XLNet-Based Prediction Model for CVSS Metric Values
Source abstract
Abstract
A plethora of software vulnerabilities are exposed daily, posing a severe threat to the Internet. It is almost impossible for security experts or software developers to deal with all vulnerabilities. Therefore, it is imperative to rapidly assess the severity of the vulnerability to be able to select which one should be given preferential attention. CVSS is now the industry’s de facto evaluation standard, which is calculated with a quantitative formula to measure the severity of a vulnerability. The CVSS formula consists of several metrics related to the vulnerability’s features. Security experts need to determine the values of each metric, which is tedious and time-consuming, therefore hindering the efficiency of severity assessment. To address this problem, in this paper, we propose a method based on a pre-trained model for the prediction of CVSS metric values. More specifically, this method utilizes the XLNet model that is fine-tuned with a self-built corpus to predict the metric values from the vulnerability description text, thus reducing the burden of the assessment procedure. To verify the performance of our method, we compare the XLNet model with other pre-trained models and conventional machine learning techniques. The experimental results show that the method outperforms these models on evaluation metrics, reaching state-of-the-art performance levels.
Source: crossref · Quality: baseline
Research context
OpenAlex topics: Software Engineering Research · Information and Cyber Security · Web Application Security Vulnerabilities
SciVX discovery tags are terminology-based. OpenAlex topics are source-provided classifications.
Affiliations
College of Electronic Engineering, National University of Defense Technology, Hefei 230037, China
Funding
National Key Research and Development Program of China
References (35)
Show source-provided references
1. (2022, September 01). National Vulnerability Database, Available online: https://nvd.nist.gov/vuln.
2. Big data for cybersecurity: Vulnerability disclosure trends and dependencies10.1109/TBDATA.2017.2723570 ↗
3. Viegas, V., and Kuyucu, O. (2022). IT Security Controls, Apress. [1st ed.].10.1007/978-1-4842-7799-7 ↗
4. Chen, H., Liu, J., Liu, R., Park, N., and Subrahmanian, V. (2019, January 10–16). VEST: A System for Vulnerability Exploit Scoring & Timing. Proceedings of the Twenty-Eighth International Joint Conference on Artificial Intelligence (IJCAI-19), Macao, China.10.24963/ijcai.2019/937 ↗
5. A look at the time delays in CVSS vulnerability scoring10.1016/j.aci.2017.12.002 ↗
6. (2022, June 15). Binding Operational Directive 19-02—Vulnerability Remediation Requirements for Internet-Accessible Systems, Available online: https://www.cisa.gov/binding-operational-directive-19-02.
7. Ahmadi, V., Arlos, P., and Casalicchio, E. (2020, January 17–21). Normalization of severity rating for automated context-aware vulnerability risk management. Proceedings of the 2020 IEEE International Conference on Autonomic Computing and Self-Organizing Systems Companion (ACSOS-C), Online.10.1109/ACSOS-C51401.2020.00056 ↗
8. (2022, June 15). CVE Status Count, Available online: https://nvd.nist.gov/general/nvd-dashboard.
9. Kai, S., Zheng, J., Shi, F., and Lu, Z. (2021, January 27–29). A CVSS-based Vulnerability Assessment Method for Reducing Scoring Error. Proceedings of the 2021 2nd International Conference on Electronics, Communications and Information Technology (CECIT), Sanya, China.10.1109/CECIT53797.2021.00013 ↗
10. (2022, July 02). A Complete Guide to the Common Vulnerability Scoring System. Available online: https://www.first.org/cvss/v2/guide.
11. (2022, September 01). Common Vulnerability Scoring System v3.1: Specification Document. Available online: https://www.first.org/cvss/v3.1/specification-document.
12. Xlnet: Generalized autoregressive pretraining for language understanding
13. (2022, June 15). Common Vulnerability Scoring System SIG. Available online: https://www.first.org/cvss/.
14. Schiffman, M., Wright, A., Ahmad, D., Eschelbeck, G., National Infrastructure Advisory Council, Vulnerability Disclosure Working Group, and Vulnerability Scoring Subgroup (2004). The Common Vulnerability Scoring System, National Infrastructure Advisory Council.
