Abstract:It is increasingly suggested to identify emerging software vulner-abilities (SVs) through relevant development activities (e.g., issue reports) to allow early warnings to open source software (OSS) users. However, the support for the following assessment of the de-tected SVs has not yet been explored. SV assessment characterizes the detected SVs to prioritize limited remediation resources on the critical ones. To fill this gap, we aim to enable early vulnerability assessment based on SV-related issue reports (SIR). Besides, we observe the following concerns of the existing assessment techniques: 1) the assessment output lacks rationale and practical value; 2) the associations between Common Vulnerability Scoring System (CVSS) metrics have been ignored; 3) insufficient evaluation sce-narios and metrics. We address these concerns to enhance the prac-ticality of our proposed early vulnerability assessment approach (namely proEVA). Specifically, based on the observation of strong associations between CVSS metrics, we propose a prompt-based model to exploit such relations for CVSS metrics prediction. More-over, we design a curriculum-learning (CL) schedule to guide the model better learn such hidden associations during training. Aside from the standard classification metrics adopted in existing works, we propose two severity-aware metrics to provide a more compre-hensive evaluation regarding the prioritization of the high-severe SVs. Experimental results show that proEVA significantly outper-forms the baselines in both types of metrics. We further discuss the transferability of the prediction model regarding the upgrade of the assessment system, an important yet overlooked evaluation scenario in existing works. The results verify that proEVA is more efficient and flexible in migrating to different assessment systems.

A Software Vulnerability Analysis Environment Based on Virtualization Technology

An Emulation Environment for Vulnerability Analysis of Large-Scale Distributed System

Towards More Practical Automation of Vulnerability Assessment

Software Simulation-Based Fault Injection Tool of Virtual Machine System

Vulnerability Detection For Smart Grid Devices Via Static Analysis

Survey on Virtual Machine Environment Detection Methods

A Think on Security and Trusty Measurement for Virtualized Environment

Survey on Software Vulnerability Analysis Method Based on Machine Learning.

Vulnerability analysis dased on a fuzzy input testing

Analysis of a Secure Virtual Desktop Infrastructure System

An OVAL-based Active Vulnerability Assessment System for Enterprise Computer Networks.

Research on Security Techniques Based on System Virtualization

Virtual machine security challenges: case studies

The study and evaluation of ARM-based mobile virtualization

Vulnerability Analysis Framework for Binaries Based on Model Checking

A Mining Approach to Obtain the Software Vulnerability Characteristics

Research on the Architecture of Vulnerability Discovery Technology

Towards A Structured Model for Software Vulnerabilities

The Application of Virtual Machines on System Security

Vulnerability Detection System Based on Taint Range Propagation Analysis