Character-Level Convolutional Neural Network for Predicting Severity of Software Vulnerability from Vulnerability Description

Shunta NAKAGAWA  Tatsuya NAGAI  Hideaki KANEHARA  Keisuke FURUMOTO  Makoto TAKITA  Yoshiaki SHIRAISHI  Takeshi TAKAHASHI  Masami MOHRI  Yasuhiro TAKANO  Masakatu MORII  

Publication
IEICE TRANSACTIONS on Information and Systems   Vol.E102-D   No.9   pp.1679-1682
Publication Date: 2019/09/01
Online ISSN: 1745-1361
DOI: 10.1587/transinf.2018OFL0006
Type of Manuscript: Special Section LETTER (Special Section on Log Data Usage Technology and Office Information Systems)
Category: Cybersecurity
Keyword: 
CVE,  CVSS,  Convolutional Neural Network,  

Full Text: PDF(857.4KB)>>
Buy this Article




Summary: 
System administrators and security officials of an organization need to deal with vulnerable IT assets, especially those with severe vulnerabilities, to minimize the risk of these vulnerabilities being exploited. The Common Vulnerability Scoring System (CVSS) can be used as a means to calculate the severity score of vulnerabilities, but it currently requires human operators to choose input values. A word-level Convolutional Neural Network (CNN) has been proposed to estimate the input parameters of CVSS and derive the severity score of vulnerability notes, but its accuracy needs to be improved further. In this paper, we propose a character-level CNN for estimating the severity scores. Experiments show that the proposed scheme outperforms conventional one in terms of accuracy and how errors occur.