auto_abuse_asvs_poc.ipynb

{
  "cells": [
    {
      "cell_type": "code",
      "execution_count": 107,
      "metadata": {
        "id": "AxhriL8aVHJn"
      },
      "outputs": [],
      "source": [
        "!pip -q install clean-text"
      ]
    },
    {
      "cell_type": "code",
      "execution_count": 110,
      "metadata": {
        "id": "ttp-X3WQQlCp"
      },
      "outputs": [],
      "source": [
        "from IPython.display import display, HTML\n",
        "\n",
        "from cleantext import clean\n",
        "import pandas as pd\n",
        "import requests \n",
        "import spacy\n",
        "import tqdm"
      ]
    },
    {
      "cell_type": "code",
      "execution_count": 111,
      "metadata": {
        "id": "UmyTV5G8VF4P"
      },
      "outputs": [],
      "source": [
        "nlp = spacy.load('en_core_web_sm')"
      ]
    },
    {
      "cell_type": "code",
      "execution_count": 112,
      "metadata": {
        "colab": {
          "base_uri": "https://localhost:8080/"
        },
        "id": "tR34NkoMN2sI",
        "outputId": "1c927bb8-ccd2-4c52-a518-35b77c3858fd"
      },
      "outputs": [
        {
          "name": "stdout",
          "output_type": "stream",
          "text": [
            "4.0.3\n"
          ]
        }
      ],
      "source": [
        "asvs_json = requests.get('https://github.com/OWASP/ASVS/releases/download/v4.0.3_release/OWASP.Application.Security.Verification.Standard.4.0.3-en.json').json()\n",
        "\n",
        "print(asvs_json['Version'])"
      ]
    },
    {
      "cell_type": "code",
      "execution_count": 114,
      "metadata": {
        "colab": {
          "base_uri": "https://localhost:8080/"
        },
        "id": "gQRlWPkpQtuf",
        "outputId": "dce48abf-1ac9-43a1-d8d5-bc1d6f7db75e"
      },
      "outputs": [
        {
          "name": "stderr",
          "output_type": "stream",
          "text": [
            "100%|██████████| 14/14 [00:03<00:00,  3.80it/s]"
          ]
        },
        {
          "name": "stdout",
          "output_type": "stream",
          "text": [
            "\n",
            "\n",
            "Sample:\n",
            "{'Shortcode': 'V1.1.1', 'Ordinal': 1, 'Description': 'Verify the use of a secure software development lifecycle that addresses security in all stages of development. ([C1](https://owasp.org/www-project-proactive-controls/#div-numbering))', 'L1': {'Required': False, 'Requirement': ''}, 'L2': {'Required': True, 'Requirement': ''}, 'L3': {'Required': True, 'Requirement': ''}, 'CWE': [], 'NIST': [], 'nlp': Verify the use of a secure software development lifecycle that addresses security in all stages of development. ([C1](https://owasp.org/www-project-proactive-controls/#div-numbering)), 'category': 'Secure Software Development Lifecycle'}\n"
          ]
        },
        {
          "name": "stderr",
          "output_type": "stream",
          "text": [
            "\n"
          ]
        }
      ],
      "source": [
        "asvs_req_nlp = []\n",
        "\n",
        "sections = asvs_json['Requirements']\n",
        "\n",
        "for section in tqdm.tqdm(sections):\n",
        "    for items in section['Items']:\n",
        "        for req in items['Items']:\n",
        "            description = clean(req['Description'], lower=False)\n",
        "\n",
        "            if 'DELETED' not in description:\n",
        "                req['nlp'] = nlp(description)\n",
        "                req['category'] = items['Name']\n",
        "                asvs_req_nlp.append(req)\n",
        "\n",
        "print('\\n\\nSample:')\n",
        "print(asvs_req_nlp[0])"
      ]
    },
    {
      "cell_type": "code",
      "execution_count": 77,
      "metadata": {
        "id": "DgSs8QxkJ9Oa"
      },
      "outputs": [],
      "source": [
        "# https://attack.mitre.org/tactics/enterprise/\n",
        "\n",
        "abuse_scenarios = [\n",
        "    # Reconnaissance - T1595\n",
        "    \"Adversaries may execute active reconnaissance scans to gather information that can be used during targeting. Active scans are those where the adversary probes victim infrastructure via network traffic, as opposed to other forms of reconnaissance that do not involve direct interaction.\",\n",
        "\n",
        "    # Resource Development - T1588\n",
        "    \"Adversaries may buy and/or steal capabilities that can be used during targeting. Rather than developing their own capabilities in-house, adversaries may purchase, freely download, or steal them. Activities may include the acquisition of malware, software (including licenses), exploits, certificates, and information relating to vulnerabilities. Adversaries may obtain capabilities to support their operations throughout numerous phases of the adversary lifecycle.\",\n",
        "\n",
        "    # Initial Access - T1199\n",
        "    \"Adversaries may breach or otherwise leverage organizations who have access to intended victims. Access through trusted third party relationship exploits an existing connection that may not be protected or receives less scrutiny than standard mechanisms of gaining access to a network.\",\n",
        "\n",
        "    # Execution - T1559\n",
        "    \"Adversaries may abuse inter-process communication (IPC) mechanisms for local code or command execution. IPC is typically used by processes to share data, communicate with each other, or synchronize execution. IPC is also commonly used to avoid situations such as deadlocks, which occurs when processes are stuck in a cyclic waiting pattern.\",\n",
        "\n",
        "    # Persistence - T1098\n",
        "    \"Adversaries may manipulate accounts to maintain access to victim systems. Account manipulation may consist of any action that preserves adversary access to a compromised account, such as modifying credentials or permission groups. These actions could also include account activity designed to subvert security policies, such as performing iterative password updates to bypass password duration policies and preserve the life of compromised credentials.\",\n",
        "\n",
        "    # Privilege Escalation - T1134\n",
        "    \"Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.\",\n",
        "\n",
        "    # Defense Evasion - T1006\n",
        "    \"Adversaries may directly access a volume to bypass file access controls and file system monitoring. Windows allows programs to have direct access to logical volumes. Programs with direct access may read and write files directly from the drive by analyzing file system data structures. This technique bypasses Windows file access controls as well as file system monitoring tools.\",\n",
        "\n",
        "    # Credential Access - T1110\n",
        "    \"Adversaries may use brute force techniques to gain access to accounts when passwords are unknown or when password hashes are obtained. Without knowledge of the password for an account or set of accounts, an adversary may systematically guess the password using a repetitive or iterative mechanism. Brute forcing passwords can take place via interaction with a service that will check the validity of those credentials or offline against previously acquired credential data, such as password hashes.\",\n",
        "\n",
        "    # Discovery - T1087\n",
        "    \"Adversaries may attempt to get a listing of accounts on a system or within an environment. This information can help adversaries determine which accounts exist to aid in follow-on behavior.\",\n",
        "\n",
        "    # Lateral Movement - T1534\n",
        "    \"Adversaries may use internal spearphishing to gain access to additional information or exploit other users within the same organization after they already have access to accounts or systems within the environment. Internal spearphishing is multi-staged campaign where an email account is owned either by controlling the user's device with previously installed malware or by compromising the account credentials of the user. Adversaries attempt to take advantage of a trusted internal account to increase the likelihood of tricking the target into falling for the phish attempt.\",\n",
        "\n",
        "    # Collection - T1005\n",
        "    \"Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.\",\n",
        "\n",
        "    # Command and Control - T1104\n",
        "    \"Adversaries may create multiple stages for command and control that are employed under different conditions or for certain functions. Use of multiple stages may obfuscate the command and control channel to make detection more difficult.\",\n",
        "    \n",
        "    # Exfiltration - T1030\n",
        "    \"An adversary may exfiltrate data in fixed size chunks instead of whole files or limit packet sizes below certain thresholds. This approach may be used to avoid triggering network data transfer threshold alerts.\",\n",
        "\n",
        "    # Impact - T1499\n",
        "    \"Adversaries may perform Endpoint Denial of Service (DoS) attacks to degrade or block the availability of services to users. Endpoint DoS can be performed by exhausting the system resources those services are hosted on or exploiting the system to cause a persistent crash condition. Example services include websites, email services, DNS, and web-based applications. Adversaries have been observed conducting DoS attacks for political purposes and to support other malicious activities, including distraction, hacktivism, and extortion.\",\n",
        "]"
      ]
    },
    {
      "cell_type": "code",
      "execution_count": 122,
      "metadata": {
        "colab": {
          "base_uri": "https://localhost:8080/",
          "height": 1000
        },
        "id": "UeB4IIRmSnDB",
        "outputId": "99b85914-d1be-49e7-f5f4-a4cb1dc869df"
      },
      "outputs": [
        {
          "name": "stdout",
          "output_type": "stream",
          "text": [
            "\n",
            "#1: Adversaries may execute active reconnaissance scans to gather information that can be used during targeting. Active scans are those where the adversary probes victim infrastructure via network traffic, as opposed to other forms of reconnaissance that do not involve direct interaction.\n"
          ]
        },
        {
          "data": {
            "text/html": [
              "<table border=\"1\" class=\"dataframe\">\n",
              "  <thead>\n",
              "    <tr style=\"text-align: right;\">\n",
              "      <th></th>\n",
              "      <th>nlp_similarity</th>\n",
              "      <th>category</th>\n",
              "      <th>Shortcode</th>\n",
              "      <th>Description</th>\n",
              "    </tr>\n",
              "  </thead>\n",
              "  <tbody>\n",
              "    <tr>\n",
              "      <th>0</th>\n",
              "      <td>0.797182</td>\n",
              "      <td>Log Processing</td>\n",
              "      <td>V7.2.1</td>\n",
              "      <td>Verify that all authentication decisions are logged, without storing sensitive session tokens or passwords. This should include requests with relevant metadata needed for security investigations.</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>1</th>\n",
              "      <td>0.774155</td>\n",
              "      <td>Malicious Software Architecture</td>\n",
              "      <td>V1.10.1</td>\n",
