一句话：提出 proEVA，利用 CVSS 指标关联与课程学习，从 issue report 实现早期漏洞评估并显著优于基线。
针对新兴软件漏洞可经 issue report 早期发现、但后续评估尚未获得支持的问题，本文提出早期漏洞评估方法 proEVA。它基于 Common Vulnerability Scoring System (CVSS) 指标之间的强关联，采用 prompt-based 模型预测 CVSS 指标，并用 curriculum learning 调度训练以学习隐藏关联；同时提出两个 severity-aware 指标，以更好评价高严重性漏洞的优先级排序。实验表明 proEVA 在标准分类指标和所提指标上均显著优于基线，并进一步验证其在评估系统升级时的迁移效率与灵活性。
It is increasingly suggested to identify emerging software vulnerabilities (SVs) through relevant development activities (e.g., issue reports) to allow early warnings to open source software (OSS) users. However, the support for the following assessment of the detected SVs has not yet been explored. SV assessment characterizes the detected SVs to prioritize limited remediation resources on the critical ones. To fill this gap, we aim to enable early vulnerability assessment based on SV-related issue reports (SIR). Besides, we observe the following concerns of the existing assessment techniques: 1) the assessment output lacks rationale and practical value; 2) the associations between Common Vulnerability Scoring System (CVSS) metrics have been ignored; 3) insufficient evaluation scenarios and metrics. We address these concerns to enhance the practicality of our proposed early vulnerability assessment approach (namely proEVA). Specifically, based on the observation of strong associations between CVSS metrics, we propose a prompt-based model to exploit such relations for CVSS metrics prediction. Moreover, we design a curriculum-learning (CL) schedule to guide the model better learn such hidden associations during training. Aside from the standard classification metrics adopted in existing works, we propose two severity-aware metrics to provide a more comprehensive evaluation regarding the prioritization of the high-severe SVs. Experimental results show that proEVA significantly outperforms the baselines in both types of metrics. We further discuss the transferability of the prediction model regarding the upgrade of the assessment system, an important yet overlooked evaluation scenario in existing works. The results verify that proEVA is more efficient and flexible in migrating to different assessment systems.
@inproceedings{paperbot11286,
title = {Towards More Practical Automation of Vulnerability Assessment},
author = {Shengyi Pan and Lingfeng Bao and Jiayuan Zhou and Xing Hu and Xin Xia and Shanping Li},
booktitle = {ICSE},
year = {2024},
doi = {10.1145/3597503.3639110}
}