item></item></sec:item></item>

4.3 CVE mapping of the security information
CVE is a list of standardized names for vulnerabilities andother information security exposures. Currently CVE
mostly doesn’t include security information published by
Japanese vendors, because Japanese vendors don't post
security information in a CVE-compatible format. The
purpose of grouping security information is to make arelationship map between CVE and Japanese security
information. Our approach to CVE mapping is the same as
the above section. The grouping module extracts theRelational ID of JVNRSS feed <item> and finds the CVE
entry with the same Relational ID. In addition, thevisualized CVE, which is a folder box using FLASH, isshown in Figure 10. The visualized CVE uses the extended
JVNRSS format to describe the grouping of security
information (Figure 11 and Table 2).

Figure 11: The format of item part of Extended
JVNRSS for visualized CVE.

6

18th Annual FIRST Conference
June 25-30, 2006 - Baltimore, Maryland, United States: :Vendor A<rdf:Seq><rdf:li rdf:resource="http://VendorA/sec01.html" /><rdf:li rdf:resource="http://VendorA/sec02.html" /></rdf:Seq>: :<item rdf:about=“http://vendorA/sec01.html"><title>Microsoft SQL Slammer Worm</title><link> http://vendorA/sec01.html</link><description>Overview of Microsoft SQL Slammer Worm</description><dc:publisher>Vendor A</dc:publisher><dc:identifier>AA01</dc:identifier><dc:relation>http://www.cert.org/ CA-2003-04.html</dc:relation></item>CA-2003-04: :<rdf:Seq><rdf:li rdf:resource="http://VendorA/sec01.html" /><rdf:li rdf:resource="http://News X/sec99.html" /></rdf:Seq>: :<item rdf:about=“http://vendorA/sec01.html"><title>Microsoft SQL Slammer Worm</title><link> http://vendorA/sec01.html</link><description>Overview of Microsoft SQLSlammer Worm</description><dc:publisher>Vendor A</dc:publisher><dc:identifier>AA01</dc:identifier><dc:relation>http://www.cert.org/ CA-2003-04.html</dc:relation></item><item rdf:about=“http://News X/sec99.html"><title>About SQL Slammer Worm</title><link> http://News X/sec99.html</link><description>SQL Slammer worm attack to1434/UDP.</description><dc:publisher> News Site X</dc:publisher><dc:identifier /><dc:relation>http://www.cert.org/ CA-2003-04.html</dc:relation></item>: :News Site X<rdf:Seq><rdf:li rdf:resource="http://News X/sec98.html" /><rdf:li rdf:resource="http://News X/sec99.html" />match</rdf:Seq>: :YES<item rdf:about=“http://News X/sec99.html"><title>About SQL Slammer Worm</title><link> http://News X/sec99.html</link><description>Attack port 1434/UDP</description>
CA-2003-04<dc:publisher> News Site X</dc:publisher><dc:identifier /><dc:relation>http://www.cert.org/ CA-2003-04.html</dc:relation> Grouping</item>moduleFigure 12: The grouping mechanism using Relational ID without mapping DB.

: :Vendor A<rdf:Seq><rdf:li rdf:resource="http://VendorA/sec01.html" /><rdf:li rdf:resource="http://VendorA/sec02.html" /></rdf:Seq>: :<item rdf:about=“http://vendorA/sec01.html"><title>Vulnerability Issues in TCP</title><link>http://vendorA/sec01.html</link><description>TCP DoS</description><dc:publisher>Vendor A</dc:publisher><dc:identifier>AA01</dc:identifier><dc:relation>http://www.kb.cert.org/ vuls/id/415294</dc:relation></item>: :<rdf:Seq><rdf:li rdf:resource="http://VendorA/sec01.html" /><rdf:li rdf:resource="http://News X/sec99.html" /></rdf:Seq>: :<item rdf:about=“http://vendorA/sec01.html"><title>Microsoft SQL Slammer Worm</title><link>http://vendorA/sec01.html</link><description>TCP DoS</description><dc:publisher>Vendor A</dc:publisher><dc:identifier>AA01</dc:identifier><dc:relation>http://www.kb.cert.org/ vuls/id/415294</dc:relation></item><item rdf:about=“http://News X/sec99.html"><title>Potential Reliability Issue in TCP</title><link>http://News X/sec99.html</link><description>TCP Vulnerability Information</description><dc:publisher> News Site X</dc:publisher><dc:identifier />< dc:relation>http://www.us -cert.gov/cas/techalerts/
TA04-111A.html</dc:relation ></item>VU#415294: :News Site X<rdf:Seq>match<rdf:li rdf:resource="http://News X/sec98.html" />YES<rdf:li rdf:resource="http://News X/sec99.html" /></rdf:Seq>: :VU#415294<item rdf:about=“http://News X/sec99.html"><title>Potential Reliability Issue in TCP</title>
TA04-111A<link> http://News X/sec99.html</link><description>TCP Vulnerability Information</description><dc:publisher> News Site X</dc:publisher><dc:identifier /><dc:relation>http://www.us-cert.gov/cas/techalerts/TA04-111A.html</dc:relation></item>Grouping
Modulemapping from TA04-111A to VU#415294
Figure 13: The grouping mechanism using Relational ID with mapping DB.