              "      <td>Verify that a source code control system is in use, with procedures to ensure that check-ins are accompanied by issues or change tickets. The source code control system should have access control and identifiable users to allow traceability of any changes.</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>2</th>\n",
              "      <td>0.764322</td>\n",
              "      <td>Generic Web Service Security</td>\n",
              "      <td>V13.1.1</td>\n",
              "      <td>Verify that all application components use the same encodings and parsers to avoid parsing attacks that exploit different URI or file parsing behavior that could be used in SSRF and RFI attacks.</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>3</th>\n",
              "      <td>0.756764</td>\n",
              "      <td>Log Processing</td>\n",
              "      <td>V7.2.2</td>\n",
              "      <td>Verify that all access control decisions can be logged and all failed decisions are logged. This should include requests with relevant metadata needed for security investigations.</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>4</th>\n",
              "      <td>0.733425</td>\n",
              "      <td>Build and Deploy</td>\n",
              "      <td>V14.1.5</td>\n",
              "      <td>Verify that authorized administrators can verify the integrity of all security-relevant configurations to detect tampering.</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>5</th>\n",
              "      <td>0.720403</td>\n",
              "      <td>Authentication Architecture</td>\n",
              "      <td>V1.2.3</td>\n",
              "      <td>Verify that the application uses a single vetted authentication mechanism that is known to be secure, can be extended to include strong authentication, and has sufficient logging and monitoring to detect account abuse or breaches.</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>6</th>\n",
              "      <td>0.713918</td>\n",
              "      <td>File Storage</td>\n",
              "      <td>V12.4.2</td>\n",
              "      <td>Verify that files obtained from untrusted sources are scanned by antivirus scanners to prevent upload and serving of known malicious content.</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>7</th>\n",
              "      <td>0.711574</td>\n",
              "      <td>Service Authentication</td>\n",
              "      <td>V2.10.3</td>\n",
              "      <td>Verify that passwords are stored with sufficient protection to prevent offline recovery attacks, including local system access.</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>8</th>\n",
              "      <td>0.708305</td>\n",
              "      <td>File Upload</td>\n",
              "      <td>V12.1.1</td>\n",
              "      <td>Verify that the application will not accept large files that could fill up storage or cause a denial of service.</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>9</th>\n",
              "      <td>0.704489</td>\n",
              "      <td>File Download</td>\n",
              "      <td>V12.5.2</td>\n",
              "      <td>Verify that direct requests to uploaded files will never be executed as HTML/JavaScript content.</td>\n",
              "    </tr>\n",
              "  </tbody>\n",
              "</table>"
            ],
            "text/plain": [
              "<IPython.core.display.HTML object>"
            ]
          },
          "metadata": {},
          "output_type": "display_data"
        },
        {
          "name": "stdout",
          "output_type": "stream",
          "text": [
            "\n",
            "#2: Adversaries may buy and/or steal capabilities that can be used during targeting. Rather than developing their own capabilities in-house, adversaries may purchase, freely download, or steal them. Activities may include the acquisition of malware, software (including licenses), exploits, certificates, and information relating to vulnerabilities. Adversaries may obtain capabilities to support their operations throughout numerous phases of the adversary lifecycle.\n"
          ]
        },
        {
          "data": {
            "text/html": [
              "<table border=\"1\" class=\"dataframe\">\n",
              "  <thead>\n",
              "    <tr style=\"text-align: right;\">\n",
              "      <th></th>\n",
              "      <th>nlp_similarity</th>\n",
              "      <th>category</th>\n",
              "      <th>Shortcode</th>\n",
              "      <th>Description</th>\n",
              "    </tr>\n",
              "  </thead>\n",
              "  <tbody>\n",
              "    <tr>\n",
              "      <th>0</th>\n",
              "      <td>0.741294</td>\n",
              "      <td>Log Processing</td>\n",
              "      <td>V7.2.1</td>\n",
              "      <td>Verify that all authentication decisions are logged, without storing sensitive session tokens or passwords. This should include requests with relevant metadata needed for security investigations.</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>1</th>\n",
              "      <td>0.725251</td>\n",
              "      <td>Application Integrity</td>\n",
              "      <td>V10.3.3</td>\n",
              "      <td>Verify that the application has protection from subdomain takeovers if the application relies upon DNS entries or DNS subdomains, such as expired domain names, out of date DNS pointers or CNAMEs, expired projects at public source code repos, or transient cloud APIs, serverless functions, or storage buckets (*autogen-bucket-id*.cloud.example.com) or similar. Protections can include ensuring that DNS names used by applications are regularly checked for expiry or change.</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>2</th>\n",
              "      <td>0.715681</td>\n",
              "      <td>Application Integrity</td>\n",
              "      <td>V10.3.2</td>\n",
              "      <td>Verify that the application employs integrity protections, such as code signing or subresource integrity. The application must not load or execute code from untrusted sources, such as loading includes, modules, plugins, code, or libraries from untrusted sources or the Internet.</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>3</th>\n",
              "      <td>0.710137</td>\n",
              "      <td>Memory, String, and Unmanaged Code</td>\n",
              "      <td>V5.4.3</td>\n",
              "      <td>Verify that sign, range, and input validation techniques are used to prevent integer overflows.</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>4</th>\n",
              "      <td>0.707014</td>\n",
              "      <td>General Authenticator Security</td>\n",
              "      <td>V2.2.1</td>\n",
              "      <td>Verify that anti-automation controls are effective at mitigating breached credential testing, brute force, and account lockout attacks. Such controls include blocking the most common breached passwords, soft lockouts, rate limiting, CAPTCHA, ever increasing delays between attempts, IP address restrictions, or risk-based restrictions such as location, first login on a device, recent attempts to unlock the account, or similar. Verify that no more than 100 failed attempts per hour is possible on a single account.</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>5</th>\n",
              "      <td>0.706621</td>\n",
              "      <td>Service Authentication</td>\n",
              "      <td>V2.10.4</td>\n",
              "      <td>Verify passwords, integrations with databases and third-party systems, seeds and internal secrets, and API keys are managed securely and not included in the source code or stored within source code repositories. Such storage SHOULD resist offline attacks. The use of a secure software key store (L1), hardware TPM, or an HSM (L3) is recommended for password storage.</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>6</th>\n",
              "      <td>0.685239</td>\n",
              "      <td>Business Logic Security</td>\n",
              "      <td>V11.1.5</td>\n",
              "      <td>Verify the application has business logic limits or validation to protect against likely business risks or threats, identified using threat modeling or similar methodologies.</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>7</th>\n",
              "      <td>0.684569</td>\n",
              "      <td>Secure Software Development Lifecycle</td>\n",
              "      <td>V1.1.2</td>\n",
              "      <td>Verify the use of threat modeling for every design change or sprint planning to identify threats, plan for countermeasures, facilitate appropriate risk responses, and guide security testing.</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>8</th>\n",
              "      <td>0.684290</td>\n",
              "      <td>GraphQL</td>\n",
              "      <td>V13.4.1</td>\n",
              "      <td>Verify that a query allow list or a combination of depth limiting and amount limiting is used to prevent GraphQL or data layer expression Denial of Service (DoS) as a result of expensive, nested queries. For more advanced scenarios, query cost analysis should be used.</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>9</th>\n",
              "      <td>0.682003</td>\n",
              "      <td>General Data Protection</td>\n",
              "      <td>V8.1.3</td>\n",
              "      <td>Verify the application minimizes the number of parameters in a request, such as hidden fields, Ajax variables, cookies and header values.</td>\n",
              "    </tr>\n",
              "  </tbody>\n",
              "</table>"
            ],
            "text/plain": [
              "<IPython.core.display.HTML object>"
            ]
          },
          "metadata": {},
          "output_type": "display_data"
        },
        {
          "name": "stdout",
          "output_type": "stream",
          "text": [
            "\n",
            "#3: Adversaries may breach or otherwise leverage organizations who have access to intended victims. Access through trusted third party relationship exploits an existing connection that may not be protected or receives less scrutiny than standard mechanisms of gaining access to a network.\n"
          ]
        },
        {
          "data": {
            "text/html": [
              "<table border=\"1\" class=\"dataframe\">\n",
              "  <thead>\n",
              "    <tr style=\"text-align: right;\">\n",
              "      <th></th>\n",
              "      <th>nlp_similarity</th>\n",
              "      <th>category</th>\n",
              "      <th>Shortcode</th>\n",
              "      <th>Description</th>\n",
              "    </tr>\n",
              "  </thead>\n",
              "  <tbody>\n",
              "    <tr>\n",
              "      <th>0</th>\n",
              "      <td>0.775049</td>\n",
              "      <td>Generic Web Service Security</td>\n",
              "      <td>V13.1.1</td>\n",
              "      <td>Verify that all application components use the same encodings and parsers to avoid parsing attacks that exploit different URI or file parsing behavior that could be used in SSRF and RFI attacks.</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>1</th>\n",
              "      <td>0.758930</td>\n",
