PracExtractor: Extracting Configuration Good Practices from Manuals to Detect...
summary
PracExtractor uses NLP (keyword + syntactic pattern filtering, dependency parsing, entity identification and semantic pattern matching) to turn manual sentences into formal checks and runs them against configs. From manuals it extracts 338 recommendations and generates 173 specifications; scanning 2,200 Docker images finds 1,423 violations in 853 images, reports 325 issues and gets 47 confirmed. Highlights: converts free text into checkable specs, finds many wrong defaults, identifies unchecked recommendations by source code.
AI-written summary · about
chapters (8)
- 0:00Intro
- 1:39Software release large manuals to assist sysadmins with configurations
- 2:39Is there any useful information that can be automatically extract from manuals?
- 3:58How useful are the good practices in manuais?
- 9:02Two challenges with PracExtractor
- 9:44Challenge 1: Extract good practice descriptions
- 13:23Accuracy of good practice extraction
- 16:08Evaluation of PracExtractor • Outcome of the confirmed configuration errors
related talks
36mDoes your configuration code smell?
27mCatch Me If You Can: Hunting Misconfigurations Before They...
33mOperations: a developer's guide
05mHow To Automate Compliance If You Aren't Chuck Norris
01h 21mFirst Steps to Full Lifecycle Security with Open Source Tools
26mOperational Compliance: From Requirements to Reality
28mDevSecOps - Security from Scratch
33mAutomation of SBOM Assessment in AGL Development Process