7

18th Annual FIRST Conference
June 25-30, 2006 - Baltimore, Maryland, United States

5. JVNRSS practical activity
In May 2006, a website for the feasibility study on
JVNRSS’s practical activities was launched [13]. This
chapter introduces JVNRSS activities.

TouchGraph
Link Browser

MAP Viewer

LIST Viewer

Java
AppletSWF

SWF

TouchGraph
TouchGraph
XML
XML

CVE+
http://jvnrss.ise.chuo-u.ac.jp/jtg/cve+/
CVE+ is to make a relationship map between CVE
and Japanese security information. Some modules in
Figure 14 have been implemented as a Proof ofConcept prototype. Also the convert module producesa TouchGraph XML format to describe therelationship map [14].
TRnotes
http://jvnrss.ise.chuo-u.ac.jp/jtg/trn/TRnotes will provide not only the HTML-based
information but also the JVNRSS format and theVisualized TRnotes. Currently, some information isavailable at the above website.
XSL_swf
http://jvnrss.ise.chuo-u.ac.jp/jtg/xswf/
XSL_swf is a FLASH tool for the visualized JVNRSS
and uses part of XSL as a mechanism to describe how
a document should be displayed. For example, if an
item entry of RSS or JVNRSS doesn't have a severity
level, XSL_swf displays a document with the severity
level defined in the XSL file. Currently, our XSL_swf
implementation refers to RSS including XSL, andparses an XSL file to display the severity level such as
red (LEVEL1), yellow (LEVEL2) and blue (LEVEL3)
when the XSL file includes the following entries(Figure 15).

JVNRSSJVNRSS<sec:item><sec:item>

HTML
HTML

Convert module

cve.xml

Grouping
moduleGathering
moduleMapping
DB

ArchiveDB

jvnrss.rdf

nvd.xmlsite.A

jvnrss.rdf

site.B

CVE.mitre.org NVD.nist.gov

Figure 14: System overview of CVE+.

<xsl:when test="rss:link=“'http://xxx'">LEVEL1</xsl:when><xsl:when test="rss:link='http://yyy'">LEVEL2</xsl:when><xsl:when test="rss:link='http://zzz'">LEVEL3</xsl:when>

Figure 15: Example of XSL_swf

RSS_dir
http://jvnrss.ise.chuo-u.ac.jp/jtg/rssd/
RSS_dir is a concept of the RSS directory for the RSS
channel. The RSS directory describes a RSS channel
tree with the RSS format. Some visualized tools havebeen implemented as a Proof of Concept prototype
such as one shown in Figure 16.

Step1: Read top layer RDF
jp_root.rdf
JP root

Table 2: The definition of item part of Extended
JVNRSS for visualized CVE
Element
sec:item

Web Browser

JP vendor A

SWF

vendorA.rdf

JP vendor B

vendorB.rdf

JP vendor Y

vendorY.rdf

Step2:
Read 2nd
layer RDFs

vendorC.rdf

JP vendor C

Description
Syntax: <sec:item>
Requirement: Optional
Model: (item*)Definition: Nest of item set in JVNRSS.

year2004

2004.rdf

year2005

2005.rdf

year2006

2006.rdf

Figure 16: RSS directory for RSS channel.