              "      <td>Malicious Software Architecture</td>\n",
              "      <td>V1.10.1</td>\n",
              "      <td>Verify that a source code control system is in use, with procedures to ensure that check-ins are accompanied by issues or change tickets. The source code control system should have access control and identifiable users to allow traceability of any changes.</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>2</th>\n",
              "      <td>0.747973</td>\n",
              "      <td>Log Processing</td>\n",
              "      <td>V7.2.1</td>\n",
              "      <td>Verify that all authentication decisions are logged, without storing sensitive session tokens or passwords. This should include requests with relevant metadata needed for security investigations.</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>3</th>\n",
              "      <td>0.727034</td>\n",
              "      <td>File Storage</td>\n",
              "      <td>V12.4.2</td>\n",
              "      <td>Verify that files obtained from untrusted sources are scanned by antivirus scanners to prevent upload and serving of known malicious content.</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>4</th>\n",
              "      <td>0.725798</td>\n",
              "      <td>Unintended Security Disclosure</td>\n",
              "      <td>V14.3.3</td>\n",
              "      <td>Verify that the HTTP headers or any part of the HTTP response do not expose detailed version information of system components.</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>5</th>\n",
              "      <td>0.720998</td>\n",
              "      <td>Application Integrity</td>\n",
              "      <td>V10.3.1</td>\n",
              "      <td>Verify that if the application has a client or server auto-update feature, updates should be obtained over secure channels and digitally signed. The update code must validate the digital signature of the update before installing or executing the update.</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>6</th>\n",
              "      <td>0.717221</td>\n",
              "      <td>GraphQL</td>\n",
              "      <td>V13.4.1</td>\n",
              "      <td>Verify that a query allow list or a combination of depth limiting and amount limiting is used to prevent GraphQL or data layer expression Denial of Service (DoS) as a result of expensive, nested queries. For more advanced scenarios, query cost analysis should be used.</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>7</th>\n",
              "      <td>0.716798</td>\n",
              "      <td>Sensitive Private Data</td>\n",
              "      <td>V8.3.1</td>\n",
              "      <td>Verify that sensitive data is sent to the server in the HTTP message body or headers, and that query string parameters from any HTTP verb do not contain sensitive data.</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>8</th>\n",
              "      <td>0.709394</td>\n",
              "      <td>Business Logic Security</td>\n",
              "      <td>V11.1.1</td>\n",
              "      <td>Verify that the application will only process business logic flows for the same user in sequential step order and without skipping steps.</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>9</th>\n",
              "      <td>0.709251</td>\n",
              "      <td>Sanitization and Sandboxing</td>\n",
              "      <td>V5.2.2</td>\n",
              "      <td>Verify that unstructured data is sanitized to enforce safety measures such as allowed characters and length.</td>\n",
              "    </tr>\n",
              "  </tbody>\n",
              "</table>"
            ],
            "text/plain": [
              "<IPython.core.display.HTML object>"
            ]
          },
          "metadata": {},
          "output_type": "display_data"
        },
        {
          "name": "stdout",
          "output_type": "stream",
          "text": [
            "\n",
            "#4: Adversaries may abuse inter-process communication (IPC) mechanisms for local code or command execution. IPC is typically used by processes to share data, communicate with each other, or synchronize execution. IPC is also commonly used to avoid situations such as deadlocks, which occurs when processes are stuck in a cyclic waiting pattern.\n"
          ]
        },
        {
          "data": {
            "text/html": [
              "<table border=\"1\" class=\"dataframe\">\n",
              "  <thead>\n",
              "    <tr style=\"text-align: right;\">\n",
              "      <th></th>\n",
              "      <th>nlp_similarity</th>\n",
              "      <th>category</th>\n",
              "      <th>Shortcode</th>\n",
              "      <th>Description</th>\n",
              "    </tr>\n",
              "  </thead>\n",
              "  <tbody>\n",
              "    <tr>\n",
              "      <th>0</th>\n",
              "      <td>0.785494</td>\n",
              "      <td>Service Authentication</td>\n",
              "      <td>V2.10.1</td>\n",
              "      <td>Verify that intra-service secrets do not rely on unchanging credentials such as passwords, API keys or shared accounts with privileged access.</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>1</th>\n",
              "      <td>0.783321</td>\n",
              "      <td>Log Processing</td>\n",
              "      <td>V7.2.1</td>\n",
              "      <td>Verify that all authentication decisions are logged, without storing sensitive session tokens or passwords. This should include requests with relevant metadata needed for security investigations.</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>2</th>\n",
              "      <td>0.783042</td>\n",
              "      <td>Business Logic Security</td>\n",
              "      <td>V11.1.4</td>\n",
              "      <td>Verify that the application has anti-automation controls to protect against excessive calls such as mass data exfiltration, business logic requests, file uploads or denial of service attacks.</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>3</th>\n",
              "      <td>0.767927</td>\n",
              "      <td>Application Integrity</td>\n",
              "      <td>V10.3.3</td>\n",
              "      <td>Verify that the application has protection from subdomain takeovers if the application relies upon DNS entries or DNS subdomains, such as expired domain names, out of date DNS pointers or CNAMEs, expired projects at public source code repos, or transient cloud APIs, serverless functions, or storage buckets (*autogen-bucket-id*.cloud.example.com) or similar. Protections can include ensuring that DNS names used by applications are regularly checked for expiry or change.</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>4</th>\n",
              "      <td>0.767708</td>\n",
              "      <td>General Authenticator Security</td>\n",
              "      <td>V2.2.1</td>\n",
              "      <td>Verify that anti-automation controls are effective at mitigating breached credential testing, brute force, and account lockout attacks. Such controls include blocking the most common breached passwords, soft lockouts, rate limiting, CAPTCHA, ever increasing delays between attempts, IP address restrictions, or risk-based restrictions such as location, first login on a device, recent attempts to unlock the account, or similar. Verify that no more than 100 failed attempts per hour is possible on a single account.</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>5</th>\n",
              "      <td>0.757278</td>\n",
              "      <td>One Time Verifier</td>\n",
              "      <td>V2.8.6</td>\n",
              "      <td>Verify physical single-factor OTP generator can be revoked in case of theft or other loss. Ensure that revocation is immediately effective across logged in sessions, regardless of location.</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>6</th>\n",
              "      <td>0.747427</td>\n",
              "      <td>File Storage</td>\n",
              "      <td>V12.4.2</td>\n",
              "      <td>Verify that files obtained from untrusted sources are scanned by antivirus scanners to prevent upload and serving of known malicious content.</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>7</th>\n",
              "      <td>0.745349</td>\n",
              "      <td>Input and Output Architecture</td>\n",
              "      <td>V1.5.2</td>\n",
              "      <td>Verify that serialization is not used when communicating with untrusted clients. If this is not possible, ensure that adequate integrity controls (and possibly encryption if sensitive data is sent) are enforced to prevent deserialization attacks including object injection.</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>8</th>\n",
              "      <td>0.741244</td>\n",
              "      <td>General Authenticator Security</td>\n",
              "      <td>V2.2.2</td>\n",
              "      <td>Verify that the use of weak authenticators (such as SMS and email) is limited to secondary verification and transaction approval and not as a replacement for more secure authentication methods. Verify that stronger methods are offered before weak methods, users are aware of the risks, or that proper measures are in place to limit the risks of account compromise.</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>9</th>\n",
              "      <td>0.734195</td>\n",
              "      <td>Service Authentication</td>\n",
              "      <td>V2.10.3</td>\n",
              "      <td>Verify that passwords are stored with sufficient protection to prevent offline recovery attacks, including local system access.</td>\n",
              "    </tr>\n",
              "  </tbody>\n",
              "</table>"
            ],
            "text/plain": [
              "<IPython.core.display.HTML object>"
            ]
          },
          "metadata": {},
          "output_type": "display_data"
        },
        {
          "name": "stdout",
          "output_type": "stream",
          "text": [
            "\n",
            "#5: Adversaries may manipulate accounts to maintain access to victim systems. Account manipulation may consist of any action that preserves adversary access to a compromised account, such as modifying credentials or permission groups. These actions could also include account activity designed to subvert security policies, such as performing iterative password updates to bypass password duration policies and preserve the life of compromised credentials.\n"
          ]
        },
        {
          "data": {
            "text/html": [
              "<table border=\"1\" class=\"dataframe\">\n",
              "  <thead>\n",
              "    <tr style=\"text-align: right;\">\n",
              "      <th></th>\n",
              "      <th>nlp_similarity</th>\n",
              "      <th>category</th>\n",
              "      <th>Shortcode</th>\n",
              "      <th>Description</th>\n",
              "    </tr>\n",
              "  </thead>\n",
              "  <tbody>\n",
              "    <tr>\n",
              "      <th>0</th>\n",
              "      <td>0.842403</td>\n",
              "      <td>Log Processing</td>\n",
              "      <td>V7.2.1</td>\n",
