ASVC: An Automatic Security Vulnerability Categorization Framework Based on Novel Features of Vulnerability Data

Abstract

Security vulnerabilities are a main cause of network security. Vulnerability classification gives us a better understanding of the essence of vulnerabilities, which help propose efficient solutions. However, applying Vulnerability Categorization Standard (VCS) to manually categorize vulnerabilities is impracticable since it is time-consuming and subjective. To address this issue, a new framework named Automatic Security Vulnerabilities Categorization Framework (ASVC) is proposed based on Text Mining. To further improve the accuracy, a new rule for extraction of features of Text Mining is proposed. ASVC abstracts the categorization of vulnerabilities into a process of Text Mining, and categorize vulnerabilities automatically according to a VCS. Finally, VCS of Common Weakness Enumeration is applied to three main Vulnerability Databases based on ASVC in a fast way, about 1000 vulnerabilities per hour. The accuracy of the categorization is 86.8%, 8.3% higher than previous works.

Toward Validation of Textual Information Retrieval Techniques for Software Weaknesses

“…Therefore, data is used from the CWE database only for the 102 weaknesses that are present also in NVD indirectly via CVE mappings. Although the present context is weaknesses, the idea here is similar to the enforcement of "one-to-one vulnerabilities" between vulnerability databases [35]. In contrast to some previous studies [10], all textual information is used for constructing the corpora.…”

“…To contribute toward sealing some of these gaps, this paper tentatively examines the validity of common textual information retrieval techniques for extracting CWEs from vulnerability databases. The extraction itself has practical value because many vulnerability databases do not catalog weaknesses, partially due to the complexity of the CWE framework and the manual work required [35]. By superseding the manual assignment of security bug reports to CWEs [8], automatic extraction can also facilitate empirical security research.…”

Security Bug Report Classification using Feature Selection, Clustering, and Deep Learning

“…Chi-squared and info gain feature selection were used to rank features for use in classifying configuration bug reports [36]. Feature selection was also used for dimensionality reduction to categorize bug reports based on CWE standards [34]. Unlike related works, this work focuses on improving the vocabulary of the feature vectors to classify software bug reports to security related and non-security related.…”

“…A successful automated identification of security bug reports has been done on NASA projects through machine learning approaches [11]. Automated classification of security bug reports has also been attempted on other datasets [30], [9], [34].…”

“…reduction on a bug report classification approach to classify bug reports based on CWE descriptions[34].5.2 Feature Selection ApproachThe process of feature selection was done using Sci-kit Lean's implementation of Selec-tKBest, chi2, and mutual info classif[29]. Mutual information is an implementation of info gain that compares two variables.…”