818th Annual FIRST Conference
June 25-30, 2006 - Baltimore, Maryland, United States

6. Proposal RSS Extension
JVNRSS is based on RSS 1.0 and a proprietary format inJapan. Right now, in other words, the ability to use RSS
holds the key to successfully implement a scheme for
distributing security related information. This section
describes the RSS Extension’s definition of the tags for
RSS 1.0, RSS 2.0 and Atom [15].

<?xml version="1.0" encoding="utf-8"?><rdf:RDF
xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"
xmlns="http://purl.org/rss/1.0/"
xmlns:dc="http://purl.org/dc/elements/1.1/"
xmlns:dcterms="http://purl.org/dc/terms/"
xmlns:sec="http://jvn.jp/rss/mod_sec/">

Here is the list of the proposed elements. Examples withthe proposed elements are shown in Figure 18 and Figure
17.

<channel rdf:about="http://jvn.jp/rss/jvnJPRSS.rdf"><title>JVNRSS Feed</title><link>http://jvn.jp/jp/</link><description>JP Vendor Status Notes - JP</description><dc:publisher>JVN</dc:publisher><dc:creator>jvn@jvn.jp</dc:creator><dcterms:issued>2005-05-01T08:00+09:00</dcterms:issued><dcterms:modified>2005-06-18T08:23+09:00</dcterms:modified><items><rdf:Seq><rdf:li rdf:resource="http://jvn.jp/jp/JVN%2312345678" /><rdf:li rdf:resource="http://jvn.jp/jp/JVN%2300ABCDEF" /></rdf:Seq></items></channel><?xml version="1.0" encoding="utf-8"?><rss version="2.0"
xmlns:sec="http://jvn.jp/rss/mod_sec/"><channel><title>JVNRSS Feed</title><link>http://jvn.jp/jp/</link><description>JP Vendor Status Notes - JP</description><pubDate>Sun, 01 May 2005 08:00:00 +0900</pubDate><lastBuildDate>Sat, 18 Jun 2005 08:23:00 +0900</lastBuildDate><item rdf:about="http://jvn.jp/jp/JVN%2312345678"><title>JVN Qualified Security Advisory #12345678</title><link>http://jvn.jp/jp/JVN%2312345678</link><description>This example is description about Qualified
Security advisory Reference #12345678</description><dc:publisher>JVN</dc:publisher><dc:creator>jvn@jvn.jp</dc:creator><dcterms:issued>2005-05-22T14:00+09:00</dcterms:issued><dcterms:modified>2005-06-18T08:23+09:00</dcterms:modified><sec:identifier>JVN#12345678</sec:identifier><sec:references sec:source="JPCERT"
sec:id="JPCERT-AT-2005-0522">
http://www.jpcert.or.jp/at/2005/at050522.txt</sec:references></item><item><title>JVN Qualified Security Advisory #12345678</title><link>http://jvn.jp/jp/JVN%2312345678</link><description>This example is description about Qualified
Security Advisory Reference #12345678</description><author>JVN</author><pubDate>Sat, 18 Jun 2005 08:23:00 +0900</pubDate><sec:identifier>JVN#12345678</sec:identifier><sec:references sec:source="JPCERT"
sec:id="JPCERT-AT-2005-0522">
http://www.jpcert.or.jp/at/2005/at050522.txt</sec:references></item><item><title>JVN's Qualified Security Advisory #00ABCDEF</title><link>http://jvn.jp/jp/JVN%2300ABCDEF</link><description>This example is description about Qualified
Security Advisory Reference #00ABCDEF</description><author>JVN</author><pubDate>Tue, 31 May 2005 22:22:00 +0900</pubDate><sec:identifier>JVN#00ABCDEF</sec:identifier><sec:references sec:source="JPCERT"
sec:id="JPCERT-AT-2005-0501">
http://www.jpcert.or.jp/at/2005/at050501.txt</sec:references></item><item rdf:about="http://jvn.jp/jp/JVN%2300ABCDEF"><title>JVN Qualified Security Advisory #00ABCDEF</title><link>http://jvn.jp/jp/JVN%2300ABCDEF</link><description>This example is description about Qualified
Security Advisory Reference #00ABCDEF</description><dc:publisher>JVN</dc:publisher><dc:creator>jvn@jvn.jp</dc:creator><dcterms:issued>2005-05-01T08:00+09:00</dcterms:issued><dcterms:modified>2005-05-31T22:22+09:00</dcterms:modified><sec:identifier>JVN#00ABCDEF</sec:identifier><sec:references sec:source="JPCERT"
sec:id="JPCERT-AT-2005-0501">
http://www.jpcert.or.jp/at/2005/at050501.txt</sec:references></item></channel></rss></rdf:RDF>

Figure 17: An example of RSS 2.0 with Extension.
Figure 18: An example of RSS 1.0 with Extension.