              "      <td>Verify that all authentication decisions are logged, without storing sensitive session tokens or passwords. This should include requests with relevant metadata needed for security investigations.</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>1</th>\n",
              "      <td>0.835857</td>\n",
              "      <td>Malicious Software Architecture</td>\n",
              "      <td>V1.10.1</td>\n",
              "      <td>Verify that a source code control system is in use, with procedures to ensure that check-ins are accompanied by issues or change tickets. The source code control system should have access control and identifiable users to allow traceability of any changes.</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>2</th>\n",
              "      <td>0.810625</td>\n",
              "      <td>Generic Web Service Security</td>\n",
              "      <td>V13.1.1</td>\n",
              "      <td>Verify that all application components use the same encodings and parsers to avoid parsing attacks that exploit different URI or file parsing behavior that could be used in SSRF and RFI attacks.</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>3</th>\n",
              "      <td>0.790888</td>\n",
              "      <td>General Data Protection</td>\n",
              "      <td>V8.1.1</td>\n",
              "      <td>Verify the application protects sensitive data from being cached in server components such as load balancers and application caches.</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>4</th>\n",
              "      <td>0.767873</td>\n",
              "      <td>Business Logic Security</td>\n",
              "      <td>V11.1.5</td>\n",
              "      <td>Verify the application has business logic limits or validation to protect against likely business risks or threats, identified using threat modeling or similar methodologies.</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>5</th>\n",
              "      <td>0.766650</td>\n",
              "      <td>Sanitization and Sandboxing</td>\n",
              "      <td>V5.2.2</td>\n",
              "      <td>Verify that unstructured data is sanitized to enforce safety measures such as allowed characters and length.</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>6</th>\n",
              "      <td>0.762875</td>\n",
              "      <td>Secure Software Development Lifecycle</td>\n",
              "      <td>V1.1.2</td>\n",
              "      <td>Verify the use of threat modeling for every design change or sprint planning to identify threats, plan for countermeasures, facilitate appropriate risk responses, and guide security testing.</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>7</th>\n",
              "      <td>0.761014</td>\n",
              "      <td>Token-based Session Management</td>\n",
              "      <td>V3.5.1</td>\n",
              "      <td>Verify the application allows users to revoke OAuth tokens that form trust relationships with linked applications.</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>8</th>\n",
              "      <td>0.760668</td>\n",
              "      <td>Business Logic Security</td>\n",
              "      <td>V11.1.4</td>\n",
              "      <td>Verify that the application has anti-automation controls to protect against excessive calls such as mass data exfiltration, business logic requests, file uploads or denial of service attacks.</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>9</th>\n",
              "      <td>0.756158</td>\n",
              "      <td>Service Authentication</td>\n",
              "      <td>V2.10.3</td>\n",
              "      <td>Verify that passwords are stored with sufficient protection to prevent offline recovery attacks, including local system access.</td>\n",
              "    </tr>\n",
              "  </tbody>\n",
              "</table>"
            ],
            "text/plain": [
              "<IPython.core.display.HTML object>"
            ]
          },
          "metadata": {},
          "output_type": "display_data"
        },
        {
          "name": "stdout",
          "output_type": "stream",
          "text": [
            "\n",
            "#6: Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.\n"
          ]
        },
        {
          "data": {
            "text/html": [
              "<table border=\"1\" class=\"dataframe\">\n",
              "  <thead>\n",
              "    <tr style=\"text-align: right;\">\n",
              "      <th></th>\n",
              "      <th>nlp_similarity</th>\n",
              "      <th>category</th>\n",
              "      <th>Shortcode</th>\n",
              "      <th>Description</th>\n",
              "    </tr>\n",
              "  </thead>\n",
              "  <tbody>\n",
              "    <tr>\n",
              "      <th>0</th>\n",
              "      <td>0.807031</td>\n",
              "      <td>General Authenticator Security</td>\n",
              "      <td>V2.2.7</td>\n",
              "      <td>Verify intent to authenticate by requiring the entry of an OTP token or user-initiated action such as a button press on a FIDO hardware key.</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>1</th>\n",
              "      <td>0.770819</td>\n",
              "      <td>SOAP Web Service</td>\n",
              "      <td>V13.3.1</td>\n",
              "      <td>Verify that XSD schema validation takes place to ensure a properly formed XML document, followed by validation of each input field before any processing of that data takes place.</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>2</th>\n",
              "      <td>0.757531</td>\n",
              "      <td>Application Integrity</td>\n",
              "      <td>V10.3.1</td>\n",
              "      <td>Verify that if the application has a client or server auto-update feature, updates should be obtained over secure channels and digitally signed. The update code must validate the digital signature of the update before installing or executing the update.</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>3</th>\n",
              "      <td>0.751899</td>\n",
              "      <td>Malicious Software Architecture</td>\n",
              "      <td>V1.10.1</td>\n",
              "      <td>Verify that a source code control system is in use, with procedures to ensure that check-ins are accompanied by issues or change tickets. The source code control system should have access control and identifiable users to allow traceability of any changes.</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>4</th>\n",
              "      <td>0.750950</td>\n",
              "      <td>Unintended Security Disclosure</td>\n",
              "      <td>V14.3.3</td>\n",
              "      <td>Verify that the HTTP headers or any part of the HTTP response do not expose detailed version information of system components.</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>5</th>\n",
              "      <td>0.749123</td>\n",
              "      <td>Sanitization and Sandboxing</td>\n",
              "      <td>V5.2.3</td>\n",
              "      <td>Verify that the application sanitizes user input before passing to mail systems to protect against SMTP or IMAP injection.</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>6</th>\n",
              "      <td>0.736764</td>\n",
              "      <td>HTTP Security Headers</td>\n",
              "      <td>V14.4.6</td>\n",
              "      <td>Verify that a suitable Referrer-Policy header is included to avoid exposing sensitive information in the URL through the Referer header to untrusted parties.</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>7</th>\n",
              "      <td>0.736381</td>\n",
              "      <td>Configuration Architecture</td>\n",
              "      <td>V1.14.4</td>\n",
              "      <td>Verify that the build pipeline contains a build step to automatically build and verify the secure deployment of the application, particularly if the application infrastructure is software defined, such as cloud environment build scripts.</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>8</th>\n",
              "      <td>0.730453</td>\n",
              "      <td>Business Logic Security</td>\n",
              "      <td>V11.1.1</td>\n",
              "      <td>Verify that the application will only process business logic flows for the same user in sequential step order and without skipping steps.</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>9</th>\n",
              "      <td>0.726068</td>\n",
              "      <td>RESTful Web Service</td>\n",
              "      <td>V13.2.6</td>\n",
              "      <td>Verify that the message headers and payload are trustworthy and not modified in transit. Requiring strong encryption for transport (TLS only) may be sufficient in many cases as it provides both confidentiality and integrity protection. Per-message digital signatures can provide additional assurance on top of the transport protections for high-security applications but bring with them additional complexity and risks to weigh against the benefits.</td>\n",
              "    </tr>\n",
              "  </tbody>\n",
              "</table>"
            ],
            "text/plain": [
              "<IPython.core.display.HTML object>"
            ]
          },
          "metadata": {},
          "output_type": "display_data"
        },
        {
          "name": "stdout",
          "output_type": "stream",
          "text": [
            "\n",
            "#7: Adversaries may directly access a volume to bypass file access controls and file system monitoring. Windows allows programs to have direct access to logical volumes. Programs with direct access may read and write files directly from the drive by analyzing file system data structures. This technique bypasses Windows file access controls as well as file system monitoring tools.\n"
          ]
        },
        {
          "data": {
            "text/html": [
              "<table border=\"1\" class=\"dataframe\">\n",
              "  <thead>\n",
              "    <tr style=\"text-align: right;\">\n",
              "      <th></th>\n",
              "      <th>nlp_similarity</th>\n",
              "      <th>category</th>\n",
              "      <th>Shortcode</th>\n",
              "      <th>Description</th>\n",
              "    </tr>\n",
              "  </thead>\n",
              "  <tbody>\n",
              "    <tr>\n",
              "      <th>0</th>\n",
              "      <td>0.825527</td>\n",
              "      <td>Malicious Software Architecture</td>\n",
              "      <td>V1.10.1</td>\n",
              "      <td>Verify that a source code control system is in use, with procedures to ensure that check-ins are accompanied by issues or change tickets. The source code control system should have access control and identifiable users to allow traceability of any changes.</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>1</th>\n",
              "      <td>0.758140</td>\n",
              "      <td>Malicious Code Search</td>\n",
              "      <td>V10.2.4</td>\n",
              "      <td>Verify that the application source code and third party libraries do not contain time bombs by searching for date and time related functions.</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>2</th>\n",
              "      <td>0.757196</td>\n",
