Abstract:It is increasingly suggested to identify emerging software vulner-abilities (SVs) through relevant development activities (e.g., issue reports) to allow early warnings to open source software (OSS) users. However, the support for the following assessment of the de-tected SVs has not yet been explored. SV assessment characterizes the detected SVs to prioritize limited remediation resources on the critical ones. To fill this gap, we aim to enable early vulnerability assessment based on SV-related issue reports (SIR). Besides, we observe the following concerns of the existing assessment techniques: 1) the assessment output lacks rationale and practical value; 2) the associations between Common Vulnerability Scoring System (CVSS) metrics have been ignored; 3) insufficient evaluation sce-narios and metrics. We address these concerns to enhance the prac-ticality of our proposed early vulnerability assessment approach (namely proEVA). Specifically, based on the observation of strong associations between CVSS metrics, we propose a prompt-based model to exploit such relations for CVSS metrics prediction. More-over, we design a curriculum-learning (CL) schedule to guide the model better learn such hidden associations during training. Aside from the standard classification metrics adopted in existing works, we propose two severity-aware metrics to provide a more compre-hensive evaluation regarding the prioritization of the high-severe SVs. Experimental results show that proEVA significantly outper-forms the baselines in both types of metrics. We further discuss the transferability of the prediction model regarding the upgrade of the assessment system, an important yet overlooked evaluation scenario in existing works. The results verify that proEVA is more efficient and flexible in migrating to different assessment systems.

An Emulation Environment for Vulnerability Analysis of Large-Scale Distributed System

A Software Vulnerability Analysis Environment Based on Virtualization Technology

Vulnerability Assessment of Electrical Cyber-Physical Systems Against Cyber Attacks

Towards More Practical Automation of Vulnerability Assessment

Vulnerability Analysis of Electrical Cyber Physical Systems Using a Simulation Platform.

Research on Vulnerability Analysis Framework for Large-scale Distributed System

Vulnerability Testing of Software Using Extended EAI Model

Design Of An Evaluation System For Large Scale Network Attacks Based On Emulab

How Far Have We Gone in Vulnerability Detection Using Large Language Models

An OVAL-based Active Vulnerability Assessment System for Enterprise Computer Networks.

A Scalable Network Emulation Architecture for Space Internetworking

VulnLLMEval: A Framework for Evaluating Large Language Models in Software Vulnerability Detection and Patching

Network Reconnaissance and Vulnerability Excavation of Secure DDS Systems

DCDetector: An IoT terminal vulnerability mining system based on distributed deep ensemble learning under source code representation

A Large-Scale Empirical Study on Vulnerability Distribution Within Projects and the Lessons Learned

Dis-NDVW: Distributed Network Asset Detection and Vulnerability Warning Platform

An Empirical Study of Automated Vulnerability Localization with Large Language Models

RealVul: Can We Detect Vulnerabilities in Web Applications with LLM?

An Extensible Emulation and Network Performance Analysis System for Space Information Network.

Comparison of Static Application Security Testing Tools and Large Language Models for Repo-level Vulnerability Detection

A Novel Vulnerability Assessment System Based on OVAL