Abstract:It is increasingly suggested to identify emerging software vulner-abilities (SVs) through relevant development activities (e.g., issue reports) to allow early warnings to open source software (OSS) users. However, the support for the following assessment of the de-tected SVs has not yet been explored. SV assessment characterizes the detected SVs to prioritize limited remediation resources on the critical ones. To fill this gap, we aim to enable early vulnerability assessment based on SV-related issue reports (SIR). Besides, we observe the following concerns of the existing assessment techniques: 1) the assessment output lacks rationale and practical value; 2) the associations between Common Vulnerability Scoring System (CVSS) metrics have been ignored; 3) insufficient evaluation sce-narios and metrics. We address these concerns to enhance the prac-ticality of our proposed early vulnerability assessment approach (namely proEVA). Specifically, based on the observation of strong associations between CVSS metrics, we propose a prompt-based model to exploit such relations for CVSS metrics prediction. More-over, we design a curriculum-learning (CL) schedule to guide the model better learn such hidden associations during training. Aside from the standard classification metrics adopted in existing works, we propose two severity-aware metrics to provide a more compre-hensive evaluation regarding the prioritization of the high-severe SVs. Experimental results show that proEVA significantly outper-forms the baselines in both types of metrics. We further discuss the transferability of the prediction model regarding the upgrade of the assessment system, an important yet overlooked evaluation scenario in existing works. The results verify that proEVA is more efficient and flexible in migrating to different assessment systems.

Methodical Vulnerability Assessment for Electronic Equipment Based on Fisher Discriminant and Gaussian Process Regression

Vulnerability Assessment of Electrical Cyber-Physical Systems Against Cyber Attacks

Towards More Practical Automation of Vulnerability Assessment

Discrimination of Three or More Partial Discharge Sources by Multi-Step Clustering of Cumulative Energy Features

Multivariate image analysis in gaussian multi-scale space for defect detection

Electromagnetic Susceptibility Analysis In Device Level With Numerical Technique Based On Electric Field Integral Equation

Risk Based Vulnerability Assessment for Hvdc Transmission System

Vulnerability Assessment of Equipment Excited by Disturbances for Class Imbalance Problem Based on Improved Kernel Density Estimation

A Security Situation Assessment Method Based on Support Vector Regression for Power Monitoring System.

Fringing Electric Field Sensors for Anti-Attack at System-Level Protection

Study on Defect Classification in Multi-Layer Structures Based on Fisher Linear Discriminate Analysis by Using Pulsed Eddy Current Technique

Application of multi-sensor data fusion in defects evaluation based on Dempster-Shafer theory

An EM Imaging Method Based on Plane-Wave Spectrum and Transmission Line Model

Study on Technology and Application for Health Assessment of Electronic Equipment

A Method for Characterizing Defects in Multi-Layer Conductive Structures by Combining Pulsed Eddy Current Signals with PCA Components

Insulation Defects Discrimination in GIS by Fisher Discriminant Analysis of Partial Discharge

Evaluation method for electromagnetic interference complexity of high voltage switch based on feature extraction and GCC‐GRU network

An Electromagnetic Environment Situation Assessment and Abnormal Detection Technology

A probabilistic uncertain linguistic approach for FMEA‐based risk assessment

PD Signal Detection Model Based on Multiscale Simulation of EM Generation and Transmission.

Experimental study on probability threshold of electromagnetic effect of electronic equipment