              "      <td>Sanitization and Sandboxing</td>\n",
              "      <td>V5.2.3</td>\n",
              "      <td>Verify that the application sanitizes user input before passing to mail systems to protect against SMTP or IMAP injection.</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>3</th>\n",
              "      <td>0.756832</td>\n",
              "      <td>General Data Protection</td>\n",
              "      <td>V8.1.1</td>\n",
              "      <td>Verify the application protects sensitive data from being cached in server components such as load balancers and application caches.</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>4</th>\n",
              "      <td>0.748806</td>\n",
              "      <td>Generic Web Service Security</td>\n",
              "      <td>V13.1.1</td>\n",
              "      <td>Verify that all application components use the same encodings and parsers to avoid parsing attacks that exploit different URI or file parsing behavior that could be used in SSRF and RFI attacks.</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>5</th>\n",
              "      <td>0.741499</td>\n",
              "      <td>RESTful Web Service</td>\n",
              "      <td>V13.2.6</td>\n",
              "      <td>Verify that the message headers and payload are trustworthy and not modified in transit. Requiring strong encryption for transport (TLS only) may be sufficient in many cases as it provides both confidentiality and integrity protection. Per-message digital signatures can provide additional assurance on top of the transport protections for high-security applications but bring with them additional complexity and risks to weigh against the benefits.</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>6</th>\n",
              "      <td>0.740205</td>\n",
              "      <td>Secure Software Development Lifecycle</td>\n",
              "      <td>V1.1.2</td>\n",
              "      <td>Verify the use of threat modeling for every design change or sprint planning to identify threats, plan for countermeasures, facilitate appropriate risk responses, and guide security testing.</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>7</th>\n",
              "      <td>0.729685</td>\n",
              "      <td>Malicious Code Search</td>\n",
              "      <td>V10.2.1</td>\n",
              "      <td>Verify that the application source code and third party libraries do not contain unauthorized phone home or data collection capabilities. Where such functionality exists, obtain the user's permission for it to operate before collecting any data.</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>8</th>\n",
              "      <td>0.720847</td>\n",
              "      <td>Business Logic Security</td>\n",
              "      <td>V11.1.4</td>\n",
              "      <td>Verify that the application has anti-automation controls to protect against excessive calls such as mass data exfiltration, business logic requests, file uploads or denial of service attacks.</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>9</th>\n",
              "      <td>0.716935</td>\n",
              "      <td>Token-based Session Management</td>\n",
              "      <td>V3.5.1</td>\n",
              "      <td>Verify the application allows users to revoke OAuth tokens that form trust relationships with linked applications.</td>\n",
              "    </tr>\n",
              "  </tbody>\n",
              "</table>"
            ],
            "text/plain": [
              "<IPython.core.display.HTML object>"
            ]
          },
          "metadata": {},
          "output_type": "display_data"
        },
        {
          "name": "stdout",
          "output_type": "stream",
          "text": [
            "\n",
            "#8: Adversaries may use brute force techniques to gain access to accounts when passwords are unknown or when password hashes are obtained. Without knowledge of the password for an account or set of accounts, an adversary may systematically guess the password using a repetitive or iterative mechanism. Brute forcing passwords can take place via interaction with a service that will check the validity of those credentials or offline against previously acquired credential data, such as password hashes.\n"
          ]
        },
        {
          "data": {
            "text/html": [
              "<table border=\"1\" class=\"dataframe\">\n",
              "  <thead>\n",
              "    <tr style=\"text-align: right;\">\n",
              "      <th></th>\n",
              "      <th>nlp_similarity</th>\n",
              "      <th>category</th>\n",
              "      <th>Shortcode</th>\n",
              "      <th>Description</th>\n",
              "    </tr>\n",
              "  </thead>\n",
              "  <tbody>\n",
              "    <tr>\n",
              "      <th>0</th>\n",
              "      <td>0.818108</td>\n",
              "      <td>Log Processing</td>\n",
              "      <td>V7.2.1</td>\n",
              "      <td>Verify that all authentication decisions are logged, without storing sensitive session tokens or passwords. This should include requests with relevant metadata needed for security investigations.</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>1</th>\n",
              "      <td>0.816247</td>\n",
              "      <td>Malicious Software Architecture</td>\n",
              "      <td>V1.10.1</td>\n",
              "      <td>Verify that a source code control system is in use, with procedures to ensure that check-ins are accompanied by issues or change tickets. The source code control system should have access control and identifiable users to allow traceability of any changes.</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>2</th>\n",
              "      <td>0.811109</td>\n",
              "      <td>RESTful Web Service</td>\n",
              "      <td>V13.2.6</td>\n",
              "      <td>Verify that the message headers and payload are trustworthy and not modified in transit. Requiring strong encryption for transport (TLS only) may be sufficient in many cases as it provides both confidentiality and integrity protection. Per-message digital signatures can provide additional assurance on top of the transport protections for high-security applications but bring with them additional complexity and risks to weigh against the benefits.</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>3</th>\n",
              "      <td>0.805851</td>\n",
              "      <td>General Authenticator Security</td>\n",
              "      <td>V2.2.2</td>\n",
              "      <td>Verify that the use of weak authenticators (such as SMS and email) is limited to secondary verification and transaction approval and not as a replacement for more secure authentication methods. Verify that stronger methods are offered before weak methods, users are aware of the risks, or that proper measures are in place to limit the risks of account compromise.</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>4</th>\n",
              "      <td>0.792773</td>\n",
              "      <td>Generic Web Service Security</td>\n",
              "      <td>V13.1.1</td>\n",
              "      <td>Verify that all application components use the same encodings and parsers to avoid parsing attacks that exploit different URI or file parsing behavior that could be used in SSRF and RFI attacks.</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>5</th>\n",
              "      <td>0.776009</td>\n",
              "      <td>Sensitive Private Data</td>\n",
              "      <td>V8.3.1</td>\n",
              "      <td>Verify that sensitive data is sent to the server in the HTTP message body or headers, and that query string parameters from any HTTP verb do not contain sensitive data.</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>6</th>\n",
              "      <td>0.774353</td>\n",
              "      <td>RESTful Web Service</td>\n",
              "      <td>V13.2.1</td>\n",
              "      <td>Verify that enabled RESTful HTTP methods are a valid choice for the user or action, such as preventing normal users using DELETE or PUT on protected API or resources.</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>7</th>\n",
              "      <td>0.766404</td>\n",
              "      <td>SOAP Web Service</td>\n",
              "      <td>V13.3.1</td>\n",
              "      <td>Verify that XSD schema validation takes place to ensure a properly formed XML document, followed by validation of each input field before any processing of that data takes place.</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>8</th>\n",
              "      <td>0.764694</td>\n",
              "      <td>Unintended Security Disclosure</td>\n",
              "      <td>V14.3.3</td>\n",
              "      <td>Verify that the HTTP headers or any part of the HTTP response do not expose detailed version information of system components.</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>9</th>\n",
              "      <td>0.764157</td>\n",
              "      <td>Sensitive Private Data</td>\n",
              "      <td>V8.3.3</td>\n",
              "      <td>Verify that users are provided clear language regarding collection and use of supplied personal information and that users have provided opt-in consent for the use of that data before it is used in any way.</td>\n",
              "    </tr>\n",
              "  </tbody>\n",
              "</table>"
            ],
            "text/plain": [
              "<IPython.core.display.HTML object>"
            ]
          },
          "metadata": {},
          "output_type": "display_data"
        },
        {
          "name": "stdout",
          "output_type": "stream",
          "text": [
            "\n",
            "#9: Adversaries may attempt to get a listing of accounts on a system or within an environment. This information can help adversaries determine which accounts exist to aid in follow-on behavior.\n"
          ]
        },
        {
          "data": {
            "text/html": [
              "<table border=\"1\" class=\"dataframe\">\n",
              "  <thead>\n",
              "    <tr style=\"text-align: right;\">\n",
              "      <th></th>\n",
              "      <th>nlp_similarity</th>\n",
              "      <th>category</th>\n",
              "      <th>Shortcode</th>\n",
              "      <th>Description</th>\n",
              "    </tr>\n",
              "  </thead>\n",
              "  <tbody>\n",
              "    <tr>\n",
              "      <th>0</th>\n",
              "      <td>0.801609</td>\n",
              "      <td>File Upload</td>\n",
              "      <td>V12.1.1</td>\n",
              "      <td>Verify that the application will not accept large files that could fill up storage or cause a denial of service.</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>1</th>\n",
              "      <td>0.791692</td>\n",
              "      <td>Malicious Software Architecture</td>\n",
              "      <td>V1.10.1</td>\n",
              "      <td>Verify that a source code control system is in use, with procedures to ensure that check-ins are accompanied by issues or change tickets. The source code control system should have access control and identifiable users to allow traceability of any changes.</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>2</th>\n",
