Tags:cve entry, feature selection, machine learning, nvd cwe slice, random forest, security advisory, security automation, software vulnerability, software weakness, vulnerability and vulnerability type
Abstract:
Vulnerability reports play an important role in cybersecurity. Mitigation of software vulnerabilities that can be exploited by attackers depends on the disclosure of vulnerabilities. Information regarding the vulnerability type or identifiers facilitates the automation of vulnerability management, statistical analysis of vulnerability trends, and secure software development. Labeling reports with vulnerability identifiers has been manually conducted and thus, has suffered from human errors and scalability issues owing to the shortage of security experts. In this paper, we proposed a scheme that automatically classifies each vulnerability description by type using machine learning. Through experiments, we demonstrated the performance of the proposed scheme in comparison with other algorithms, analyzed cases of misclassification, and showed the potential for numerous human errors. Furthermore, we tried to correct these errors.
Automating Vulnerability Classification from Description using Machine Learning