CVE-LLM : Automatic vulnerability evaluation in medical device industry using large language models

Rikhiya Ghosh,Oladimeji Farri,Hans-Martin von Stockhausen,Martin Schmitt,George Marica Vasile

2024-07-20

Abstract:The healthcare industry is currently experiencing an unprecedented wave of cybersecurity attacks, impacting millions of individuals. With the discovery of thousands of vulnerabilities each month, there is a pressing need to drive the automation of vulnerability assessment processes for medical devices, facilitating rapid mitigation efforts. Generative AI systems have revolutionized various industries, offering unparalleled opportunities for automation and increased efficiency. This paper presents a solution leveraging Large Language Models (LLMs) to learn from historical evaluations of vulnerabilities for the automatic assessment of vulnerabilities in the medical devices industry. This approach is applied within the portfolio of a single manufacturer, taking into account device characteristics, including existing security posture and controls. The primary contributions of this paper are threefold. Firstly, it provides a detailed examination of the best practices for training a vulnerability Language Model (LM) in an industrial context. Secondly, it presents a comprehensive comparison and insightful analysis of the effectiveness of Language Models in vulnerability assessment. Finally, it proposes a new human-in-the-loop framework to expedite vulnerability evaluation processes.

Computation and Language,Artificial Intelligence,Cryptography and Security

What problem does this paper attempt to address?

The paper attempts to address the issue of automating the vulnerability assessment process in the medical device industry to expedite vulnerability mitigation efforts. Specifically, the paper focuses on the following aspects:

1. **Automated Vulnerability Assessment**: The medical device industry faces a large number of cybersecurity attacks, with thousands of new vulnerabilities discovered each month. This has led to a demand for automated vulnerability assessment to quickly identify and mitigate potential threats.

2. **Utilizing Large Language Models (LLMs)**: The paper proposes a method based on large language models, which automatically assesses vulnerabilities in medical devices by learning from historical vulnerability assessment data. This method takes into account device characteristics, existing security posture, and control measures.

3. **Improving Assessment Efficiency**: Traditional vulnerability assessment processes are usually conducted manually, which can lead to delays in addressing actual threats. The goal of the paper is to improve efficiency by automating the assessment process, thereby reducing assessment time.

4. **Detailed Assessment Content**: The paper proposes a detailed assessment framework, including vulnerability classification (affected or unaffected), vulnerability explanation, internal comments, customer comments, and the evaluation of CVSS environmental metrics.

5. **Human-Machine Collaboration Framework**: The paper also proposes a human-machine collaboration framework to further accelerate the vulnerability assessment process and reduce the time required for human intervention.

In summary, the main objective of the paper is to automate the vulnerability assessment process in the medical device industry using large language models, thereby improving assessment efficiency and accuracy to more quickly mitigate potential security threats.