              "      <td>0.735983</td>\n",
              "      <td>Sensitive Private Data</td>\n",
              "      <td>V8.3.2</td>\n",
              "      <td>Verify that users have a method to remove or export their data on demand.</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>3</th>\n",
              "      <td>0.728566</td>\n",
              "      <td>Communications Architecture</td>\n",
              "      <td>V1.9.2</td>\n",
              "      <td>Verify that application components verify the authenticity of each side in a communication link to prevent person-in-the-middle attacks. For example, application components should validate TLS certificates and chains.</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>4</th>\n",
              "      <td>0.724648</td>\n",
              "      <td>RESTful Web Service</td>\n",
              "      <td>V13.2.6</td>\n",
              "      <td>Verify that the message headers and payload are trustworthy and not modified in transit. Requiring strong encryption for transport (TLS only) may be sufficient in many cases as it provides both confidentiality and integrity protection. Per-message digital signatures can provide additional assurance on top of the transport protections for high-security applications but bring with them additional complexity and risks to weigh against the benefits.</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>5</th>\n",
              "      <td>0.722857</td>\n",
              "      <td>Build and Deploy</td>\n",
              "      <td>V14.1.5</td>\n",
              "      <td>Verify that authorized administrators can verify the integrity of all security-relevant configurations to detect tampering.</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>6</th>\n",
              "      <td>0.712498</td>\n",
              "      <td>Application Integrity</td>\n",
              "      <td>V10.3.1</td>\n",
              "      <td>Verify that if the application has a client or server auto-update feature, updates should be obtained over secure channels and digitally signed. The update code must validate the digital signature of the update before installing or executing the update.</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>7</th>\n",
              "      <td>0.703471</td>\n",
              "      <td>Unintended Security Disclosure</td>\n",
              "      <td>V14.3.3</td>\n",
              "      <td>Verify that the HTTP headers or any part of the HTTP response do not expose detailed version information of system components.</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>8</th>\n",
              "      <td>0.690650</td>\n",
              "      <td>Secure Software Development Lifecycle</td>\n",
              "      <td>V1.1.2</td>\n",
              "      <td>Verify the use of threat modeling for every design change or sprint planning to identify threats, plan for countermeasures, facilitate appropriate risk responses, and guide security testing.</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>9</th>\n",
              "      <td>0.677192</td>\n",
              "      <td>Log Processing</td>\n",
              "      <td>V7.2.1</td>\n",
              "      <td>Verify that all authentication decisions are logged, without storing sensitive session tokens or passwords. This should include requests with relevant metadata needed for security investigations.</td>\n",
              "    </tr>\n",
              "  </tbody>\n",
              "</table>"
            ],
            "text/plain": [
              "<IPython.core.display.HTML object>"
            ]
          },
          "metadata": {},
          "output_type": "display_data"
        },
        {
          "name": "stdout",
          "output_type": "stream",
          "text": [
            "\n",
            "#10: Adversaries may use internal spearphishing to gain access to additional information or exploit other users within the same organization after they already have access to accounts or systems within the environment. Internal spearphishing is multi-staged campaign where an email account is owned either by controlling the user's device with previously installed malware or by compromising the account credentials of the user. Adversaries attempt to take advantage of a trusted internal account to increase the likelihood of tricking the target into falling for the phish attempt.\n"
          ]
        },
        {
          "data": {
            "text/html": [
              "<table border=\"1\" class=\"dataframe\">\n",
              "  <thead>\n",
              "    <tr style=\"text-align: right;\">\n",
              "      <th></th>\n",
              "      <th>nlp_similarity</th>\n",
              "      <th>category</th>\n",
              "      <th>Shortcode</th>\n",
              "      <th>Description</th>\n",
              "    </tr>\n",
              "  </thead>\n",
              "  <tbody>\n",
              "    <tr>\n",
              "      <th>0</th>\n",
              "      <td>0.824364</td>\n",
              "      <td>General Authenticator Security</td>\n",
              "      <td>V2.2.7</td>\n",
              "      <td>Verify intent to authenticate by requiring the entry of an OTP token or user-initiated action such as a button press on a FIDO hardware key.</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>1</th>\n",
              "      <td>0.810173</td>\n",
              "      <td>RESTful Web Service</td>\n",
              "      <td>V13.2.6</td>\n",
              "      <td>Verify that the message headers and payload are trustworthy and not modified in transit. Requiring strong encryption for transport (TLS only) may be sufficient in many cases as it provides both confidentiality and integrity protection. Per-message digital signatures can provide additional assurance on top of the transport protections for high-security applications but bring with them additional complexity and risks to weigh against the benefits.</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>2</th>\n",
              "      <td>0.792918</td>\n",
              "      <td>SOAP Web Service</td>\n",
              "      <td>V13.3.1</td>\n",
              "      <td>Verify that XSD schema validation takes place to ensure a properly formed XML document, followed by validation of each input field before any processing of that data takes place.</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>3</th>\n",
              "      <td>0.792212</td>\n",
              "      <td>General Authenticator Security</td>\n",
              "      <td>V2.2.2</td>\n",
              "      <td>Verify that the use of weak authenticators (such as SMS and email) is limited to secondary verification and transaction approval and not as a replacement for more secure authentication methods. Verify that stronger methods are offered before weak methods, users are aware of the risks, or that proper measures are in place to limit the risks of account compromise.</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>4</th>\n",
              "      <td>0.785892</td>\n",
              "      <td>Business Logic Security</td>\n",
              "      <td>V11.1.1</td>\n",
              "      <td>Verify that the application will only process business logic flows for the same user in sequential step order and without skipping steps.</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>5</th>\n",
              "      <td>0.775526</td>\n",
              "      <td>Application Integrity</td>\n",
              "      <td>V10.3.1</td>\n",
              "      <td>Verify that if the application has a client or server auto-update feature, updates should be obtained over secure channels and digitally signed. The update code must validate the digital signature of the update before installing or executing the update.</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>6</th>\n",
              "      <td>0.773547</td>\n",
              "      <td>HTTP Security Headers</td>\n",
              "      <td>V14.4.6</td>\n",
              "      <td>Verify that a suitable Referrer-Policy header is included to avoid exposing sensitive information in the URL through the Referer header to untrusted parties.</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>7</th>\n",
              "      <td>0.765897</td>\n",
              "      <td>Sensitive Private Data</td>\n",
              "      <td>V8.3.3</td>\n",
              "      <td>Verify that users are provided clear language regarding collection and use of supplied personal information and that users have provided opt-in consent for the use of that data before it is used in any way.</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>8</th>\n",
              "      <td>0.762733</td>\n",
              "      <td>Malicious Software Architecture</td>\n",
              "      <td>V1.10.1</td>\n",
              "      <td>Verify that a source code control system is in use, with procedures to ensure that check-ins are accompanied by issues or change tickets. The source code control system should have access control and identifiable users to allow traceability of any changes.</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>9</th>\n",
              "      <td>0.758051</td>\n",
              "      <td>File Storage</td>\n",
              "      <td>V12.4.2</td>\n",
              "      <td>Verify that files obtained from untrusted sources are scanned by antivirus scanners to prevent upload and serving of known malicious content.</td>\n",
              "    </tr>\n",
              "  </tbody>\n",
              "</table>"
            ],
            "text/plain": [
              "<IPython.core.display.HTML object>"
            ]
          },
          "metadata": {},
          "output_type": "display_data"
        },
        {
          "name": "stdout",
          "output_type": "stream",
          "text": [
            "\n",
            "#11: Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.\n"
          ]
        },
        {
          "data": {
            "text/html": [
              "<table border=\"1\" class=\"dataframe\">\n",
              "  <thead>\n",
              "    <tr style=\"text-align: right;\">\n",
              "      <th></th>\n",
              "      <th>nlp_similarity</th>\n",
              "      <th>category</th>\n",
              "      <th>Shortcode</th>\n",
              "      <th>Description</th>\n",
              "    </tr>\n",
              "  </thead>\n",
              "  <tbody>\n",
              "    <tr>\n",
              "      <th>0</th>\n",
              "      <td>0.877704</td>\n",
              "      <td>Sanitization and Sandboxing</td>\n",
              "      <td>V5.2.6</td>\n",
              "      <td>Verify that the application protects against SSRF attacks, by validating or sanitizing untrusted data or HTTP file metadata, such as filenames and URL input fields, and uses allow lists of protocols, domains, paths and ports.</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>1</th>\n",
              "      <td>0.817654</td>\n",
              "      <td>Application Integrity</td>\n",
              "      <td>V10.3.3</td>\n",
