一句话：提出知识驱动的漏洞搜索工具 KVS，利用 BERT 抽取漏洞实体并构建漏洞知识图谱，支持检索感兴趣的漏洞。
现有漏洞管理库中的漏洞信息分散，难以快速定位和搜索特定漏洞及其解决方案。为缓解该问题，作者从漏洞报告中抽取知识，将漏洞信息组织成知识图谱，并实现知识驱动的漏洞搜索工具 KVS。该工具主要使用 BERT 模型完成漏洞命名实体识别，构建漏洞知识图谱 VulKG，再基于 VulKG 搜索用户感兴趣的漏洞。摘要未报告量化实验评估，主要通过工具实现、在线访问地址与演示视频展示其功能。
It is difficult to quickly locate and search for specific vulnerabilities and their solutions because vulnerability information is scattered in the existing vulnerability management library. To alleviate this problem, we extract knowledge from vulnerability reports and organize the vulnerability information into the form of a knowledge graph. Then, we implement a tool for knowledge-driven vulnerability searching, KVS. This tool mainly uses the BERT model to realize the vulnerability named entity recognition and construct the vulnerability knowledge graph (VulKG). Finally, we can search vulnerabilities of interest-based on VulKG. The URL of this tool is https://cinnqi.github.io/Neo4j-D3-VKG/. Video of our demo is available at https://youtu.be/FT1BaLUGPk0.
DOI 原文 ·
@inproceedings{paperbot6979,
title = {KVS: a tool for knowledge-driven vulnerability searching},
author = {Xingqi Cheng and Xiaobing Sun and Lili Bo and Ying Wei},
booktitle = {FSE},
year = {2022},
doi = {10.1145/3540250.3558920}
}