9

18th Annual FIRST Conference
June 25-30, 2006 - Baltimore, Maryland, United States

Some visualization tools have been implemented as a Proofof Concept prototype. For the future work, we will
implement the JVNRSS gathering, grouping and convert
modules. In addition, we will clarify how we can establish
a relationship between RSS extension and the existing
information sharing mechanisms such as CVE, NIST NVD
and OSVDB.

(1) sec:references
sec:references is an element for the best reference (CVE,
CERT Advisory, CERT Vulnerability Note, US-CERT
Technical Alert etc.) to the related security information.
Syntax:<sec:references
sec:source="%name"
sec:id="%id">%ResourceReference</sec:references>

Acknowledgements
Part of this work was supported by "The Special
Coordination Funds for Promoting Science andTechnology" by the Ministry of Education, Culture, Sports,
Science and Technology (MEXT), Japan. The authors are
grateful to Hiroshi Takasaki and Hiroko Okashita for theirassistance, and to their colleagues in the IPA andJPCERT/CC for their insightful comments.

%nameThis attribute specifies an abbreviated name, which
provides the best reference, such as CVE, JPCERT,
CERT, CIAC, BID, CERT-VN, MS, OSVDB, XF
etc.
%id
This attribute specifies the unique identifierassigned by sec:source, such as VU#105259,
MS01-044,
CVE-2001-0525,
CA-2001-14,
TA05-111A etc.
%ResourceReferenceThis attribute specifies a URI of the reference to theresource.

References[1] JPCERT/CC Vendor Status Notes,
http://jvn.doi.ics.keio.ac.jp/[2] Information Security Early Warning Partnership,
http://www.ipa.go.jp/english/security/third.html[3] JP Vendor Status Notes,
http://jvn.jp/[4] RDF Site Summary (RSS),
http://web.resource.org/rss/1.0/[5] Common Vulnerabilities and Exposures,
http://cve.mitre.org/[6] National Vulnerability Database,
http://nvd.nist.gov/[7] Open Source Vulnerability Database,
http://www.osvdb.org/[8] European Information Security Promotion Programme,
http://www.eispp.org/[9] Common Announcement Interchange Format,
http://cert.uni-stuttgart.de/projects/caif/[10] VULDEF: Security Advisory Publication Format,
http://jvnrss.ise.chuo-u.ac.jp/jtg/vuldef/[11] JVNRSS - JP Vendor Status Notes RDF Site Summary
http://jvnrss.ise.chuo-u.ac.jp/jtg/jvnrss/[12] About JVNRSS,
http://jvn.jp/rss/jvnrss.html[13] JVNRSS feasibility site,
http://jvnrss.ise.chuo-u.ac.jp/jtg/[14] TouchGraph Link Browser
http://touchgraph.sourceforge.net/index.html#TGLB[15] Qualified Security Advisory Reference (mod_sec)
http://jvnrss.ise.chuo-u.ac.jp/jtg/mod_sec/(2) sec:identifier
sec:identifier is an element for the unique identifierassigned by the vendor.
Syntax:</sec:identifier>%id</sec:identifier>%idThis attribute specifies the unique identifierassigned by the vendor, such as "Cisco Security
Advisory ID#50960", HPSBMA01234 etc.

7. Conclusion
We propose "JVNRSS" to improve the security informationexchange for security administrators. JVNRSS is based on
RSS 1.0 and uses the field <dc:relation> of the Dublin Core
as a primary key to group security information. This paper
has discussed the specification of JVNRSS and its
applications, especially the gathering and grouping
approach to the security information exchange.
Furthermore, we introduced the RSS extension for security
information exchange. The security administrators must
engage in information gathering to eliminate the threats,
and we believe our approach greatly supports this task.

10