一句话：提出 CaVAE 无监督标注和抽取漏洞描述中的根因、攻击向量与影响等短语概念，并优于人工标注数据。
该论文研究如何从自然语言漏洞描述中自动抽取关键漏洞概念，以减少人工标注成本。作者聚焦根因、攻击向量和影响三类基于短语的概念，因为它们比厂商、产品、版本等名称或数字实体更难标注与抽取。方法基于一个观察：同类短语即使句法结构和表达不同，也常在句法解析树中共享相似的路径。为此，论文提出绝对路径和相对路径两种表示，并用自编码器编码句法相似性；针对路径的离散性质，利用 Gumbel-Max 技巧增强传统 VAE，构建面向类别数据分布的 Categorical VAE（CaVAE）。在绝对与相对路径的隐空间中，进一步使用 FIt-TSNE 和聚类生成同类型概念簇。实验验证了 CaVAE 编码路径表示的有效性以及生成簇中漏洞概念的准确性；在概念分类任务中，无监督标注的漏洞概念优于先前工作的两个人工标注数据集。
People usually describe the key characteristics of software vulnerabilities in natural language mixed with domain-specific names and concepts. This textual nature poses a significant challenge for the automatic analysis of vulnerabilities. Automatic extraction of key vulnerability aspects is highly desirable but demands significant effort to manually label data for model training. In this paper, we propose an unsupervised approach to label and extract important vulnerability concepts in textural vulnerability descriptions (TVDs). We focus on three types of phrase-based vulnerability concepts (root cause, attack vector, and impact) as they are much more difficult to label and extract than name- or number-based entities (i.e., vendor, product, and version). Our approach is based on a key observation that the same-type of phrases, no matter how they differ in sentence structures and phrase expressions, usually share syntactically similar paths in the sentence parsing trees. Therefore, we propose two path representations (absolute paths and relative paths) and use an auto-encoder to encode such syntactic similarities. To address the discrete nature of our paths, we enhance traditional Variational Auto-encoder (VAE) with Gumble-Max trick for categorical data distribution, and thus creates a Categorical VAE (CaVAE). In the latent space of absolute and relative paths, we further use FIt-TSNE and clustering techniques to generate clusters of the same-type of concepts. Our evaluation confirms the effectiveness of our CaVAE for encoding path representations and the accuracy of vulnerability concepts in the resulting clusters. In a concept classification task, our unsupervisedly labeled vulnerability concepts outperform the two manually labeled datasets from previous work.
DOI 原文 ·
@inproceedings{paperbot6600,
title = {Unsupervised Labeling and Extraction of Phrase-based Concepts in Vulnerability Descriptions},
author = {Sofonias Yitagesu and Zhenchang Xing and Xiaowang Zhang and Zhiyong Feng and Xiaohong Li and Linyi Han},
booktitle = {ASE},
year = {2021},
doi = {10.1109/ase51524.2021.9678638}
}