Severity Prediction of Software Vulnerabilities Using Textual Data

Malhotra, Ruchika; Vidushi,

doi:10.1007/978-981-15-7234-0_41

Cited by 7 publications

(5 citation statements)

References 12 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…They also estimated the CVSS scores in three categories, with an average success rate of 87%. Malthotra et al [23], using textual descriptions of the vulnerabilities, they estimated their severity. They used chisquare and information acquisition methods with different classification algorithms.…”

Section: Related Workmentioning

confidence: 99%

A Multiclass Approach to Estimating Software Vulnerability Severity Rating with Statistical and Word Embedding Methods

KEKÜL¹,

Ergen²,

Arslan³

2022

IJCNIS

View full text Add to dashboard Cite

The analysis and grading of software vulnerabilities is an important process that is done manually by experts today. For this reason, there are time delays, human errors, and excessive costs involved with the process. The final result of these software vulnerability reports created by experts is the calculation of a severity score and a severity rating. The severity rating is the first and foremost value of the software’s vulnerability. The vulnerabilities that can be exploited are only 20% of the total vulnerabilities. The vast majority of exploitations take place within the first two weeks. It is therefore imperative to determine the severity rating without time delays. Our proposed model uses statistical methods and deep learning-based word embedding methods from natural language processing techniques, and machine learning algorithms that perform multi-class classification. Bag of Words, Term Frequency Inverse Document Frequency and Ngram methods, which are statistical methods, were used for feature extraction. Word2Vec, Doc2Vec and Fasttext algorithms are included in the study for deep learning based Word embedding. In the classification stage, Naive Bayes, Decision Tree, K-Nearest Neighbors, Multi-Layer Perceptron, and Random Forest algorithms that can make multi-class classification were preferred. With this aspect, our model proposes a hybrid method. The database used is open to the public and is the most reliable data set in the field. The results obtained in our study are quite promising. By helping experts in this field, procedures will speed up. In addition, our study is one of the first studies containing the latest version of the data size and scoring systems it covers.

show abstract

Section: Related Workmentioning

confidence: 99%

A Multiclass Approach to Estimating Software Vulnerability Severity Rating with Statistical and Word Embedding Methods

KEKÜL¹,

Ergen²,

Arslan³

2022

IJCNIS

View full text Add to dashboard Cite

show abstract

“…Malhotra et al [17], used the definitions of Apache Tomcat vulnerabilities as input, reducing the data size using chi-square and information gain methods. They estimated the severity of security vulnerabilities with the data sets they created.…”

Section: Related Workmentioning

confidence: 99%

“…Kekül et al [17] examined in detail and systematically the databases that were used in the literature, that were not out of date, and that were open to access. In this study, they compared seven different databases available to researchers.…”

Section: Software Vulnerability Databasesmentioning

confidence: 99%

Estimating Missing Security Vectors in NVD Database Security Reports

KEKÜL¹,

Ergen²,

Arslan³

2022

IJEM

View full text Add to dashboard Cite

Detection and analysis of software vulnerabilities is a very important consideration. For this reason, software security vulnerabilities that have been identified for many years are listed and tried to be classified. Today, this process, performed manually by experts, takes time and is costly. Many methods have been proposed for the reporting and classification of software security vulnerabilities. Today, for this purpose, the Common Vulnerability Scoring System is officially used. The scoring system is constantly updated to cover the different security vulnerabilities included in the system, along with the changing security perception and newly developed technologies. Different versions of the scoring system are used with vulnerability reports. In order to add new versions of the published scoring system to the old vulnerability reports, all analyzes must be done manually backwards in accordance with the new security framework. This is a situation that requires a lot of resources, time and expert skill. For this reason, there are large deficiencies in the values of vulnerability scoring systems in the database. The aim of this study is to estimate missing security metrics of vulnerability reports using natural language processing and machine learning algorithms. For this purpose, a model using term frequency inverse document frequency and K-Nearest Neighbors algorithms is proposed. In addition, the obtained data was presented to the use of researchers as a new database. The results obtained are quite promising. A publicly available database was chosen as the data set that all researchers accepted as a reference. This approach facilitates the evaluation and analysis of our model. This study was performed with the largest dataset size available from this database to the best of our knowledge and is one of the limited studies on the latest version of the official scoring system published for classification of software security vulnerabilities. Due to the mentioned issues, our study is a comprehensive and original study in the field.

show abstract

“…Besides investigating feature extraction, Kudjo et al [99] also highlighted the possibility of finding Bellwether, i.e., the smallest set of data that can be used to train an optimal prediction model, for classifying severity. Recently, Malhotra et al [115] revisited this task by showing that Chi-square and information gain can be effective dimensionality reduction techniques for multiple classifiers, i.e., bagging technique, Random forest, Naïve Bayes and SVM.…”

Section: Severe Vs Non-severementioning

confidence: 99%

A Survey on Data-driven Software Vulnerability Assessment and Prioritization

Le¹,

Chen²,

Babar³

2021

Preprint

View full text Add to dashboard Cite

Software Vulnerabilities (SVs) are increasing in complexity and scale, posing great security risks to many software systems. Given the limited resources in practice, SV assessment and prioritization help practitioners devise optimal SV mitigation plans based on various SV characteristics. The surge in SV data sources and datadriven techniques such as Machine Learning and Deep Learning have taken SV assessment and prioritization to the next level. Our survey provides a taxonomy of the past research efforts and highlights the best practices for data-driven SV assessment and prioritization. We also discuss the current limitations and propose potential solutions to address such issues. CCS Concepts: • General and reference → Surveys and overviews; • Security and privacy → Software security engineering; • Computing methodologies → Machine learning; Neural networks;

show abstract

Severity Prediction of Software Vulnerabilities Using Textual Data

Cited by 7 publications

References 12 publications

A Multiclass Approach to Estimating Software Vulnerability Severity Rating with Statistical and Word Embedding Methods

A Multiclass Approach to Estimating Software Vulnerability Severity Rating with Statistical and Word Embedding Methods

Estimating Missing Security Vectors in NVD Database Security Reports

A Survey on Data-driven Software Vulnerability Assessment and Prioritization

Contact Info

Product

Resources

About