Abstract:Weaknesses in computer systems such as faults, bugs and errors in the architecture, design or implementation of software provide vulnerabilities that can be exploited by attackers to compromise the security of a system. Common Weakness Enumerations (CWE) are a hierarchically designed dictionary of software weaknesses that provide a means to understand software flaws, potential impact of their exploitation, and means to mitigate these flaws. Common Vulnerabilities and Exposures (CVE) are brief low-level descriptions that uniquely identify vulnerabilities in a specific product or protocol. Classifying or mapping of CVEs to CWEs provides a means to understand the impact and mitigate the vulnerabilities. Since manual mapping of CVEs is not a viable option, automated approaches are desirable but challenging. We present a novel Transformer-based learning framework (V2W-BERT) in this paper. By using ideas from natural language processing, link prediction and transfer learning, our method outperforms previous approaches not only for CWE instances with abundant data to train, but also rare CWE classes with little or no data to train. Our approach also shows significant improvements in using historical data to predict links for future instances of CVEs, and therefore, provides a viable approach for practical applications. Using data from MITRE and National Vulnerability Database, we achieve up to 97% prediction accuracy for randomly partitioned data and up to 94% prediction accuracy in temporally partitioned data. We believe that our work will influence the design of better methods and training models, as well as applications to solve increasingly harder problems in cybersecurity.

Software Vulnerabilities Detection Based on a Pre-trained Language Model

Function-Level Vulnerability Detection Through Fusing Multi-Modal Knowledge

Detecting software vulnerabilities using Language Models

Transformer-Based Language Models for Software Vulnerability Detection

Vulnerability Detection for Source Code Using Contextual LSTM

Enhancing Pre-Trained Language Models for Vulnerability Detection via Semantic-Preserving Data Augmentation

Automated software vulnerability detection with machine learning

Automated Vulnerability Detection Using Deep Learning Technique

XGV-BERT: Leveraging Contextualized Language Model and Graph Neural Network for Efficient Software Vulnerability Detection

Outside the Comfort Zone: Analysing LLM Capabilities in Software Vulnerability Detection

Security Vulnerability Detection Using Deep Learning Natural Language Processing

Vulnerability Detection Using Two-Stage Deep Learning Models

Software Vulnerability Detection Using Deep Neural Networks: A Survey

V2W-BERT: A Framework for Effective Hierarchical Multiclass Classification of Software Vulnerabilities

Harnessing Large Language Models for Software Vulnerability Detection: A Comprehensive Benchmarking Study

StagedVulBERT: Multi-Granular Vulnerability Detection with a Novel Pre-trained Code Model

DeepVulSeeker: A novel vulnerability identification framework via code graph structure and pre-training mechanism

Security Vulnerability Detection with Multitask Self-Instructed Fine-Tuning of Large Language Models

Optimizing software vulnerability detection using RoBERTa and machine learning

How Far Have We Gone in Vulnerability Detection Using Large Language Models

Python Source Code Vulnerability Detection with Named Entity Recognition