Automatic labeling of the elements of a vulnerability report CVE with NLP

Kensuke Sumoto; Kenta Kanakogi; Hironori Washizaki; Naohiko Tsuda; Nobukazu Yoshioka; Yoshiaki Fukazawa; Hideyuki Kanuka

doi:10.1109/IRI54793.2022.00045

Automatic labeling of the elements of a vulnerability report CVE with NLP

Kensuke Sumoto, Kenta Kanakogi, Hironori Washizaki, Naohiko Tsuda, Nobukazu Yoshioka, Yoshiaki Fukazawa, Hideyuki Kanuka

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution

Abstract

Common Vulnerabilities and Exposures (CVE) databases contain information about vulnerabilities of software products and source code. If individual elements of CVE descriptions can be extracted and structured, then the data can be used to search and analyze CVE descriptions. Herein we propose a method to label each element in CVE descriptions by applying Named Entity Recognition (NER). For NER, we used BERT, a transformer-based natural language processing model. Using NER with machine learning can label information from CVE descriptions even if there are some distortions in the data. An experiment involving manually prepared label information for 1000 CVE descriptions shows that the labeling accuracy of the proposed method is about 0.81 for precision and about 0.89 for recall. In addition, we devise a way to train the data by dividing it into labels. Our proposed method can be used to label each element automatically from CVE descriptions.

Original language	English
Title of host publication	Proceedings - 2022 IEEE 23rd International Conference on Information Reuse and Integration for Data Science, IRI 2022
Publisher	Institute of Electrical and Electronics Engineers Inc.
Pages	164-165
Number of pages	2
ISBN (Electronic)	9781665466035
DOIs	https://doi.org/10.1109/IRI54793.2022.00045
Publication status	Published - 2022
Event	23rd IEEE International Conference on Information Reuse and Integration for Data Science, IRI 2022 - Virtual, Online, United States Duration: 2022 Aug 9 → 2022 Aug 11

Publication series

Name	Proceedings - 2022 IEEE 23rd International Conference on Information Reuse and Integration for Data Science, IRI 2022

Conference

Conference	23rd IEEE International Conference on Information Reuse and Integration for Data Science, IRI 2022
Country/Territory	United States
City	Virtual, Online
Period	22/8/9 → 22/8/11

Keywords

BERT
CVE
Technological
named entity recognition
natural language processing
security knowledge repository

ASJC Scopus subject areas

Artificial Intelligence
Computer Science Applications
Computer Vision and Pattern Recognition
Decision Sciences (miscellaneous)
Information Systems and Management
Safety, Risk, Reliability and Quality

Access to Document

10.1109/IRI54793.2022.00045

Cite this

Sumoto, K., Kanakogi, K., Washizaki, H., Tsuda, N., Yoshioka, N., Fukazawa, Y., & Kanuka, H. (2022). Automatic labeling of the elements of a vulnerability report CVE with NLP. In Proceedings - 2022 IEEE 23rd International Conference on Information Reuse and Integration for Data Science, IRI 2022 (pp. 164-165). (Proceedings - 2022 IEEE 23rd International Conference on Information Reuse and Integration for Data Science, IRI 2022). Institute of Electrical and Electronics Engineers Inc.. https://doi.org/10.1109/IRI54793.2022.00045

Automatic labeling of the elements of a vulnerability report CVE with NLP. / Sumoto, Kensuke; Kanakogi, Kenta; Washizaki, Hironori et al.

Proceedings - 2022 IEEE 23rd International Conference on Information Reuse and Integration for Data Science, IRI 2022. Institute of Electrical and Electronics Engineers Inc., 2022. p. 164-165 (Proceedings - 2022 IEEE 23rd International Conference on Information Reuse and Integration for Data Science, IRI 2022).

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution

Sumoto, K, Kanakogi, K, Washizaki, H, Tsuda, N, Yoshioka, N , Fukazawa, Y & Kanuka, H 2022, Automatic labeling of the elements of a vulnerability report CVE with NLP. in Proceedings - 2022 IEEE 23rd International Conference on Information Reuse and Integration for Data Science, IRI 2022. Proceedings - 2022 IEEE 23rd International Conference on Information Reuse and Integration for Data Science, IRI 2022, Institute of Electrical and Electronics Engineers Inc., pp. 164-165, 23rd IEEE International Conference on Information Reuse and Integration for Data Science, IRI 2022, Virtual, Online, United States, 22/8/9. https://doi.org/10.1109/IRI54793.2022.00045

Sumoto K, Kanakogi K, Washizaki H, Tsuda N, Yoshioka N , Fukazawa Y et al. Automatic labeling of the elements of a vulnerability report CVE with NLP. In Proceedings - 2022 IEEE 23rd International Conference on Information Reuse and Integration for Data Science, IRI 2022. Institute of Electrical and Electronics Engineers Inc. 2022. p. 164-165. (Proceedings - 2022 IEEE 23rd International Conference on Information Reuse and Integration for Data Science, IRI 2022). doi: 10.1109/IRI54793.2022.00045

Sumoto, Kensuke ; Kanakogi, Kenta ; Washizaki, Hironori et al. / Automatic labeling of the elements of a vulnerability report CVE with NLP. Proceedings - 2022 IEEE 23rd International Conference on Information Reuse and Integration for Data Science, IRI 2022. Institute of Electrical and Electronics Engineers Inc., 2022. pp. 164-165 (Proceedings - 2022 IEEE 23rd International Conference on Information Reuse and Integration for Data Science, IRI 2022).

