Cybersecurity Defenses: Exploration of CVE Types through Attack
Descriptions

D 2024

Cybersecurity Defenses: Exploration of CVE Types through Attack Descriptions

OTHMAN, Refat T A; Bruno ROSSI a Barbara RUSSO

Základní údaje

Originální název

Cybersecurity Defenses: Exploration of CVE Types through Attack Descriptions

Autoři

OTHMAN, Refat T A (275 Palestina); Bruno ROSSI (380 Itálie, garant, domácí) a Barbara RUSSO (380 Itálie)

Vydání

Not specified, 50th Euromicro Conference Series on Software Engineering and Advanced Applications (SEAA), od s. 415-418, 4 s. 2024

Nakladatel

IEEE

Další údaje

Jazyk

angličtina

Typ výsledku

Stať ve sborníku

Obor

10200 1.2 Computer and information sciences

Stát vydavatele

Spojené státy

Utajení

není předmětem státního či obchodního tajemství

Forma vydání

elektronická verze "online"

Kód RIV

RIV/00216224:14330/24:00136512

Organizační jednotka

Fakulta informatiky

ISBN

979-8-3503-8026-2

ISSN

DOI

https://doi.org/10.1109/SEAA64295.2024.00069

UT WoS

001413352200059

EID Scopus

2-s2.0-85199594242

Klíčová slova anglicky

MITRE; CAPEC; CVE; Transformer models; Pretrained language models

Štítky

core_B, firank_B

Příznaky

Mezinárodní význam, Recenzováno

Změněno: 21. 3. 2025 15:03, doc. Bruno Rossi, PhD

Anotace

V originále

Vulnerabilities in software security can remain undiscovered even after being exploited. Linking attacks to vulnerabilities helps experts identify and respond promptly to the incident. This paper introduces VULDAT, a classification tool using a sentence transformer MPNET to identify system vulnerabilities from attack descriptions. Our model was applied to 100 attack techniques from the ATT&CK repository and 685 issues from the CVE repository. Then, we compare the performance of VULDAT against the other eight state-of-the-art classifiers based on sentence transformers. Our findings indicate that our model achieves the best performance with F1 score of 0.85, Precision of 0.86, and Recall of 0.83. Furthermore, we found 56% of CVE reports vulnerabilities associated with an attack were identified by VULDAT, and 61% of identified vulnerabilities were in the CVE repository.

Citovat

OTHMAN, Refat T A; Bruno ROSSI a Barbara RUSSO. Cybersecurity Defenses: Exploration of CVE Types through Attack Descriptions. Online. In 50th Euromicro Conference Series on Software Engineering and Advanced Applications (SEAA). Not specified: IEEE, 2024, s. 415-418. ISBN 979-8-3503-8026-2. Dostupné z: https://doi.org/10.1109/SEAA64295.2024.00069.

@inproceedings{2418565,
   author = {Othman, Refat T A and Rossi, Bruno and Russo, Barbara},
   address = {Not specified},
   booktitle = {50th Euromicro Conference Series on Software Engineering and Advanced Applications (SEAA)},
   doi = {https://doi.org/10.1109/SEAA64295.2024.00069},
   keywords = {MITRE; CAPEC; CVE; Transformer models; Pretrained language models},
   howpublished = {elektronická verze "online"},
   language = {eng},
   location = {Not specified},
   isbn = {979-8-3503-8026-2},
   pages = {415-418},
   publisher = {IEEE},
   title = {Cybersecurity Defenses: Exploration of CVE Types through Attack Descriptions},
   year = {2024}
}

TY  - CONF
ID  - 2418565
AU  - Othman, Refat T A - Rossi, Bruno - Russo, Barbara
PY  - 2024
TI  - Cybersecurity Defenses: Exploration of CVE Types through Attack Descriptions
PB  - IEEE
CY  - Not specified
SN  - 9798350380262
KW  - MITRE
KW  - CAPEC
KW  - CVE
KW  - Transformer models
KW  - Pretrained language models
N2  - Vulnerabilities in software security can remain undiscovered even after being exploited. Linking attacks to vulnerabilities helps experts identify and respond promptly to the incident. This paper introduces VULDAT, a classification tool using a sentence transformer MPNET to identify system vulnerabilities from attack descriptions. Our model was applied to 100 attack techniques from the ATT&CK repository and 685 issues from the CVE repository. Then, we compare the performance of VULDAT against the other eight state-of-the-art classifiers based on sentence transformers. Our findings indicate that our model achieves the best performance with F1 score of 0.85, Precision of 0.86, and Recall of 0.83. Furthermore, we found 56% of CVE reports vulnerabilities associated with an attack were identified by VULDAT, and 61% of identified vulnerabilities were in the CVE repository.
ER  -

OTHMAN, Refat T A; Bruno ROSSI a Barbara RUSSO. Cybersecurity Defenses: Exploration of CVE Types through Attack Descriptions. Online. In \textit{50th Euromicro Conference Series on Software Engineering and Advanced Applications (SEAA)}. Not specified: IEEE, 2024, s.~415-418. ISBN~979-8-3503-8026-2. Dostupné z: https://doi.org/10.1109/SEAA64295.2024.00069.

Přehled o publikaci