Vulnerability Severity Prediction With Deep Neural Network

Li, Kai; Zhou, Yun; Wang, Qingyong; Zhu, Xianqiang

doi:10.1109/bigdia.2019.8802851

Cited by 16 publications

(6 citation statements)

References 19 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…CNNs are capable of capturing local dependencies and structural features within sentences or documents. Our research indicates their suitability for highly structured sequential data tasks like vulnerability prediction, and some studies have already achieved certain results [8]. We have defined a one-dimensional CNN layer with 256 filters and a kernel size of 3x3 after the lightweight Transformer block to capture local patterns from the Transformer layer's output, enhancing the model's ability to recognize structural patterns in source code, such as indentation patterns and bracket matching.…”

Section: Cnnmentioning

confidence: 99%

“…In recent years, research on vulnerability prediction technology has made significant progress. Researchers use various machine learning algorithms to try to predict potential vulnerabilities from a large number of software attributes, such as using Decision Tree [6], SVM [7], and traditional machine learning techniques such as neural networks [8]. However, existing methods often face difficulties in identifying minority category vulnerabilities when dealing with highly unbalanced real-world vulnerability datasets, and traditional deep learning and machine learning methods cannot fully learn vulnerability features [9].…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Elevating Security Analysis: The MTLPT Framework for Enhanced Vulnerability Prediction

HUI,

LIU,

CHEN

et al. 2024

Preprint

View full text Add to dashboard Cite

In the current field of vulnerability prediction, accurate forecasting and identification of potential vulnerabilities in software are crucial, especially when dealing with real-world vulnerability data. The challenges posed by data imbalance and complex dependency relationships often make prediction tasks exceptionally difficult. Traditional single-task learning methods and ensemble learning methods typically perform poorly when handling highly imbalanced datasets. These methods often overlook minority categories, which frequently contain the most critical vulnerabilities, and fail to fully learn vulnerability features. To address these issues, we propose a novel multi-task learning model called MTLPT, aimed at enhancing the accuracy and efficiency of vulnerability prediction through a multi-task learning framework. The MTLPT model combines custom lightweight Transformer blocks and position encoding layers to effectively capture long-range dependencies and complex contextual information from source code. With this structural design, MTLPT can simultaneously handle various vulnerability prediction tasks, thereby learning the latent relationships between different vulnerability types and improving the model’s sensitivity to rare but severe vulnerabilities. Additionally, the MTLPT model introduces a loss function based on dynamic weights, which dynamically adjusts loss weights based on the prediction difficulty of different tasks, effectively mitigating the challenges posed by imbalanced data. We conducted comparative experiments on a subset of highly imbalanced real-world vulnerability dataset. The experimental results demonstrate that, compared to existing single-task learning and ensemble learning methods, MTLPT exhibits significant advantages across multiple key performance metrics, particularly in identifying minority class vulnerabilities with higher sensitivity and accuracy. This performance enhancement validates the effectiveness of our proposed multi-task learning framework in handling complex and imbalanced vulnerability data, highlighting the importance of the MTLPT framework, custom lightweight Transformer blocks, position encoding layers, and the dynamic weight loss function in practical applications. Furthermore, we conducted a series of ablation experiments to thoroughly evaluate the contributions of individual components within the MTLPT model, confirming the role of custom lightweight Transformer blocks and position encoding layers in enhancing the model’s ability to learn complex code structures and behavioral patterns, while also demonstrating the critical role of the dynamic weight loss function in optimizing the training process of the multi-task learning model.

show abstract

Section: Cnnmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Elevating Security Analysis: The MTLPT Framework for Enhanced Vulnerability Prediction

HUI,

LIU,

CHEN

et al. 2024

Preprint

View full text Add to dashboard Cite

show abstract

“…Te model-based approach, on the other hand, hopes to take advantage of machine learning algorithms to automatically extract features through algorithms to avoid the bias brought about by manual extraction of features, and the main idea is to characterize and classify vulnerability description statements based on machine learning methods. Khazaei et al [25], Wang et al [28], Han et al [29], and Liu et al [30] have characterized vulnerability descriptions using traditional wordvector algorithms. However, such methods do not consider contextual information, which may contain rich information that could enhance the fnal prediction.…”

Section: Related Workmentioning

confidence: 99%

VulDistilBERT: A CPS Vulnerability Severity Prediction Method Based on Distillation Model

Kai

Shi

Zheng

2023

Security and Communication Networks

View full text Add to dashboard Cite

With the vigorous development of the Internet, the ecosystem of cyber-physical systems is also developing at a high speed, but cyber-physical systems may be accompanied by unknown vulnerabilities in the process of concrete implementation. Thus, the number of vulnerabilities in cyber-physical systems has been increasing year by year. The vulnerability evaluation speed cannot keep up with the vulnerability exposure speed. The traditional manual evaluation method can no longer effectively deal with such large-scale vulnerabilities, resulting in a backlog of vulnerabilities. Therefore, the vulnerability evaluation results have a certain lag. To address this problem, the paper proposes a vulnerability severity assessment method based on the distillation model. The method first uses data augmentation and integration of optimal subsets to improve the amount of information in the vulnerability description text, then uses the DistilBERT model to characterize the text of the vulnerability description text, and then the characterized feature vectors are classified based on the linear layer to achieve the purpose of assessing vulnerability severity. Compared with the current method of manual assessment based on the CVSS metric system, this method can automate the assessment of vulnerabilities based on vulnerability description text, which improves the speed of vulnerability assessment, and the assessment accuracy and other metrics achieved by this method are improved compared with similar studies. This approach provides an automated solution for cyber-physical systems vulnerability assessment and can better address the current situation where cyber-physical systems vulnerabilities are being exposed at an accelerated rate.

show abstract

“…LGBM [90] and Random forest) outperformed single models (e.g., Naïve Bayes, KNN and SVM) for this task. Predicting severity levels has also been tackled with DL techniques [114,166] such as Recurrent Convolutional Neural Network (RCNN) [103], Convolutional Neural Network (CNN) [94], Long-Short Term Memory (LSTM) [75]. These studies showed potential performance gain of DL models compared to traditional ML counterparts.…”

Section: Severity Levelsmentioning

confidence: 99%

A Survey on Data-driven Software Vulnerability Assessment and Prioritization

Le¹,

Chen²,

Babar³

2021

Preprint

View full text Add to dashboard Cite

Software Vulnerabilities (SVs) are increasing in complexity and scale, posing great security risks to many software systems. Given the limited resources in practice, SV assessment and prioritization help practitioners devise optimal SV mitigation plans based on various SV characteristics. The surge in SV data sources and datadriven techniques such as Machine Learning and Deep Learning have taken SV assessment and prioritization to the next level. Our survey provides a taxonomy of the past research efforts and highlights the best practices for data-driven SV assessment and prioritization. We also discuss the current limitations and propose potential solutions to address such issues. CCS Concepts: • General and reference → Surveys and overviews; • Security and privacy → Software security engineering; • Computing methodologies → Machine learning; Neural networks;

show abstract

Vulnerability Severity Prediction With Deep Neural Network

Cited by 16 publications

References 19 publications

Elevating Security Analysis: The MTLPT Framework for Enhanced Vulnerability Prediction

Elevating Security Analysis: The MTLPT Framework for Enhanced Vulnerability Prediction

VulDistilBERT: A CPS Vulnerability Severity Prediction Method Based on Distillation Model

A Survey on Data-driven Software Vulnerability Assessment and Prioritization

Contact Info

Product

Resources

About