A Multiclass Approach to Estimating Software Vulnerability Severity Rating with Statistical and Word Embedding Methods

Abstract

The analysis and grading of software vulnerabilities is an important process that is done manually by experts today. For this reason, there are time delays, human errors, and excessive costs involved with the process. The final result of these software vulnerability reports created by experts is the calculation of a severity score and a severity rating. The severity rating is the first and foremost value of the software’s vulnerability. The vulnerabilities that can be exploited are only 20% of the total vulnerabilities. The vast majority of exploitations take place within the first two weeks. It is therefore imperative to determine the severity rating without time delays. Our proposed model uses statistical methods and deep learning-based word embedding methods from natural language processing techniques, and machine learning algorithms that perform multi-class classification. Bag of Words, Term Frequency Inverse Document Frequency and Ngram methods, which are statistical methods, were used for feature extraction. Word2Vec, Doc2Vec and Fasttext algorithms are included in the study for deep learning based Word embedding. In the classification stage, Naive Bayes, Decision Tree, K-Nearest Neighbors, Multi-Layer Perceptron, and Random Forest algorithms that can make multi-class classification were preferred. With this aspect, our model proposes a hybrid method. The database used is open to the public and is the most reliable data set in the field. The results obtained in our study are quite promising. By helping experts in this field, procedures will speed up. In addition, our study is one of the first studies containing the latest version of the data size and scoring systems it covers.

Software vulnerability detection method based on code attribute graph presentation and Bi-LSTM neural network extraction

“…This section mainly compares the time performance of VDCPG with the methods proposed by Lin et al [8], Jacob A et al [14], Canan Batur et al [15], X Cheng et al [16], SM Ghaffarian et al [17] and W Jian et al [18]. As can be seen from Table 8, Compared with other methods, the time cost of this method is mainly in the model pretreatment stage and training stage, and the time difference in the detection stage is little.…”

“…In the model pretreatment stage and the model training stage, VDCPG can directly input the code files in the project without segmentation, so the time required is shorter compared with other models. [8] 181 1041 35 Jacob A et al [14] 257 1124 54 Canan Batur et al [15] 149 1073 47 X Cheng et al [16] 381 975 59 SM Ghaffarian et al [17] 203 492 65 W Jian et al [18] 196 885 43 VDCPG 117 489 30…”