基于提取摘要的ExploitDB帖子信息CVE描述
Generating Informative CVE Description From ExploitDB Posts by Extractive Summarization
摘要：
ExploitDB是重要的公共网站之一，为官方CVE数据库贡献了大量漏洞。这些漏洞中有60%以上具有高度或严重的安全风险。不幸的是，超过73%的漏洞比相应的CVE更早公开出现，大约40%的漏洞甚至没有CVE。为了帮助记录ExploitDB帖子的CVE，我们提出了一种开放信息方法，从冗长和嘈杂的ExploitDB帖子中提取9个关键漏洞方面（易受攻击的产品/版本/组件，漏洞类型，供应商，攻击者类型，根本原因，攻击向量和影响）。从ExploitDB帖子中提取的方面然后根据建议的CVE描述模板组成CVE描述，这是请求新CVE必须提供的信息。通过对13，017个人工标注句子的评估和对3，456个提取方面的统计抽样，我们证实了我们的提取方法的高准确性。与27，230个参考CVE描述相比。我们组合的CVE描述达到了高ROUGH-L（0.38），这是一个用于评估文本摘要方法的基于最长公共子序列的指标。
英文摘要：
ExploitDB is one of the important public websites, which contributes a large number of vulnerabilities to official CVE database. Over 60\% of these vulnerabilities have high- or critical-security risks. Unfortunately, over 73\% of exploits appear publicly earlier than the corresponding CVEs, and about 40\% of exploits do not even have CVEs. To assist in documenting CVEs for the ExploitDB posts, we propose an open information method to extract 9 key vulnerability aspects (vulnerable product/version/component, vulnerability type, vendor, attacker type, root cause, attack vector and impact) from the verbose and noisy ExploitDB posts. The extracted aspects from an ExploitDB post are then composed into a CVE description according to the suggested CVE description templates, which is must-provided information for requesting new CVEs. Through the evaluation on 13,017 manually labeled sentences and the statistically sampling of 3,456 extracted aspects, we confirm the high accuracy of our extraction method. Compared with 27,230 reference CVE descriptions. Our composed CVE descriptions achieve high ROUGH-L (0.38), a longest common subsequence based metric for evaluating text summarization methods.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