              "      <td>Verify that the application has protection from subdomain takeovers if the application relies upon DNS entries or DNS subdomains, such as expired domain names, out of date DNS pointers or CNAMEs, expired projects at public source code repos, or transient cloud APIs, serverless functions, or storage buckets (*autogen-bucket-id*.cloud.example.com) or similar. Protections can include ensuring that DNS names used by applications are regularly checked for expiry or change.</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>2</th>\n",
              "      <td>0.811673</td>\n",
              "      <td>Application Integrity</td>\n",
              "      <td>V10.3.2</td>\n",
              "      <td>Verify that the application employs integrity protections, such as code signing or subresource integrity. The application must not load or execute code from untrusted sources, such as loading includes, modules, plugins, code, or libraries from untrusted sources or the Internet.</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>3</th>\n",
              "      <td>0.796706</td>\n",
              "      <td>Malicious Code Search</td>\n",
              "      <td>V10.2.2</td>\n",
              "      <td>Verify that the application does not ask for unnecessary or excessive permissions to privacy related features or sensors, such as contacts, cameras, microphones, or location.</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>4</th>\n",
              "      <td>0.792139</td>\n",
              "      <td>Business Logic Security</td>\n",
              "      <td>V11.1.5</td>\n",
              "      <td>Verify the application has business logic limits or validation to protect against likely business risks or threats, identified using threat modeling or similar methodologies.</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>5</th>\n",
              "      <td>0.790120</td>\n",
              "      <td>General Data Protection</td>\n",
              "      <td>V8.1.3</td>\n",
              "      <td>Verify the application minimizes the number of parameters in a request, such as hidden fields, Ajax variables, cookies and header values.</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>6</th>\n",
              "      <td>0.784318</td>\n",
              "      <td>Other Access Control Considerations</td>\n",
              "      <td>V4.3.3</td>\n",
              "      <td>Verify the application has additional authorization (such as step up or adaptive authentication) for lower value systems, and / or segregation of duties for high value applications to enforce anti-fraud controls as per the risk of application and past fraud.</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>7</th>\n",
              "      <td>0.771198</td>\n",
              "      <td>Cryptographic Architecture</td>\n",
              "      <td>V1.6.2</td>\n",
              "      <td>Verify that consumers of cryptographic services protect key material and other secrets by using key vaults or API based alternatives.</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>8</th>\n",
              "      <td>0.763446</td>\n",
              "      <td>Token-based Session Management</td>\n",
              "      <td>V3.5.2</td>\n",
              "      <td>Verify the application uses session tokens rather than static API secrets and keys, except with legacy implementations.</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>9</th>\n",
              "      <td>0.761467</td>\n",
              "      <td>Business Logic Security</td>\n",
              "      <td>V11.1.4</td>\n",
              "      <td>Verify that the application has anti-automation controls to protect against excessive calls such as mass data exfiltration, business logic requests, file uploads or denial of service attacks.</td>\n",
              "    </tr>\n",
              "  </tbody>\n",
              "</table>"
            ],
            "text/plain": [
              "<IPython.core.display.HTML object>"
            ]
          },
          "metadata": {},
          "output_type": "display_data"
        },
        {
          "name": "stdout",
          "output_type": "stream",
          "text": [
            "\n",
            "#12: Adversaries may create multiple stages for command and control that are employed under different conditions or for certain functions. Use of multiple stages may obfuscate the command and control channel to make detection more difficult.\n"
          ]
        },
        {
          "data": {
            "text/html": [
              "<table border=\"1\" class=\"dataframe\">\n",
              "  <thead>\n",
              "    <tr style=\"text-align: right;\">\n",
              "      <th></th>\n",
              "      <th>nlp_similarity</th>\n",
              "      <th>category</th>\n",
              "      <th>Shortcode</th>\n",
              "      <th>Description</th>\n",
              "    </tr>\n",
              "  </thead>\n",
              "  <tbody>\n",
              "    <tr>\n",
              "      <th>0</th>\n",
              "      <td>0.791528</td>\n",
              "      <td>Generic Web Service Security</td>\n",
              "      <td>V13.1.1</td>\n",
              "      <td>Verify that all application components use the same encodings and parsers to avoid parsing attacks that exploit different URI or file parsing behavior that could be used in SSRF and RFI attacks.</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>1</th>\n",
              "      <td>0.780302</td>\n",
              "      <td>RESTful Web Service</td>\n",
              "      <td>V13.2.6</td>\n",
              "      <td>Verify that the message headers and payload are trustworthy and not modified in transit. Requiring strong encryption for transport (TLS only) may be sufficient in many cases as it provides both confidentiality and integrity protection. Per-message digital signatures can provide additional assurance on top of the transport protections for high-security applications but bring with them additional complexity and risks to weigh against the benefits.</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>2</th>\n",
              "      <td>0.777876</td>\n",
              "      <td>General Authenticator Security</td>\n",
              "      <td>V2.2.2</td>\n",
              "      <td>Verify that the use of weak authenticators (such as SMS and email) is limited to secondary verification and transaction approval and not as a replacement for more secure authentication methods. Verify that stronger methods are offered before weak methods, users are aware of the risks, or that proper measures are in place to limit the risks of account compromise.</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>3</th>\n",
              "      <td>0.776007</td>\n",
              "      <td>Malicious Software Architecture</td>\n",
              "      <td>V1.10.1</td>\n",
              "      <td>Verify that a source code control system is in use, with procedures to ensure that check-ins are accompanied by issues or change tickets. The source code control system should have access control and identifiable users to allow traceability of any changes.</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>4</th>\n",
              "      <td>0.754401</td>\n",
              "      <td>Business Logic Security</td>\n",
              "      <td>V11.1.1</td>\n",
              "      <td>Verify that the application will only process business logic flows for the same user in sequential step order and without skipping steps.</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>5</th>\n",
              "      <td>0.748945</td>\n",
              "      <td>GraphQL</td>\n",
              "      <td>V13.4.1</td>\n",
              "      <td>Verify that a query allow list or a combination of depth limiting and amount limiting is used to prevent GraphQL or data layer expression Denial of Service (DoS) as a result of expensive, nested queries. For more advanced scenarios, query cost analysis should be used.</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>6</th>\n",
              "      <td>0.740163</td>\n",
              "      <td>Business Logic Security</td>\n",
              "      <td>V11.1.3</td>\n",
              "      <td>Verify the application has appropriate limits for specific business actions or transactions which are correctly enforced on a per user basis.</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>7</th>\n",
              "      <td>0.733491</td>\n",
              "      <td>Other Access Control Considerations</td>\n",
              "      <td>V4.3.3</td>\n",
              "      <td>Verify the application has additional authorization (such as step up or adaptive authentication) for lower value systems, and / or segregation of duties for high value applications to enforce anti-fraud controls as per the risk of application and past fraud.</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>8</th>\n",
              "      <td>0.726283</td>\n",
              "      <td>Log Processing</td>\n",
              "      <td>V7.2.1</td>\n",
              "      <td>Verify that all authentication decisions are logged, without storing sensitive session tokens or passwords. This should include requests with relevant metadata needed for security investigations.</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>9</th>\n",
              "      <td>0.726216</td>\n",
              "      <td>Business Logic Security</td>\n",
              "      <td>V11.1.5</td>\n",
              "      <td>Verify the application has business logic limits or validation to protect against likely business risks or threats, identified using threat modeling or similar methodologies.</td>\n",
              "    </tr>\n",
              "  </tbody>\n",
              "</table>"
            ],
            "text/plain": [
              "<IPython.core.display.HTML object>"
            ]
          },
          "metadata": {},
          "output_type": "display_data"
        },
        {
          "name": "stdout",
          "output_type": "stream",
          "text": [
            "\n",
            "#13: An adversary may exfiltrate data in fixed size chunks instead of whole files or limit packet sizes below certain thresholds. This approach may be used to avoid triggering network data transfer threshold alerts.\n"
          ]
        },
        {
          "data": {
            "text/html": [
              "<table border=\"1\" class=\"dataframe\">\n",
              "  <thead>\n",
              "    <tr style=\"text-align: right;\">\n",
              "      <th></th>\n",
              "      <th>nlp_similarity</th>\n",
              "      <th>category</th>\n",
              "      <th>Shortcode</th>\n",
              "      <th>Description</th>\n",
              "    </tr>\n",
              "  </thead>\n",
              "  <tbody>\n",
              "    <tr>\n",
              "      <th>0</th>\n",
              "      <td>0.784739</td>\n",
              "      <td>Malicious Software Architecture</td>\n",
              "      <td>V1.10.1</td>\n",
              "      <td>Verify that a source code control system is in use, with procedures to ensure that check-ins are accompanied by issues or change tickets. The source code control system should have access control and identifiable users to allow traceability of any changes.</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>1</th>\n",
              "      <td>0.784721</td>\n",
              "      <td>Log Processing</td>\n",
              "      <td>V7.2.1</td>\n",
