一句话：提出通过挖掘 GitHub issue 并用 NLP 对齐 CVE/CWE/OWASP 的微服务漏洞管理框架。
微服务架构的广泛采用扩大了攻击面，但现有文献多依赖受控场景或合成数据，难以反映真实世界中的安全实践。本文提出一个面向微服务架构的综合漏洞管理方法论框架，其核心是通过挖掘 GitHub 仓库中的 issue 来获取真实漏洞信息。作者利用自然语言处理技术，将现实世界的漏洞报告与 CVE、CWE、OWASP 等行业标准进行对齐，从而构建一个能够准确反映真实开发实践的混合分类法。该框架旨在弥合学术研究与工业实践之间的差距，为微服务环境中的漏洞识别、分类与管理提供更贴合实际的方法基础。摘要未报告具体的实证评估结果，主要贡献在于方法论设计与分类法构建。
The widespread adoption of microservices has expanded the attack surface, presenting security challenges that current literature typically addresses through controlled scenarios or synthetic data, thus limiting its applicability in the real world. This research proposes a methodological framework for comprehensive vulnerability management by mining issues in GitHub repositories. Using Natural Language Processing (NLP) techniques, we align real-world vulnerability reports with industry standards such as CVE, CWE, and OWASP, building a hybrid taxonomy that accurately reflects real-world development practices.
@inproceedings{paperbot11940,
title = {A Methodological Framework for Intelligent Vulnerability Management in Microservice Architectures},
author = {Danelys Brito Gonzalez and Julio Andrés Sotelo Parraguez and Gaston Marquez and Marcello Visconti},
booktitle = {ICSE},
year = {2026},
doi = {10.1145/3774748.3787669}
}