@inproceedings{4f0f910576fa47df946163af8c92c549,

title = "Automatic labeling of the elements of a vulnerability report CVE with NLP",

abstract = "Common Vulnerabilities and Exposures (CVE) databases contain information about vulnerabilities of software products and source code. If individual elements of CVE descriptions can be extracted and structured, then the data can be used to search and analyze CVE descriptions. Herein we propose a method to label each element in CVE descriptions by applying Named Entity Recognition (NER). For NER, we used BERT, a transformer-based natural language processing model. Using NER with machine learning can label information from CVE descriptions even if there are some distortions in the data. An experiment involving manually prepared label information for 1000 CVE descriptions shows that the labeling accuracy of the proposed method is about 0.81 for precision and about 0.89 for recall. In addition, we devise a way to train the data by dividing it into labels. Our proposed method can be used to label each element automatically from CVE descriptions.",

keywords = "BERT, CVE, Technological, named entity recognition, natural language processing, security knowledge repository",

author = "Kensuke Sumoto and Kenta Kanakogi and Hironori Washizaki and Naohiko Tsuda and Nobukazu Yoshioka and Yoshiaki Fukazawa and Hideyuki Kanuka",

note = "Publisher Copyright: {\textcopyright} 2022 IEEE.; 23rd IEEE International Conference on Information Reuse and Integration for Data Science, IRI 2022 ; Conference date: 09-08-2022 Through 11-08-2022",

year = "2022",

doi = "10.1109/IRI54793.2022.00045",

language = "English",

series = "Proceedings - 2022 IEEE 23rd International Conference on Information Reuse and Integration for Data Science, IRI 2022",

publisher = "Institute of Electrical and Electronics Engineers Inc.",

pages = "164--165",

booktitle = "Proceedings - 2022 IEEE 23rd International Conference on Information Reuse and Integration for Data Science, IRI 2022",

}

TY - GEN

T1 - Automatic labeling of the elements of a vulnerability report CVE with NLP

AU - Sumoto, Kensuke

AU - Kanakogi, Kenta

AU - Washizaki, Hironori

AU - Tsuda, Naohiko

AU - Yoshioka, Nobukazu

AU - Fukazawa, Yoshiaki

AU - Kanuka, Hideyuki

PY - 2022

Y1 - 2022

N2 - Common Vulnerabilities and Exposures (CVE) databases contain information about vulnerabilities of software products and source code. If individual elements of CVE descriptions can be extracted and structured, then the data can be used to search and analyze CVE descriptions. Herein we propose a method to label each element in CVE descriptions by applying Named Entity Recognition (NER). For NER, we used BERT, a transformer-based natural language processing model. Using NER with machine learning can label information from CVE descriptions even if there are some distortions in the data. An experiment involving manually prepared label information for 1000 CVE descriptions shows that the labeling accuracy of the proposed method is about 0.81 for precision and about 0.89 for recall. In addition, we devise a way to train the data by dividing it into labels. Our proposed method can be used to label each element automatically from CVE descriptions.

AB - Common Vulnerabilities and Exposures (CVE) databases contain information about vulnerabilities of software products and source code. If individual elements of CVE descriptions can be extracted and structured, then the data can be used to search and analyze CVE descriptions. Herein we propose a method to label each element in CVE descriptions by applying Named Entity Recognition (NER). For NER, we used BERT, a transformer-based natural language processing model. Using NER with machine learning can label information from CVE descriptions even if there are some distortions in the data. An experiment involving manually prepared label information for 1000 CVE descriptions shows that the labeling accuracy of the proposed method is about 0.81 for precision and about 0.89 for recall. In addition, we devise a way to train the data by dividing it into labels. Our proposed method can be used to label each element automatically from CVE descriptions.

KW - BERT

KW - CVE

KW - Technological

KW - named entity recognition

KW - natural language processing

KW - security knowledge repository

UR - http://www.scopus.com/inward/record.url?scp=85139040087&partnerID=8YFLogxK

UR - http://www.scopus.com/inward/citedby.url?scp=85139040087&partnerID=8YFLogxK

U2 - 10.1109/IRI54793.2022.00045

DO - 10.1109/IRI54793.2022.00045

M3 - Conference contribution

AN - SCOPUS:85139040087

T3 - Proceedings - 2022 IEEE 23rd International Conference on Information Reuse and Integration for Data Science, IRI 2022

SP - 164

EP - 165

BT - Proceedings - 2022 IEEE 23rd International Conference on Information Reuse and Integration for Data Science, IRI 2022

PB - Institute of Electrical and Electronics Engineers Inc.

T2 - 23rd IEEE International Conference on Information Reuse and Integration for Data Science, IRI 2022

Y2 - 9 August 2022 through 11 August 2022

ER -

Automatic labeling of the elements of a vulnerability report CVE with NLP

Abstract

Publication series

Conference

Keywords

ASJC Scopus subject areas

Access to Document

Other files and links

Fingerprint

Cite this