ThreatZoom：使用分层神经网络的CVE2CWE
ThreatZoom: CVE2CWE using Hierarchical Neural Network
摘要：
常见漏洞和暴露（CVE）代表用于共享公开已知的信息安全漏洞的标准方法。将一个或多个CVE分组到常见弱点枚举（CWE）类中，以了解软件或配置缺陷以及这些漏洞造成的潜在影响，并确定检测或防止利用的方法。由于CVE到CWE的分类主要由领域专家手动执行，因此数千个关键和新的CVE仍然未分类，但它们是不可修补的。这大大限制了CVE的实用性，并减缓了主动威胁缓解的速度。本文提出了第一个自动工具分类的CVES CWEs。ThreatZoom使用一种新的学习算法，该算法采用自适应分层神经网络，该网络根据文本分析分数和分类错误调整其权重。它使用从CVE的描述中提取的统计和语义特征来自动估计对应于CVE实例的CWE类。该工具通过MITRE和国家漏洞数据库（NVD）提供的各种数据集进行了严格测试。NVD数据集的分类准确率为92%（细粒度）和94%（粗粒度），MITRE数据集的分类准确率为75%（细粒度）和90%（粗粒度），尽管语料库很小。
英文摘要：
The Common Vulnerabilities and Exposures (CVE) represent standard means for sharing publicly known information security vulnerabilities. One or more CVEs are grouped into the Common Weakness Enumeration (CWE) classes for the purpose of understanding the software or configuration flaws and potential impacts enabled by these vulnerabilities and identifying means to detect or prevent exploitation. As the CVE-to-CWE classification is mostly performed manually by domain experts, thousands of critical and new CVEs remain unclassified, yet they are unpatchable. This significantly limits the utility of CVEs and slows down proactive threat mitigation. This paper presents the first automatic tool to classify CVEs to CWEs. ThreatZoom uses a novel learning algorithm that employs an adaptive hierarchical neural network which adjusts its weights based on text analytic scores and classification errors. It automatically estimates the CWE classes corresponding to a CVE instance using both statistical and semantic features extracted from the description of a CVE. This tool is rigorously tested by various datasets provided by MITRE and the National Vulnerability Database (NVD). The accuracy of classifying CVE instances to their correct CWE classes are 92% (fine-grain) and 94% (coarse-grain) for NVD dataset, and 75% (fine-grain) and 90% (coarse-grain) for MITRE dataset, despite the small corpus.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
