论文标题
基于开源智能信息来源的常见漏洞评分系统预测
Common Vulnerability Scoring System Prediction based on Open Source Intelligence Information Sources
论文作者
论文摘要
新发表的漏洞的数量不断增加。到目前为止，专家使用常见漏洞评分系统（CVSS）向量和得分来手动评估发表新漏洞时可用的信息。这项评估很耗时，需要专业知识。各种作品已经尝试使用机器学习来预测CVSS向量或分数，以基于对脆弱性的文本描述，以实现更快的评估。但是，为此，以前的作品仅使用数据库中可用的文本，例如国家漏洞数据库。通过这项工作，分析了国家漏洞数据库中引用的公开网页，并通过网络刮擦作为文本来源。实施和评估了一种基于深度学习的方法来预测CVSS矢量。目前的工作根据其文本的适用性和爬行性提供了国家脆弱性数据库参考文本的分类。尽管我们确定了其他文本的总体影响可以忽略不计，但我们通过深度学习预测模型优于最先进的文本。
The number of newly published vulnerabilities is constantly increasing. Until now, the information available when a new vulnerability is published is manually assessed by experts using a Common Vulnerability Scoring System (CVSS) vector and score. This assessment is time consuming and requires expertise. Various works already try to predict CVSS vectors or scores using machine learning based on the textual descriptions of the vulnerability to enable faster assessment. However, for this purpose, previous works only use the texts available in databases such as National Vulnerability Database. With this work, the publicly available web pages referenced in the National Vulnerability Database are analyzed and made available as sources of texts through web scraping. A Deep Learning based method for predicting the CVSS vector is implemented and evaluated. The present work provides a classification of the National Vulnerability Database's reference texts based on the suitability and crawlability of their texts. While we identified the overall influence of the additional texts is negligible, we outperformed the state-of-the-art with our Deep Learning prediction models.
