Assessing Vulnerability from Its Description

Zijing Zhang; Vimal Kumar; Michael Mayo; Albert Bifet

doi:10.1007/978-981-99-0272-9_9

Assessing Vulnerability from Its Description

Zijing Zhang
, Vimal Kumar
, Michael Mayo
, Albert Bifet

University of Waikato

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › peer-review

Abstract

This paper shows an end-to-end Artificial Intelligence (AI) system to estimate the severity level and the various Common Vulnerability Scoring System (CVSS) components from natural language descriptions without reproducing the vulnerability. This natural language processing-based approach can estimate the CVSS from only the Common Vulnerabilities and Exposures description without the need to reproduce the vulnerability environment. We present an Error Grid Analysis for the CVSS base score prediction task. Experiments on CVSS 2.0 and CVSS 3.1 show that state-of-the-art deep learning models can predict the CVSS scoring components with high accuracy. The low-cost Universal Sentence Encoder (large) model outperforms the Generative Pre-trained Transformer-3 (GPT-3) and the Support Vector Machine baseline on the majority of the classification tasks with a lower computation overhead than the GPT-3.

Original language	English
Title of host publication	Ubiquitous Security - 2nd International Conference, UbiSec 2022, Revised Selected Papers
Editors	Guojun Wang, Kim-Kwang Raymond Choo, Jie Wu, Ernesto Damiani
Publisher	Springer Science and Business Media Deutschland GmbH
Pages	129-143
Number of pages	15
ISBN (Print)	9789819902712
DOIs	https://doi.org/10.1007/978-981-99-0272-9_9
Publication status	Published - 1 Jan 2023
Externally published	Yes
Event	2nd International Conference on Ubiquitous Security, UbiSec 2022 - Zhangjiajie, China Duration: 28 Dec 2022 → 31 Dec 2022

Publication series

Name	Communications in Computer and Information Science
Volume	1768 CCIS
ISSN (Print)	1865-0929
ISSN (Electronic)	1865-0937

Conference

Conference	2nd International Conference on Ubiquitous Security, UbiSec 2022
Country/Territory	China
City	Zhangjiajie
Period	28/12/22 → 31/12/22

Keywords

Artificial Intelligence
CVSS
Deep Learning
Natural Language Processing
Threat Intelligence

Access to Document

10.1007/978-981-99-0272-9_9

Cite this

Zhang, Z., Kumar, V., Mayo, M., & Bifet, A. (2023). Assessing Vulnerability from Its Description. In G. Wang, K.-K. R. Choo, J. Wu, & E. Damiani (Eds.), Ubiquitous Security - 2nd International Conference, UbiSec 2022, Revised Selected Papers (pp. 129-143). (Communications in Computer and Information Science; Vol. 1768 CCIS). Springer Science and Business Media Deutschland GmbH. https://doi.org/10.1007/978-981-99-0272-9_9

Zhang, Zijing ; Kumar, Vimal ; Mayo, Michael et al. / Assessing Vulnerability from Its Description. Ubiquitous Security - 2nd International Conference, UbiSec 2022, Revised Selected Papers. editor / Guojun Wang ; Kim-Kwang Raymond Choo ; Jie Wu ; Ernesto Damiani. Springer Science and Business Media Deutschland GmbH, 2023. pp. 129-143 (Communications in Computer and Information Science).

@inproceedings{27b82575115f4fa18a82f75e13aa0a07,

title = "Assessing Vulnerability from Its Description",

abstract = "This paper shows an end-to-end Artificial Intelligence (AI) system to estimate the severity level and the various Common Vulnerability Scoring System (CVSS) components from natural language descriptions without reproducing the vulnerability. This natural language processing-based approach can estimate the CVSS from only the Common Vulnerabilities and Exposures description without the need to reproduce the vulnerability environment. We present an Error Grid Analysis for the CVSS base score prediction task. Experiments on CVSS 2.0 and CVSS 3.1 show that state-of-the-art deep learning models can predict the CVSS scoring components with high accuracy. The low-cost Universal Sentence Encoder (large) model outperforms the Generative Pre-trained Transformer-3 (GPT-3) and the Support Vector Machine baseline on the majority of the classification tasks with a lower computation overhead than the GPT-3.",

keywords = "Artificial Intelligence, CVSS, Deep Learning, Natural Language Processing, Threat Intelligence",

author = "Zijing Zhang and Vimal Kumar and Michael Mayo and Albert Bifet",

note = "Publisher Copyright: {\textcopyright} 2023, The Author(s), under exclusive license to Springer Nature Singapore Pte Ltd.; 2nd International Conference on Ubiquitous Security, UbiSec 2022 ; Conference date: 28-12-2022 Through 31-12-2022",

year = "2023",

month = jan,

day = "1",

doi = "10.1007/978-981-99-0272-9\_9",

language = "English",

isbn = "9789819902712",

series = "Communications in Computer and Information Science",

publisher = "Springer Science and Business Media Deutschland GmbH",

pages = "129--143",

editor = "Guojun Wang and Choo, \{Kim-Kwang Raymond\} and Jie Wu and Ernesto Damiani",

booktitle = "Ubiquitous Security - 2nd International Conference, UbiSec 2022, Revised Selected Papers",

