论文标题
预测漏洞报告中关键方面的缺失信息
Predicting Missing Information of Key Aspects in Vulnerability Reports
论文作者
论文摘要
软件漏洞已不断披露和记录。记录漏洞的一个重要做法是描述关键漏洞方面，例如漏洞类型，根本原因，受影响的产品，影响，攻击者类型和攻击向量，以有效地搜索和管理快速增长的漏洞。我们在过去20年中调查了120,103个漏洞报告（CVE）。我们发现，CVE的56％，85％，38％和28％分别遗漏了脆弱性类型，根本原因，攻击向量和攻击者类型。为了帮助完成这些脆弱性方面的缺失信息，我们提出了一种基于神经网络的方法，用于根据脆弱性的已知方面来预测脆弱性的关键方面的缺失信息。我们探索神经网络模型的设计空间，并从经验上确定最有效的模型设计。使用CVE的大规模漏洞数据\ -ET，我们表明我们可以有效地培训基于神经网络的分类器，其中不到20％的历史CVE。我们的模型分别实现了漏洞类型，根本原因，攻击者类型和攻击向量的预测准确性94％，79％，89％和70％。我们的消融研究揭示了脆弱性方面的显着相关性，并进一步证实了我们方法的实用性。
Software vulnerabilities have been continually disclosed and documented. An important practice in documenting vulnerabilities is to describe the key vulnerability aspects, such as vulnerability type, root cause, affected product, impact, attacker type and attack vector, for the effective search and management of fast-growing vulnerabilities. We investigate 120,103 vulnerability reports in the Common Vulnerabilities and Exposures (CVE) over the past 20 years. We find that 56%, 85%, 38% and 28% of CVEs miss vulnerability type, root causes, attack vector and attacker type respectively. To help to complete the missing information of these vulnerability aspects, we propose a neural-network based approach for predicting the missing information of a key aspect of a vulnerability based on the known aspects of the vulnerability. We explore the design space of the neural network models and empirically identify the most effective model design. Using a large-scale vulnerability datas\-et from CVE, we show that we can effectively train a neural-network based classifier with less than 20% of historical CVEs. Our model achieves the prediction accuracy 94%, 79%, 89%and 70% for vulnerability type, root cause, attacker type and attack vector, respectively. Our ablation study reveals the prominent correlations among vulnerability aspects and further confirms the practicality of our approach.
