Common vulnerability scoring system prediction based on open source intelligence information sources

doi:10.1016/j.cose.2023.103286

2023-08-01

Philipp Kühn *

David N. Relke

Christian Reuter

DOI：10.1016/j.cose.2023.103286

原文链接

查看原文

摘要

En 中文

The number of newly published vulnerabilities is constantly increasing. Until now, the information avail-able when a new vulnerability is published is manually assessed by experts using a Common Vulnera-bility Scoring System (CVSS) vector and score. This assessment is time consuming and requires expertise. Various works already try to predict CVSS vectors or scores using machine learning based on the textual descriptions of the vulnerability to enable faster assessment. However, for this purpose, previous works only use the texts available in databases such as National Vulnerability Database. With this work, the publicly available web pages referenced in the National Vulnerability Database are analyzed and made available as sources of texts through web scraping. A Deep Learning based method for predicting the CVSS vector is implemented and evaluated. The present work provides a classification of the National Vulnerability Database's reference texts based on the suitability and crawlability of their texts. While we identified the overall influence of the additional texts is negligible, we outperformed the state-of-the-art with our Deep Learning prediction models.(c) 2023 Elsevier Ltd. All rights reserved.

Keyword:

IT Security

Common vulnerability scoring system

Classification

National vulnerability database

Security management

Deep learning