Research on intelligent recognition method of software vulnerability severity based on event extraction

Abstract

The number of vulnerability reports is rapidly increasing, and relying on human resources for vulnerability analysis will become more difficult. In addition, the current vulnerability report research is mainly based on general vulnerability disclosure (CVE) or other foreign open source projects, and there are few researches on Chinese vulnerability reports. With the development of deep learning, the research on event extraction has also been greatly developed. In order to contribute to the vulnerability analysis of Chinese vulnerability report, this paper adopts the method of event extraction to automatically mine the vulnerability report of the National Information security Vulnerability Sharing platform (CNVD). A new vulnerability analysis method is proposed, that is, the severity level of vulnerability report is evaluated by the vulnerability description information and the event information. At the same time, a convolutional neural network method named EICNN is proposed to realize this new vulnerability analysis method by integrating event information. An application that obtains the vulnerability reporting event information and evaluates the vulnerability severity at the end.