Automation of Vulnerability Classification from its Description using Machine Learning

被引：34
作者：
Aota, Masaki [1 ,2 ]
Kanehara, Hideaki [1 ,2 ]
Kubo, Masaki [1 ]
Murata, Noboru [1 ,2 ]
Sun, Bo [1 ]
Takahashi, Takeshi [1 ]
机构：
[1] Natl Inst Informat & Commun Technol, Tokyo, Japan
[2] Waseda Univ, Tokyo, Japan
来源：
2020 IEEE SYMPOSIUM ON COMPUTERS AND COMMUNICATIONS (ISCC) | 2020年
基金：
日本学术振兴会;
关键词：
vulnerability; vulnerability type; machine-learning; security automation; security advisory;
D O I：
10.1109/iscc50000.2020.9219568
中图分类号：
TP [自动化技术、计算机技术];
学科分类号：
0812 ;
摘要：
Vulnerability reports play an important role in cybersecurity. Mitigation of software vulnerabilities that can be exploited by attackers depends on disclosure of vulnerabilities. Information on vulnerability types or identifiers facilitates automation of vulnerability management, statistical analysis of vulnerability trends, and secure software development. Labeling of reports with vulnerability identifiers has thus far been performed manually and has therefore suffered from human-induced errors and scalability issues due to the shortage of security experts. In this paper, we propose a scheme that automatically classifies each vulnerability description by type using machine learning. We experimentally demonstrated the performance of our proposed scheme compared to other algorithms, analyzed cases of misclassification, and revealed the potential for numerous human errors. We experimentally demonstrated the performance of the proposed scheme in comparison with other algorithms, analyzed cases of misclassification, and revealed the potential for numerous human errors. Furthermore, we tried to correct these errors.
引用
收藏
页码：26 / 32
页数：7
相关论文
共 21 条
[11]   Random forests [J].
Breiman, L .
MACHINE LEARNING, 2001, 45 (01) :5-32
[12]  
Common vulnerabilities and exposures, 2014, COMM VULN EXP, P1520
[13]  
Common weakness enumeration, 2012, ITU T RECOMMENDATION, P1524
[14]  
Han ZB, 2018, 2018 25TH IEEE INTERNATIONAL CONFERENCE ON SOFTWARE ANALYSIS, EVOLUTION AND REENGINEERING (SANER 2018), P456, DOI 10.1109/SANER.2018.8330232
[15]   Learning to Predict Severity of Software Vulnerability Using Only Vulnerability Description [J].
Han, Zhuobing ;
Li, Xiaohong ;
Xing, Zhenchang ;
Liu, Hongtao ;
Feng, Zhiyong .
2017 IEEE INTERNATIONAL CONFERENCE ON SOFTWARE MAINTENANCE AND EVOLUTION (ICSME), 2017, :125-136
[16]  
Ke GL, 2017, ADV NEUR IN, V30
[17]   Boruta - A System for Feature Selection [J].
Kursa, Miron B. ;
Jankowski, Aleksander ;
Rudnicki, Witold R. .
FUNDAMENTA INFORMATICAE, 2010, 101 (04) :271-286
[18]  
Li Zhenmin, 2006, P 1 WORKSHOP ARCHITE
[19]  
Na S., STUDY CLASSIFICATION
[20]  
Pedregosa F, 2011, J MACH LEARN RES, V12, P2825
123