Extraction of Phrase-based Concepts in Vulnerability Descriptions through Unsupervised Labeling
Extraction of Phrase-based Concepts in Vulnerability Descriptions through Unsupervised Labeling
复制标题
DOI：
10.1145/3579638
复制
发表时间：
2023-02
影响因子：
4.4
通讯作者：
Sofonias Yitagesu;Zhenchang Xing;Xiaowang Zhang;Zhiyong Feng;Xiaohong Li;Linyi Han
中科院分区：
文献类型：
--
作者：
Sofonias Yitagesu;Zhenchang Xing;Xiaowang Zhang;Zhiyong Feng;Xiaohong Li;Linyi Han
软件漏洞一旦被披露，可以记录在漏洞数据库中，这对于推进漏洞分析和安全研究具有巨大的潜力。人们用自然语言与特定领域的名称和概念混合来描述软件漏洞的关键特征。这种文本性质对文本中嵌入的漏洞知识的自动分析提出了重大挑战。自动提取关键漏洞方面是非常理想的，但需要付出巨大的努力来手动标记数据以进行模型训练。在本文中，我们提出了无监督方法来标记和提取文本漏洞描述（TVD）中的重要漏洞概念。我们重点关注六种基于短语的漏洞概念（漏洞类型、易受攻击的组件、根本原因、攻击者类型、影响和攻击向量），因为它们比基于名称或数字的实体（即供应商、产品和版本）更难以标记和提取。我们的方法基于一个关键的观察，即相同类型的短语，无论句子结构和短语表达如何不同，通常在句子解析树中共享句法相似的路径。具体来说，我们提出了一种源-目标神经架构，它学习词性（POS）标记以识别标记在 TVD 中的功能角色，其中源神经模型经过训练以捕获 TVD 语料库中的常见特征，目标模型经过训练以识别特定于安全域的语言畸形单词。我们的评估证实，所提出的标注器优于（4.45%–5.98%）基于自然语言概念设计的标注器，并识别了广泛的 TVD 和自然语言内容。然后，根据关键观察结果，我们提出两种路径表示（绝对路径和相对路径），并使用自动编码器对这种语法相似性进行编码。为了解决路径的离散性，我们使用 Gumble-Max 技巧增强了传统的变分自动编码器 (VAE)，以实现分类数据分布，从而创建了分类 VAE (CaVAE)。在绝对和相对路径的潜在空间中，我们进一步应用无监督聚类技术来生成相同类型概念的聚类。我们的评估证实了 CaVAE 的有效性，它在编码路径表示方面实现了较小的对数似然 (85.85)，并且在结果集群中实现了漏洞概念的准确性 (83%–89%)。生成的集群以无监督的方式准确地标记了 TVD 语料库中的六种类型的漏洞概念。此外，这些标记的漏洞概念可以映射回原始TVD中的相应短语，从而产生六种漏洞概念的标签。生成的标记 TVD 可用于训练其他 TVD 语料库的概念提取模型。在这项工作中，我们提出了两种概念提取方法（概念分类和序列标记模型）来证明无监督标记概念的实用性。我们的研究表明，由于我们的无监督标记方法的边界和类型一致，使用我们的无监督标记漏洞概念训练的模型优于使用之前工作中的两个手动标记的 TVD 数据集训练的模型 (3.9%–5.14%)。
Software vulnerabilities, once disclosed, can be documented in vulnerability databases, which have great potential to advance vulnerability analysis and security research. People describe the key characteristics of software vulnerabilities in natural language mixed with domain-specific names and concepts. This textual nature poses a significant challenge for the automatic analysis of vulnerability knowledge embedded in text. Automatic extraction of key vulnerability aspects is highly desirable but demands significant effort to manually label data for model training. In this article, we propose unsupervised methods to label and extract important vulnerability concepts in textual vulnerability descriptions (TVDs). We focus on six types of phrase-based vulnerability concepts (vulnerability type, vulnerable component, root cause, attacker type, impact, and attack vector) as they are much more difficult to label and extract than name- or number-based entities (i.e., vendor, product, and version). Our approach is based on a key observation that the same-type of phrases, no matter how they differ in sentence structures and phrase expressions, usually share syntactically similar paths in the sentence parsing trees. Specifically, we present a source-target neural architecture that learns the Part-of-Speech (POS) tagging to identify a token’s functional role within TVDs, where the source neural model is trained to capture common features found in the TVD corpus, and the target model is trained to identify linguistically malformed words specific to the security domain. Our evaluation confirms that the proposed tagger outperforms (4.45%–5.98%) the taggers designed on natural language notions and identifies a broad set of TVDs and natural language contents. Then, based on the key observations, we propose two path representations (absolute paths and relative paths) and use an auto-encoder to encode such syntactic similarities. To address the discrete nature of our paths, we enhance the traditional Variational Auto-encoder (VAE) with Gumble-Max trick for categorical data distribution and thus create a Categorical VAE (CaVAE). In the latent space of absolute and relative paths, we further apply unsupervised clustering techniques to generate clusters of the same-type of concepts. Our evaluation confirms the effectiveness of our CaVAE, which achieves a small (85.85) log-likelihood for encoding path representations and the accuracy (83%–89%) of vulnerability concepts in the resulting clusters. The resulting clusters accurately label six types of vulnerability concepts from a TVD corpus in an unsupervised way. Furthermore, these labeled vulnerability concepts can be mapped back to the corresponding phrases in the original TVDs, which produce labels of six types of vulnerability concepts. The resulting labeled TVDs can be used to train concept extraction models for other TVD corpora. In this work, we present two concept extraction methods (concept classification and sequence labeling model) to demonstrate the utility of the unsupervisedly labeled concepts. Our study shows that models trained with our unsupervisedly labeled vulnerability concepts outperform (3.9%–5.14%) those trained with the two manually labeled TVD datasets from previous work due to the consistent boundary and typing by our unsupervised labeling method.