Assessing Vulnerability from Its Description - Archive ouverte HAL Accéder directement au contenu
Communication Dans Un Congrès Année : 2022

Assessing Vulnerability from Its Description

Résumé

This paper shows an end-to-end Artificial Intelligence (AI) system to estimate the severity level and the various Common Vulnerability Scoring System (CVSS) components from natural language descriptions without reproducing the vulnerability. This natural language processing-based approach can estimate the CVSS from only the Common Vulnerabilities and Exposures description without the need to reproduce the vulnerability environment. We present an Error Grid Analysis for the CVSS base score prediction task. Experiments on CVSS 2.0 and CVSS 3.1 show that state-of-the-art deep learning models can predict the CVSS scoring components with high accuracy. The low-cost Universal Sentence Encoder (large) model outperforms the Generative Pre-trained Transformer-3 (GPT-3) and the Support Vector Machine baseline on the majority of the classification tasks with a lower computation overhead than the GPT-3.
Fichier non déposé

Dates et versions

hal-04468407 , version 1 (20-02-2024)

Identifiants

Citer

Zijing Zhang, Vimal Kumar, Michael Mayo, Albert Bifet. Assessing Vulnerability from Its Description. Ubiquitous Security - Second International Conference, UbiSec 2022, Zhangjiajie, China, December 28-31, 2022, Revised Selected Papers, Dec 2022, Zhangjiajie, China. pp.129--143, ⟨10.1007/978-981-99-0272-9_9⟩. ⟨hal-04468407⟩
14 Consultations
0 Téléchargements

Altmetric

Partager

Gmail Mastodon Facebook X LinkedIn More