}

Zhang, Z, Kumar, V, Mayo, M & Bifet, A 2023, Assessing Vulnerability from Its Description. in G Wang, K-KR Choo, J Wu & E Damiani (eds), Ubiquitous Security - 2nd International Conference, UbiSec 2022, Revised Selected Papers. Communications in Computer and Information Science, vol. 1768 CCIS, Springer Science and Business Media Deutschland GmbH, pp. 129-143, 2nd International Conference on Ubiquitous Security, UbiSec 2022, Zhangjiajie, China, 28/12/22. https://doi.org/10.1007/978-981-99-0272-9_9

Assessing Vulnerability from Its Description. / Zhang, Zijing; Kumar, Vimal; Mayo, Michael et al.
Ubiquitous Security - 2nd International Conference, UbiSec 2022, Revised Selected Papers. ed. / Guojun Wang; Kim-Kwang Raymond Choo; Jie Wu; Ernesto Damiani. Springer Science and Business Media Deutschland GmbH, 2023. p. 129-143 (Communications in Computer and Information Science; Vol. 1768 CCIS).

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › peer-review

TY - GEN

T1 - Assessing Vulnerability from Its Description

AU - Zhang, Zijing

AU - Kumar, Vimal

AU - Mayo, Michael

AU - Bifet, Albert

PY - 2023/1/1

Y1 - 2023/1/1

N2 - This paper shows an end-to-end Artificial Intelligence (AI) system to estimate the severity level and the various Common Vulnerability Scoring System (CVSS) components from natural language descriptions without reproducing the vulnerability. This natural language processing-based approach can estimate the CVSS from only the Common Vulnerabilities and Exposures description without the need to reproduce the vulnerability environment. We present an Error Grid Analysis for the CVSS base score prediction task. Experiments on CVSS 2.0 and CVSS 3.1 show that state-of-the-art deep learning models can predict the CVSS scoring components with high accuracy. The low-cost Universal Sentence Encoder (large) model outperforms the Generative Pre-trained Transformer-3 (GPT-3) and the Support Vector Machine baseline on the majority of the classification tasks with a lower computation overhead than the GPT-3.

AB - This paper shows an end-to-end Artificial Intelligence (AI) system to estimate the severity level and the various Common Vulnerability Scoring System (CVSS) components from natural language descriptions without reproducing the vulnerability. This natural language processing-based approach can estimate the CVSS from only the Common Vulnerabilities and Exposures description without the need to reproduce the vulnerability environment. We present an Error Grid Analysis for the CVSS base score prediction task. Experiments on CVSS 2.0 and CVSS 3.1 show that state-of-the-art deep learning models can predict the CVSS scoring components with high accuracy. The low-cost Universal Sentence Encoder (large) model outperforms the Generative Pre-trained Transformer-3 (GPT-3) and the Support Vector Machine baseline on the majority of the classification tasks with a lower computation overhead than the GPT-3.

KW - Artificial Intelligence

KW - CVSS

KW - Deep Learning

KW - Natural Language Processing

KW - Threat Intelligence

U2 - 10.1007/978-981-99-0272-9_9

DO - 10.1007/978-981-99-0272-9_9

M3 - Conference contribution

AN - SCOPUS:85151058563

SN - 9789819902712

T3 - Communications in Computer and Information Science

SP - 129

EP - 143

BT - Ubiquitous Security - 2nd International Conference, UbiSec 2022, Revised Selected Papers

A2 - Wang, Guojun

A2 - Choo, Kim-Kwang Raymond

A2 - Wu, Jie

A2 - Damiani, Ernesto

PB - Springer Science and Business Media Deutschland GmbH

T2 - 2nd International Conference on Ubiquitous Security, UbiSec 2022

Y2 - 28 December 2022 through 31 December 2022

ER -

Zhang Z, Kumar V, Mayo M, Bifet A. Assessing Vulnerability from Its Description. In Wang G, Choo KKR, Wu J, Damiani E, editors, Ubiquitous Security - 2nd International Conference, UbiSec 2022, Revised Selected Papers. Springer Science and Business Media Deutschland GmbH. 2023. p. 129-143. (Communications in Computer and Information Science). doi: 10.1007/978-981-99-0272-9_9