15. Common vulnerability scoring system10.1109/MSP.2006.145 ↗
16. Eiram, C., and Martin, B. (2013). The CVSSv2 Shortcomings, Faults, and Failures Formulation, Forum of Incident Response and Security Teams (FIRST). Technical Report.
17. (2022, September 01). Exploit Prediction Scoring System (EPSS). Available online: https://www.first.org/epss/model.
18. Exploit prediction scoring system (epss)10.1145/3436242 ↗
19. Keskin, O., Gannon, N., Lopez, B., and Tatar, U. (2021, January 29–30). Scoring Cyber Vulnerabilities based on Their Impact on Organizational Goals. Proceedings of the 2021 Systems and Information Engineering Design Symposium (SIEDS), Online.10.1109/SIEDS52267.2021.9483741 ↗
20. Team, C. (2015). Common Vulnerability Scoring System v3.0: Specification Document, Forum of Incident Response and Security Teams (FIRST).
21. Shahid, M.R., and Debar, H. (2021, January 13–16). CVSS-BERT: Explainable Natural Language Processing to Determine the Severity of a Computer Security Vulnerability from its Description. Proceedings of the 2021 20th IEEE International Conference on Machine Learning and Applications (ICMLA), Pasadena, CA, USA.10.1109/ICMLA52953.2021.00256 ↗
22. Gong, X., Xing, Z., Li, X., Feng, Z., and Han, Z. (2019, January 10–13). Joint prediction of multiple vulnerability characteristics through multi-task learning. Proceedings of the 2019 24th International Conference on Engineering of Complex Computer Systems (ICECCS), Guangzhou, China.10.1109/ICECCS.2019.00011 ↗
23. Predicting CVSS Metric Via Description Interpretation10.1109/ACCESS.2022.3179692 ↗
24. An automatic method for CVSS score prediction using vulnerabilities description10.3233/IFS-151733 ↗
25. Wang, P., Zhou, Y., Sun, B., and Zhang, W. (2019, January 7–9). Intelligent prediction of vulnerability severity level based on text mining and XGBboost. Proceedings of the 2019 Eleventh International Conference on Advanced Computational Intelligence (ICACI), Guilin, China.10.1109/ICACI.2019.8778469 ↗
26. Han, Z., Li, X., Xing, Z., Liu, H., and Feng, Z. (2017, January 17–22). Learning to predict severity of software vulnerability using only vulnerability description. Proceedings of the 2017 IEEE International conference on software maintenance and evolution (ICSME), Shanghai, China.10.1109/ICSME.2017.52 ↗
27. Liu, K., Zhou, Y., Wang, Q., and Zhu, X. (2019, January 8–10). Vulnerability severity prediction with deep neural network. Proceedings of the 2019 5th International Conference on Big Data and Information Analytics (BigDIA), Kunming, China.10.1109/BigDIA.2019.8802851 ↗
28. Spanos, G., Angelis, L., and Toloudis, D. (2017, January 28–30). Assessment of vulnerability severity using text mining. Proceedings of the 21st Pan-Hellenic Conference on Informatics, Larissa, Greece.10.1145/3139367.3139390 ↗
29. Ali, M. (2018, January 20). Character level convolutional neural network for Arabic dialect identification. Proceedings of the Fifth Workshop on NLP for Similar Languages, Varieties and Dialects (VarDial 2018), Santa Fe, NM, USA.
30. CyBERT: Cybersecurity Claim Classification by Fine-Tuning the BERT Language Model10.3390/jcp1040031 ↗
31. The effect of Bellwether analysis on software vulnerability severity prediction models10.1007/s11219-019-09490-1 ↗
32. Text mining: Use of TF-IDF to examine the relevance of words to documents
33. Goldberg, Y., and Levy, O. (2014). Word2vec Explained: Deriving Mikolov et al.’s negative-sampling word-embedding method. arXiv.
34. Devlin, J., Chang, M.-W., Lee, K., and Toutanova, K. (2018). Bert: Pre-training of deep bidirectional transformers for language understanding. arXiv.
35. Apply transfer learning to cybersecurity: Predicting exploitability of vulnerabilities by description10.1016/j.knosys.2020.106529 ↗