V2W-BERT: A Framework for Effective Hierarchical Multiclass Classification of Software Vulnerabilities.

摘要: Weaknesses in computer systems such as faults, bugs and errors the architecture, design or implementation of software provide vulnerabilities that can be exploited by attackers to compromise security a system. Common Weakness Enumerations (CWE) are hierarchically designed dictionary weaknesses means understand flaws, potential impact their exploitation, mitigate these flaws. Vulnerabilities Exposures (CVE) brief low-level descriptions uniquely identify specific product protocol. Classifying mapping CVEs CWEs provides vulnerabilities. Since manual is not viable option, automated approaches desirable but challenging. We present novel Transformer-based learning framework (V2W-BERT) this paper. By using ideas from natural language processing, link prediction transfer learning, our method outperforms previous only for CWE instances with abundant data train, also rare classes little no train. Our approach shows significant improvements historical predict links future CVEs, therefore, practical applications. Using MITRE National Vulnerability Database, we achieve up 97% accuracy randomly partitioned 94% temporally data. We believe work will influence better methods training models, well applications solve increasingly harder problems cybersecurity.