Automated CPE Labeling of CVE Summaries with Machine Learning

Emil Wåreus; Martin Hell

doi:10.1007/978-3-030-52683-2_1

Automated CPE Labeling of CVE Summaries with Machine Learning

Emil Wåreus, Martin Hell

debricked AB

Research output: Chapter in Book/Report/Conference proceeding › Paper in conference proceeding › peer-review

Abstract

Open Source Security and Dependency Vulnerability Management (DVM) has become a more vital part of the software security stack in recent years as modern software tend to be more dependent on open source libraries. The largest open source of vulnerabilities is the National Vulnerability Database (NVD), which supplies developers with machine-readable vulnerabilities. However, sometimes Common Vulnerabilities and Exposures (CVE) have not been labeled with a Common Platform Enumeration (CPE) -version, -product and -vendor. This makes it very hard to automatically discover these vulnerabilities from import statements in dependency files. We, therefore, propose an automatic process of matching CVE summaries with CPEs through the machine learning task called Named Entity Recognition (NER). Our proposed model achieves an F-measure of 0.86 with a precision of 0.857 and a recall of 0.865, outperforming previous research for automated CPE-labeling of CVEs.

Original language	English
Title of host publication	Detection of Intrusions and Malware, and Vulnerability Assessment - 17th International Conference, DIMVA 2020, Proceedings
Editors	Clémentine Maurice, Leyla Bilge, Gianluca Stringhini, Nuno Neves
Publisher	Springer
Pages	3-22
Number of pages	20
ISBN (Print)	9783030526825
DOIs	https://doi.org/10.1007/978-3-030-52683-2_1
Publication status	Published - 2020
Event	17th International Conference on Detection of Intrusions and Malware, and Vulnerability Assessment, DIMVA 2020 - Lisbon, Portugal Duration: 2020 Jun 24 → 2020 Jun 26

Publication series

Name	Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)
Volume	12223 LNCS
ISSN (Print)	0302-9743
ISSN (Electronic)	1611-3349

Conference

Conference	17th International Conference on Detection of Intrusions and Malware, and Vulnerability Assessment, DIMVA 2020
Country/Territory	Portugal
City	Lisbon
Period	2020/06/24 → 2020/06/26

Subject classification (UKÄ)

Software Engineering

Free keywords

CPE
CVE
Machine learning
Open source
Vulnerabilities

Access to Document

10.1007/978-3-030-52683-2_1

SMARTY: Säkra mjukvaruuppdateringar för den smarta staden
Hell, M. (PI), Magnusson, B. (PI), Gehrmann, C. (CoI), Paladi, N. (Researcher), Karlsson, L. (Researcher), Sönnerup, J. (Researcher), Johnsson, B. A. (Researcher), Hedin, G. (Researcher), Nordahl, M. (Researcher), Pagnin, E. (Researcher), Kundu, R. (Researcher), Åkesson, A. (Researcher), Stankovski Wagner, P. (Researcher) & Ramezanian, S. (Researcher)
Swedish Foundation for Strategic Research, SSF
2018/03/01 → 2024/12/31
Project: Research

Cite this

Wåreus, E., & Hell, M. (2020). Automated CPE Labeling of CVE Summaries with Machine Learning. In C. Maurice, L. Bilge, G. Stringhini, & N. Neves (Eds.), Detection of Intrusions and Malware, and Vulnerability Assessment - 17th International Conference, DIMVA 2020, Proceedings (pp. 3-22). (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics); Vol. 12223 LNCS). Springer. https://doi.org/10.1007/978-3-030-52683-2_1

Wåreus, Emil ; Hell, Martin. / Automated CPE Labeling of CVE Summaries with Machine Learning. Detection of Intrusions and Malware, and Vulnerability Assessment - 17th International Conference, DIMVA 2020, Proceedings. editor / Clémentine Maurice ; Leyla Bilge ; Gianluca Stringhini ; Nuno Neves. Springer, 2020. pp. 3-22 (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)).

@inproceedings{55a6bc3597e04b67b7c8a4c0c9bedf77,

title = "Automated CPE Labeling of CVE Summaries with Machine Learning",

abstract = "Open Source Security and Dependency Vulnerability Management (DVM) has become a more vital part of the software security stack in recent years as modern software tend to be more dependent on open source libraries. The largest open source of vulnerabilities is the National Vulnerability Database (NVD), which supplies developers with machine-readable vulnerabilities. However, sometimes Common Vulnerabilities and Exposures (CVE) have not been labeled with a Common Platform Enumeration (CPE) -version, -product and -vendor. This makes it very hard to automatically discover these vulnerabilities from import statements in dependency files. We, therefore, propose an automatic process of matching CVE summaries with CPEs through the machine learning task called Named Entity Recognition (NER). Our proposed model achieves an F-measure of 0.86 with a precision of 0.857 and a recall of 0.865, outperforming previous research for automated CPE-labeling of CVEs.",

keywords = "CPE, CVE, Machine learning, Open source, Vulnerabilities",

author = "Emil W{\aa}reus and Martin Hell",

year = "2020",

doi = "10.1007/978-3-030-52683-2_1",

language = "English",

isbn = "9783030526825",

series = "Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)",

publisher = "Springer",

pages = "3--22",

editor = "Cl{\'e}mentine Maurice and Leyla Bilge and Gianluca Stringhini and Nuno Neves",

booktitle = "Detection of Intrusions and Malware, and Vulnerability Assessment - 17th International Conference, DIMVA 2020, Proceedings",

address = "Germany",

note = "17th International Conference on Detection of Intrusions and Malware, and Vulnerability Assessment, DIMVA 2020 ; Conference date: 24-06-2020 Through 26-06-2020",

