Weaknesses in computer systems such as faults, bugs and errors in the
architecture, design or implementation of software provide vulnerabilities that
can be exploited by attackers to compromise the security of a system. Common
Weakness Enumerations (CWE) are a hierarchically designed dictionary of
software weaknesses that provide a means to understand software flaws,
potential impact of their exploitation, and means to mitigate these flaws.
Common Vulnerabilities and Exposures (CVE) are brief low-level descriptions
that uniquely identify vulnerabilities in a specific product or protocol.
Classifying or mapping of CVEs to CWEs provides a means to understand the
impact and mitigate the vulnerabilities. Since manual mapping of CVEs is not a
viable option, automated approaches are desirable but challenging.
We present a novel Transformer-based learning framework (V2W-BERT) in this
paper. By using ideas from natural language processing, link prediction and
transfer learning, our method outperforms previous approaches not only for CWE
instances with abundant data to train, but also rare CWE classes with little or
no data to train. Our approach also shows significant improvements in using
historical data to predict links for future instances of CVEs, and therefore,
provides a viable approach for practical applications. Using data from MITRE
and National Vulnerability Database, we achieve up to 97% prediction accuracy
for randomly partitioned data and up to 94% prediction accuracy in temporally
partitioned data. We believe that our work will influence the design of better
methods and training models, as well as applications to solve increasingly
harder problems in cybersecurity.
Go to Source of this post
Author Of this post: <a href="http://arxiv.org/find/cs/1/au:+Das_S/0/1/0/all/0/1">Siddhartha Shankar Das</a>, <a href="http://arxiv.org/find/cs/1/au:+Serra_E/0/1/0/all/0/1">Edoardo Serra</a>, <a href="http://arxiv.org/find/cs/1/au:+Halappanavar_M/0/1/0/all/0/1">Mahantesh Halappanavar</a>, <a href="http://arxiv.org/find/cs/1/au:+Pothen_A/0/1/0/all/0/1">Alex Pothen</a>, <a href="http://arxiv.org/find/cs/1/au:+Al_Shaer_E/0/1/0/all/0/1">Ehab Al-Shaer</a>