Abstract:It is increasingly suggested to identify emerging software vulner-abilities (SVs) through relevant development activities (e.g., issue reports) to allow early warnings to open source software (OSS) users. However, the support for the following assessment of the de-tected SVs has not yet been explored. SV assessment characterizes the detected SVs to prioritize limited remediation resources on the critical ones. To fill this gap, we aim to enable early vulnerability assessment based on SV-related issue reports (SIR). Besides, we observe the following concerns of the existing assessment techniques: 1) the assessment output lacks rationale and practical value; 2) the associations between Common Vulnerability Scoring System (CVSS) metrics have been ignored; 3) insufficient evaluation sce-narios and metrics. We address these concerns to enhance the prac-ticality of our proposed early vulnerability assessment approach (namely proEVA). Specifically, based on the observation of strong associations between CVSS metrics, we propose a prompt-based model to exploit such relations for CVSS metrics prediction. More-over, we design a curriculum-learning (CL) schedule to guide the model better learn such hidden associations during training. Aside from the standard classification metrics adopted in existing works, we propose two severity-aware metrics to provide a more compre-hensive evaluation regarding the prioritization of the high-severe SVs. Experimental results show that proEVA significantly outper-forms the baselines in both types of metrics. We further discuss the transferability of the prediction model regarding the upgrade of the assessment system, an important yet overlooked evaluation scenario in existing works. The results verify that proEVA is more efficient and flexible in migrating to different assessment systems.

A new reliability evaluation method for embedded system

An architecture-based reliability estimation framework through component composition mechanisms

An Accurate Cross-Layer Approach for Online Architectural Vulnerability Estimation

A Cross-Layer Framework for Early-Stage Full Chip Oxide Breakdown Reliability Analysis

Towards More Practical Automation of Vulnerability Assessment

On the Characterization and Optimization of System-Level Vulnerability for Instruction Caches in Embedded Processors

THE IMPLEMENTATION OF FAULTS DEBUGGING AND DETECTION BASED ON VXWORKS

A Statistical Framework for Post-Fabrication Oxide Breakdown Reliability Prediction and Management

Characterizing System-Level Vulnerability for Instruction Caches Against Soft Errors

Application Specified Soft-Error Failure Rate Analysis Using Sequential Equivalence Checking Techniques

Soft Error Effects on Arm Microprocessors: Early Estimations versus Chip Measurements

Reliability analysis of digital protection's software based on architecture

Evaluation of A Resilience Embedded System Using Probabilistic Model-Checking

Using Formal Verification to Evaluate Single Event Upsets in a RISC-V Core

On the Characterization and Optimization of On-Chip Cache Reliability Against Soft Errors

A Micro Architectural Events Aware Real-Time Embedded System Fault Injector

A Cycle-Accurate Soft Error Vulnerability Analysis Framework for FPGA-based Designs

Micro-Architectural features as soft-error induced fault executions markers in embedded safety-critical systems: a preliminary study

Self-Adaptive Data Caches for Soft-Error Reliability

A Flexible Soft Error Mitigation Framework Leveraging Dynamic Partial Reconfiguration Technology

Dependability Analysis of Data Storage Systems in Presence of Soft Errors