}

Wåreus, E & Hell, M 2020, Automated CPE Labeling of CVE Summaries with Machine Learning. in C Maurice, L Bilge, G Stringhini & N Neves (eds), Detection of Intrusions and Malware, and Vulnerability Assessment - 17th International Conference, DIMVA 2020, Proceedings. Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics), vol. 12223 LNCS, Springer, pp. 3-22, 17th International Conference on Detection of Intrusions and Malware, and Vulnerability Assessment, DIMVA 2020, Lisbon, Portugal, 2020/06/24. https://doi.org/10.1007/978-3-030-52683-2_1

Automated CPE Labeling of CVE Summaries with Machine Learning. / Wåreus, Emil; Hell, Martin.
Detection of Intrusions and Malware, and Vulnerability Assessment - 17th International Conference, DIMVA 2020, Proceedings. ed. / Clémentine Maurice; Leyla Bilge; Gianluca Stringhini; Nuno Neves. Springer, 2020. p. 3-22 (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics); Vol. 12223 LNCS).

Research output: Chapter in Book/Report/Conference proceeding › Paper in conference proceeding › peer-review

TY - GEN

T1 - Automated CPE Labeling of CVE Summaries with Machine Learning

AU - Wåreus, Emil

AU - Hell, Martin

PY - 2020

Y1 - 2020

N2 - Open Source Security and Dependency Vulnerability Management (DVM) has become a more vital part of the software security stack in recent years as modern software tend to be more dependent on open source libraries. The largest open source of vulnerabilities is the National Vulnerability Database (NVD), which supplies developers with machine-readable vulnerabilities. However, sometimes Common Vulnerabilities and Exposures (CVE) have not been labeled with a Common Platform Enumeration (CPE) -version, -product and -vendor. This makes it very hard to automatically discover these vulnerabilities from import statements in dependency files. We, therefore, propose an automatic process of matching CVE summaries with CPEs through the machine learning task called Named Entity Recognition (NER). Our proposed model achieves an F-measure of 0.86 with a precision of 0.857 and a recall of 0.865, outperforming previous research for automated CPE-labeling of CVEs.

AB - Open Source Security and Dependency Vulnerability Management (DVM) has become a more vital part of the software security stack in recent years as modern software tend to be more dependent on open source libraries. The largest open source of vulnerabilities is the National Vulnerability Database (NVD), which supplies developers with machine-readable vulnerabilities. However, sometimes Common Vulnerabilities and Exposures (CVE) have not been labeled with a Common Platform Enumeration (CPE) -version, -product and -vendor. This makes it very hard to automatically discover these vulnerabilities from import statements in dependency files. We, therefore, propose an automatic process of matching CVE summaries with CPEs through the machine learning task called Named Entity Recognition (NER). Our proposed model achieves an F-measure of 0.86 with a precision of 0.857 and a recall of 0.865, outperforming previous research for automated CPE-labeling of CVEs.

KW - CPE

KW - CVE

KW - Machine learning

KW - Open source

KW - Vulnerabilities

U2 - 10.1007/978-3-030-52683-2_1

DO - 10.1007/978-3-030-52683-2_1

M3 - Paper in conference proceeding

AN - SCOPUS:85088508164

SN - 9783030526825

T3 - Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)

SP - 3

EP - 22

BT - Detection of Intrusions and Malware, and Vulnerability Assessment - 17th International Conference, DIMVA 2020, Proceedings

A2 - Maurice, Clémentine

A2 - Bilge, Leyla

A2 - Stringhini, Gianluca

A2 - Neves, Nuno

PB - Springer

T2 - 17th International Conference on Detection of Intrusions and Malware, and Vulnerability Assessment, DIMVA 2020

Y2 - 24 June 2020 through 26 June 2020

ER -

Wåreus E, Hell M. Automated CPE Labeling of CVE Summaries with Machine Learning. In Maurice C, Bilge L, Stringhini G, Neves N, editors, Detection of Intrusions and Malware, and Vulnerability Assessment - 17th International Conference, DIMVA 2020, Proceedings. Springer. 2020. p. 3-22. (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)). doi: 10.1007/978-3-030-52683-2_1

Automated CPE Labeling of CVE Summaries with Machine Learning

Abstract

Publication series

Conference

Subject classification (UKÄ)

Free keywords

Access to Document

Fingerprint

Projects

SMARTY: Säkra mjukvaruuppdateringar för den smarta staden

Cite this