论文标题
通过自动和增强说明摘要来丰富脆弱性报告
Enriching Vulnerability Reports Through Automated and Augmented Description Summarization
论文作者
论文摘要
安全事件和数据泄露行为正在迅速增加，仅报告了其中的一小部分。公共脆弱性数据库，例如国家漏洞数据库（NVD）以及共同的漏洞和暴露（CVE），一直在努力记录漏洞并共享它们以帮助防御。两者都以许多问题而闻名，包括简短的漏洞描述。这些描述在将漏洞信息传达给安全分析师以开发适当的对策方面起着重要作用。许多资源提供了有关漏洞的其他信息，但是，它们并未用于增加公共存储库。在本文中，我们设计了一条管道来通过第三方参考（超链接）报废来增强漏洞描述。为了使描述归一化，我们利用验证的语言模型构建了自然语言摘要管道，该语言模型使用标记的实例进行了微调，并根据人类评估（黄金标准）和计算指标评估了其绩效，从而显示出最初的有希望的结果，以简单的流畅性，完整性，正确性，正确性和理解为基础。
Security incidents and data breaches are increasing rapidly, and only a fraction of them is being reported. Public vulnerability databases, e.g., national vulnerability database (NVD) and common vulnerability and exposure (CVE), have been leading the effort in documenting vulnerabilities and sharing them to aid defenses. Both are known for many issues, including brief vulnerability descriptions. Those descriptions play an important role in communicating the vulnerability information to security analysts in order to develop the appropriate countermeasure. Many resources provide additional information about vulnerabilities, however, they are not utilized to boost public repositories. In this paper, we devise a pipeline to augment vulnerability description through third party reference (hyperlink) scrapping. To normalize the description, we build a natural language summarization pipeline utilizing a pretrained language model that is fine-tuned using labeled instances and evaluate its performance against both human evaluation (golden standard) and computational metrics, showing initial promising results in terms of summary fluency, completeness, correctness, and understanding.
