一句话：提出 DeepCVA，用深度多任务学习同时预测 CVSS 七项指标，实现提交级漏洞的自动化早期评估。
软件漏洞若能在代码提交中早期识别并评估，可帮助及时规划修复优先级；但现有工作多关注漏洞提交检测，缺少对已检出提交的可利用性、影响和严重性的快速评估。本文提出 DeepCVA，一种深度多任务学习模型，基于 CVSS 指标同时自动化完成七项提交级漏洞评估任务。作者在 246 个真实项目、1,229 个漏洞贡献提交（含 542 个不同漏洞）上开展大规模实验。结果显示，DeepCVA 的 Matthews 相关系数比监督与无监督基线高 38%–59.8%，训练与验证时间比七个累积模型少 6.3 倍，显著降低维护成本，是首个有效且高效的自动化早期漏洞评估方案。
It is increasingly suggested to identify Software Vulnerabilities (SVs) in code commits to give early warnings about potential security risks. However, there is a lack of effort to assess vulnerability-contributing commits right after they are detected to provide timely information about the exploitability, impact and severity of SVs. Such information is important to plan and prioritize the mitigation for the identified SVs. We propose a novel Deep multi-task learning model, DeepCVA, to automate seven Commit-level Vulnerability Assessment tasks simultaneously based on Common Vulnerability Scoring System (CVSS) metrics. We conduct large-scale experiments on 1,229 vulnerability-contributing commits containing 542 different SVs in 246 real-world software projects to evaluate the effectiveness and efficiency of our model. We show that DeepCVA is the best-performing model with 38% to 59.8% higher Matthews Correlation Coefficient than many supervised and unsupervised baseline models. DeepCVA also requires 6.3 times less training and validation time than seven cumulative assessment models, leading to significantly less model maintenance cost as well. Over-all, DeepCVA presents the first effective and efficient solution to automatically assess SVs early in software systems.
DOI 原文 ·
@inproceedings{paperbot6606,
title = {DeepCVA: Automated Commit-level Vulnerability Assessment with Deep Multi-task Learning},
author = {Triet Huynh Minh Le and David Hin and Roland Croft and M. Ali Babar},
booktitle = {ASE},
year = {2021},
doi = {10.1109/ase51524.2021.9678622}
}