              "      <td>Verify that all authentication decisions are logged, without storing sensitive session tokens or passwords. This should include requests with relevant metadata needed for security investigations.</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>2</th>\n",
              "      <td>0.759625</td>\n",
              "      <td>Sensitive Private Data</td>\n",
              "      <td>V8.3.1</td>\n",
              "      <td>Verify that sensitive data is sent to the server in the HTTP message body or headers, and that query string parameters from any HTTP verb do not contain sensitive data.</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>3</th>\n",
              "      <td>0.758730</td>\n",
              "      <td>Generic Web Service Security</td>\n",
              "      <td>V13.1.1</td>\n",
              "      <td>Verify that all application components use the same encodings and parsers to avoid parsing attacks that exploit different URI or file parsing behavior that could be used in SSRF and RFI attacks.</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>4</th>\n",
              "      <td>0.734436</td>\n",
              "      <td>HTTP Security Headers</td>\n",
              "      <td>V14.4.6</td>\n",
              "      <td>Verify that a suitable Referrer-Policy header is included to avoid exposing sensitive information in the URL through the Referer header to untrusted parties.</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>5</th>\n",
              "      <td>0.727654</td>\n",
              "      <td>RESTful Web Service</td>\n",
              "      <td>V13.2.6</td>\n",
              "      <td>Verify that the message headers and payload are trustworthy and not modified in transit. Requiring strong encryption for transport (TLS only) may be sufficient in many cases as it provides both confidentiality and integrity protection. Per-message digital signatures can provide additional assurance on top of the transport protections for high-security applications but bring with them additional complexity and risks to weigh against the benefits.</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>6</th>\n",
              "      <td>0.723775</td>\n",
              "      <td>Fundamental Session Management Security</td>\n",
              "      <td>V3.1.1</td>\n",
              "      <td>Verify the application never reveals session tokens in URL parameters.</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>7</th>\n",
              "      <td>0.718993</td>\n",
              "      <td>GraphQL</td>\n",
              "      <td>V13.4.2</td>\n",
              "      <td>Verify that GraphQL or other data layer authorization logic should be implemented at the business logic layer instead of the GraphQL layer.</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>8</th>\n",
              "      <td>0.718323</td>\n",
              "      <td>Business Logic Security</td>\n",
              "      <td>V11.1.1</td>\n",
              "      <td>Verify that the application will only process business logic flows for the same user in sequential step order and without skipping steps.</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>9</th>\n",
              "      <td>0.718264</td>\n",
              "      <td>File Storage</td>\n",
              "      <td>V12.4.2</td>\n",
              "      <td>Verify that files obtained from untrusted sources are scanned by antivirus scanners to prevent upload and serving of known malicious content.</td>\n",
              "    </tr>\n",
              "  </tbody>\n",
              "</table>"
            ],
            "text/plain": [
              "<IPython.core.display.HTML object>"
            ]
          },
          "metadata": {},
          "output_type": "display_data"
        },
        {
          "name": "stdout",
          "output_type": "stream",
          "text": [
            "\n",
            "#14: Adversaries may perform Endpoint Denial of Service (DoS) attacks to degrade or block the availability of services to users. Endpoint DoS can be performed by exhausting the system resources those services are hosted on or exploiting the system to cause a persistent crash condition. Example services include websites, email services, DNS, and web-based applications. Adversaries have been observed conducting DoS attacks for political purposes and to support other malicious activities, including distraction, hacktivism, and extortion.\n"
          ]
        },
        {
          "data": {
            "text/html": [
              "<table border=\"1\" class=\"dataframe\">\n",
              "  <thead>\n",
              "    <tr style=\"text-align: right;\">\n",
              "      <th></th>\n",
              "      <th>nlp_similarity</th>\n",
              "      <th>category</th>\n",
              "      <th>Shortcode</th>\n",
              "      <th>Description</th>\n",
              "    </tr>\n",
              "  </thead>\n",
              "  <tbody>\n",
              "    <tr>\n",
              "      <th>0</th>\n",
              "      <td>0.819715</td>\n",
              "      <td>Log Processing</td>\n",
              "      <td>V7.2.1</td>\n",
              "      <td>Verify that all authentication decisions are logged, without storing sensitive session tokens or passwords. This should include requests with relevant metadata needed for security investigations.</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>1</th>\n",
              "      <td>0.810251</td>\n",
              "      <td>Application Integrity</td>\n",
              "      <td>V10.3.3</td>\n",
              "      <td>Verify that the application has protection from subdomain takeovers if the application relies upon DNS entries or DNS subdomains, such as expired domain names, out of date DNS pointers or CNAMEs, expired projects at public source code repos, or transient cloud APIs, serverless functions, or storage buckets (*autogen-bucket-id*.cloud.example.com) or similar. Protections can include ensuring that DNS names used by applications are regularly checked for expiry or change.</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>2</th>\n",
              "      <td>0.796998</td>\n",
              "      <td>Service Authentication</td>\n",
              "      <td>V2.10.4</td>\n",
              "      <td>Verify passwords, integrations with databases and third-party systems, seeds and internal secrets, and API keys are managed securely and not included in the source code or stored within source code repositories. Such storage SHOULD resist offline attacks. The use of a secure software key store (L1), hardware TPM, or an HSM (L3) is recommended for password storage.</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>3</th>\n",
              "      <td>0.772408</td>\n",
              "      <td>GraphQL</td>\n",
              "      <td>V13.4.1</td>\n",
              "      <td>Verify that a query allow list or a combination of depth limiting and amount limiting is used to prevent GraphQL or data layer expression Denial of Service (DoS) as a result of expensive, nested queries. For more advanced scenarios, query cost analysis should be used.</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>4</th>\n",
              "      <td>0.771291</td>\n",
              "      <td>Malicious Software Architecture</td>\n",
              "      <td>V1.10.1</td>\n",
              "      <td>Verify that a source code control system is in use, with procedures to ensure that check-ins are accompanied by issues or change tickets. The source code control system should have access control and identifiable users to allow traceability of any changes.</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>5</th>\n",
              "      <td>0.756806</td>\n",
              "      <td>File Execution</td>\n",
              "      <td>V12.3.4</td>\n",
              "      <td>Verify that the application protects against Reflective File Download (RFD) by validating or ignoring user-submitted filenames in a JSON, JSONP, or URL parameter, the response Content-Type header should be set to text/plain, and the Content-Disposition header should have a fixed filename.</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>6</th>\n",
              "      <td>0.751179</td>\n",
              "      <td>General Data Protection</td>\n",
              "      <td>V8.1.1</td>\n",
              "      <td>Verify the application protects sensitive data from being cached in server components such as load balancers and application caches.</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>7</th>\n",
              "      <td>0.750643</td>\n",
              "      <td>Unintended Security Disclosure</td>\n",
              "      <td>V14.3.2</td>\n",
              "      <td>Verify that web or application server and application framework debug modes are disabled in production to eliminate debug features, developer consoles, and unintended security disclosures.</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>8</th>\n",
              "      <td>0.748784</td>\n",
              "      <td>Build and Deploy</td>\n",
              "      <td>V14.1.2</td>\n",
              "      <td>Verify that compiler flags are configured to enable all available buffer overflow protections and warnings, including stack randomization, data execution prevention, and to break the build if an unsafe pointer, memory, format string, integer, or string operations are found.</td>\n",
              "    </tr>\n",
              "    <tr>\n",
              "      <th>9</th>\n",
              "      <td>0.747571</td>\n",
              "      <td>Business Logic Security</td>\n",
              "      <td>V11.1.5</td>\n",
              "      <td>Verify the application has business logic limits or validation to protect against likely business risks or threats, identified using threat modeling or similar methodologies.</td>\n",
              "    </tr>\n",
              "  </tbody>\n",
              "</table>"
            ],
            "text/plain": [
              "<IPython.core.display.HTML object>"
            ]
          },
          "metadata": {},
          "output_type": "display_data"
        }
      ],
      "source": [
        "for i, abuse in enumerate(abuse_scenarios):\n",
        "    abuse_nlp = nlp(clean(abuse, lower=False))\n",
        "\n",
        "    for req in asvs_req_nlp:\n",
        "        req['nlp_similarity'] = abuse_nlp.similarity(req['nlp'])\n",
        "\n",
        "    print('\\n#{i}: {abuse}'.format(abuse=abuse, i=i+1))\n",
        "\n",
        "    df_req = pd.json_normalize(asvs_req_nlp)\n",
        "    \n",
        "    display(HTML(df_req[['nlp_similarity', 'category', 'Shortcode', 'Description']].sort_values('nlp_similarity', ascending=False).head(10).reset_index(drop=True, inplace=False).to_html()))"
      ]
    },
    {
      "cell_type": "code",
      "execution_count": 78,
      "metadata": {
        "id": "v11e00_aP_AI"
      },
      "outputs": [],
      "source": []
    }
  ],
  "metadata": {
    "colab": {
      "collapsed_sections": [],
      "name": "nlp-asvs.ipynb",
      "provenance": []
    },
    "kernelspec": {
      "display_name": "Python 3.10.4 64-bit",
      "language": "python",
      "name": "python3"
    },
    "language_info": {
      "name": "python",
      "version": "3.10.4"
    },
    "vscode": {
      "interpreter": {
        "hash": "50cdeac3fa59cb6059ad2e6702b43ffe31bb35423fc0f4541ef066e3d0b613b1"
      }
    }
  },
  "nbformat": 4,
  "nbformat_minor": 0
}