Abstract
In order to conduct a risk analysis on an ecosystem the potential threats to its assets must first be identified. The Risk Modelling Tool (RMT) of the CitySCAPE Project uses CWE - CAPEC - threat relationships that were mapped for identifying the threats that vulnerabilities can pose on specific assets, namely in the context of multimodal transport use cases, based on already existing vulnerabilities. However, nearly one third of all CVEs do not have any CWEs assigned to them or have generic CWEs like “NVD-CWE-Other” that do not offer any information about that vulnerability, to then be linked back to a threat. This paper proposes the use of a Natural Language Processing model and more specifically a text classification model to be trained on CVE descriptions that can be traced back to a threat using the created mapping. The model will therefore be able to extrapolate the threat that a specific vulnerability will expose and be detected earlier, allowing security analysts to be able to deploy countermeasures to combat that risk. The resulting model has an accuracy of over 90% across a ten-fold validation process. As such a more complete and accurate risk analysis can be performed using the larger number of applicable vulnerabilities found using our ML model.
This is a preview of subscription content, log in via an institution to check access.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
Similar content being viewed by others
Notes
- 1.
- 2.
- 3.
- 4.
- 5.
- 6.
- 7.
- 8.
- 9.
- 10.
References
Bird, S., Klein, E., Loper, E.: Natural language processing with Python: analyzing text with the natural language toolkit. O’Reilly Media, Inc. (2009)
CAPEC: About CAPEC. https://capec.mitre.org/about/index.html 04 Apr 2019
Cheikes, B., Waltermire, D., Scarfone, K.: Common Platform Enumeration: Naming Specification Version 2, 3 (2011). https://doi.org/10.6028/NIST.IR.7695, https://tsapps.nist.gov/publication/get_pdf.cfm?pub_id=909010
CISA: Apache Log4j Vulnerability Guidance. https://www.cisa.gov/uscert/apache-log4j-vulnerability-guidance Accessed 27 Apr 2022
CVE: CVE Numbering Authority (CNA) Rules. https://www.cve.org/ResourcesSupport/AllResources/CNARules 05 Mar 2020
CVE: History. https://www.cve.org/About/History Accessed 27 Apr 2022
CVE: Process for Assigning CVE IDs to End-of-Life (EOL) Products. https://cve.mitre.org/cve/cna/CVE_Program_End_of_Life_EOL_Assignment_Process.html 11 Dec 2020
CWE: 2021 CWE Top 25 Most Dangerous Software Weaknesses. https://cwe.mitre.org/top25/archive/2021/2021_cwe_top25.html 13 Oct 2022
CWE: About CWE. https://cwe.mitre.org/about/index.html 06 June 2023
CWE: CWE VIEW: Weaknesses for Simplified Mapping of Published Vulnerabilities. https://cwe.mitre.org/data/definitions/1003.html 27 Apr 2023
CWE: Weaknesses Originally Used by NVD from 2008 to 2016. https://cwe.mitre.org/data/definitions/635.html 27 Apr 2023
FIRST: Common Vulnerability Scoring System v1 Archive. https://www.first.org/cvss/v1/ 14 Apr 2005
FIRST: Common Vulnerability Scoring System version 3.1: User Guide. https://www.first.org/cvss/user-guide Accessed 5 May 2022
FIRST: New version of Common Vulnerability Scoring System released. https://www.first.org/cvss/v2/ 20 June 2007
Kanakogi, K., et al.: Tracing CVE Vulnerability Information to CAPEC Attack Patterns Using Natural Language Processing Techniques. Information 12(8), (2021). https://doi.org/10.3390/info12080298, https://www.mdpi.com/2078-2489/12/8/298
Kushner, D.: The real story of stuxnet. IEEE Spectr. 50(3), 48–53 (2013). https://doi.org/10.1109/MSPEC.2013.6471059
Lyvas, C., et al.: A hybrid dynamic risk analysis methodology for cyber-physical systems. In: Kastsikas, S., et al. (eds.) Computer Security. ESORICS 2022 International Workshops: CyberICPS 2022, SECPRE 2022, SPOSE 2022, CPS4CIP 2022, CDT &SECOMANE 2022, EIS 2022, and SecAssure 2022, Copenhagen, Denmark, September 26–30, 2022, Revised Selected Papers, pp. 134–152. Springer International Publishing, Cham (2023). https://doi.org/10.1007/978-3-031-25460-4_8
Manning, C.D., Raghavan, P., Schütze, H.: Introduction to Information Retrieval. Cambridge University Press (2008). https://doi.org/10.1017/CBO9780511809071
Microsoft Security Response Center: Customer Guidance for WannaCrypt attacks. https://msrc-blog.microsoft.com/2017/05/12/customer-guidance-for-wannacrypt-attacks/ 12 May 2017
NIST CSRC: Common Platform Enumeration (CPE). https://csrc.nist.gov/Projects/Security-Content-Automation-Protocol/Specifications/cpe 20 Apr 2023
NVD: A Brief History of the NVD. https://nvd.nist.gov/general/brief-history Accessed 27 Apr 2022
Ruder, S.: An overview of gradient descent optimization algorithms (2016). https://doi.org/10.48550/ARXIV.1609.04747, https://arxiv.org/abs/1609.04747
Sammut, C., Webb, G.I. (eds.): Encyclopedia of Machine Learning and Data Mining. Springer US, Boston, MA (2017). https://doi.org/10.1007/978-1-4899-7687-1
Sun, J., et al.: Generating Informative CVE Description From ExploitDB Posts by Extractive Summarization (2021). https://doi.org/10.48550/ARXIV.2101.01431, https://arxiv.org/abs/2101.01431
Tai, W.: How to Use VPR to Manage Threats Prior to NVD Publication. https://www.tenable.com/blog/how-to-use-vpr-to-manage-threats-prior-to-nvd-publication 22 May 2020
Tai, W.: What Is VPR and How Is It Different from CVSS?. https://www.tenable.com/blog/what-is-vpr-and-how-is-it-different-from-cvss 16 Apr 2020
Acknowledgment
This work is a part of the CitySCAPE project. CitySCAPE has received funding from the European Union’s Horizon 2020 research & innovation programme under grant agreement no 883321. Content reflects only the authors’ view and European Commission is not responsible for any use that may be made of the information it contains.
Author information
Authors and Affiliations
Corresponding author
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2024 The Author(s), under exclusive license to Springer Nature Switzerland AG
About this paper
Cite this paper
Giannakopoulos, T., Maliatsos, K. (2024). On the Usage of NLP on CVE Descriptions for Calculating Risk. In: Katsikas, S., et al. Computer Security. ESORICS 2023 International Workshops. ESORICS 2023. Lecture Notes in Computer Science, vol 14398. Springer, Cham. https://doi.org/10.1007/978-3-031-54204-6_6
Download citation
DOI: https://doi.org/10.1007/978-3-031-54204-6_6
Published:
Publisher Name: Springer, Cham
Print ISBN: 978-3-031-54203-9
Online ISBN: 978-3-031-54204-6
eBook Packages: Computer ScienceComputer Science (R0)