|
1209 | 1209 | <nav class="md-nav" aria-label="Research View (View-1000)"> |
1210 | 1210 | <ul class="md-nav__list"> |
1211 | 1211 |
|
| 1212 | + <li class="md-nav__item"> |
| 1213 | + <a href="#repeatability" class="md-nav__link"> |
| 1214 | + <span class="md-ellipsis"> |
| 1215 | + Repeatability |
| 1216 | + </span> |
| 1217 | + </a> |
| 1218 | + |
| 1219 | +</li> |
| 1220 | + |
1212 | 1221 | <li class="md-nav__item"> |
1213 | 1222 | <a href="#visualization" class="md-nav__link"> |
1214 | 1223 | <span class="md-ellipsis"> |
|
1850 | 1859 | <nav class="md-nav" aria-label="Research View (View-1000)"> |
1851 | 1860 | <ul class="md-nav__list"> |
1852 | 1861 |
|
| 1862 | + <li class="md-nav__item"> |
| 1863 | + <a href="#repeatability" class="md-nav__link"> |
| 1864 | + <span class="md-ellipsis"> |
| 1865 | + Repeatability |
| 1866 | + </span> |
| 1867 | + </a> |
| 1868 | + |
| 1869 | +</li> |
| 1870 | + |
1853 | 1871 | <li class="md-nav__item"> |
1854 | 1872 | <a href="#visualization" class="md-nav__link"> |
1855 | 1873 | <span class="md-ellipsis"> |
@@ -1954,10 +1972,24 @@ <h2 id="example-using-cwe-798-use-of-hard-coded-credential">Example using <a hre |
1954 | 1972 | </ol> |
1955 | 1973 | <h2 id="research-view-view-1000_2">Research View (<a href="https://cwe.mitre.org/data/definitions/1000.html">View-1000</a>)<a class="headerlink" href="#research-view-view-1000_2" title="Permanent link">¶</a></h2> |
1956 | 1974 | <p>The Research Concepts view (<abbr title="CWE Common Weakness Enumeration">CWE</abbr>-1000) organizes all weakness CWEs by the method through which an exploitation can occur.</p> |
1957 | | -<p>Research View (<a href="https://cwe.mitre.org/data/definitions/1000.html">View-1000</a>) contains all CWEs and uses a deep hierarchical organization, with more levels of abstraction than other classification schemes.</p> |
| 1975 | +<p>Research View (<a href="https://cwe.mitre.org/data/definitions/1000.html">View-1000</a>) contains all CWEs and uses a deep hierarchical organization, with <strong>more levels of abstraction than other classification schemes.</strong></p> |
1958 | 1976 | <ul> |
1959 | 1977 | <li>While Software Assurance Trends View (<a href="https://cwe.mitre.org/data/definitions/1400.html">View-1400</a>) contains all CWEs, it is only 2 levels deep.</li> |
1960 | 1978 | </ul> |
| 1979 | +<p>The Research view was built to maximize mutual exclusivity, repeatability and clarity — it’s the canonical, theory-driven taxonomy.</p> |
| 1980 | +<div class="admonition quote"> |
| 1981 | +<p class="admonition-title">Quote</p> |
| 1982 | +<p>The Research view is mainly organized according to abstractions of software behaviors and the resources that are manipulated by those behaviors, which aligns with MITRE's research into vulnerability theory. In addition to classification, the Research view explicitly models the inter-dependencies between weaknesses, which have not been a formal part of past classification efforts. The main examples are chains and composites.</p> |
| 1983 | +<p>The view uses multiple deep hierarchies as its organization structure, with more levels of abstraction than other classification schemes. </p> |
| 1984 | +<p><a href="https://cwe.mitre.org/documents/views/view-evolution.html">https://cwe.mitre.org/documents/views/view-evolution.html</a></p> |
| 1985 | +</div> |
| 1986 | +<h3 id="repeatability">Repeatability<a class="headerlink" href="#repeatability" title="Permanent link">¶</a></h3> |
| 1987 | +<div class="admonition quote"> |
| 1988 | +<p class="admonition-title">Quote</p> |
| 1989 | +<p>the Research view seeks to achieve repeatability, although strong technical knowledge and an understanding of chains is required. Repeatability has been informally verified in many situations in which two separate <abbr title="CWE Common Weakness Enumeration">CWE</abbr> team members classified issues the same way. However, there are limits - ambiguous classification can still happen because of perspective issues or incomplete parts of the hierarchy.</p> |
| 1990 | +<p>In the case of the Development view, it is hoped that the large number of navigation categories will make it easier for people to reach the desired weakness ID. However, with so many categories, there is a risk of incomplete or incorrect mappings if one user follows one path of the tree, and another mapper follows a different path.</p> |
| 1991 | +<p><a href="https://cwe.mitre.org/documents/views/view-comparison.html#Repeatable">https://cwe.mitre.org/documents/views/view-comparison.html#Repeatable</a></p> |
| 1992 | +</div> |
1961 | 1993 | <h3 id="visualization">Visualization<a class="headerlink" href="#visualization" title="Permanent link">¶</a></h3> |
1962 | 1994 | <p>MITRE <abbr title="CWE Common Weakness Enumeration">CWE</abbr> provides visualizations on <a href="https://cwe.mitre.org/data/pdfs.html">https://cwe.mitre.org/data/pdfs.html</a>.</p> |
1963 | 1995 | <ul> |
|
0 commit comments