CPE-Identifier: Automated CPE identification and CVE summaries annotation with Deep Learning and NLP

TL;DR

This paper introduces CPE-Identifier, an automated system using deep learning and NLP to accurately extract CPEs from CVE summaries, significantly improving speed and precision over previous methods.

Contribution

The work presents a novel automated CPE annotation system that leverages deep learning and NLP for high accuracy and efficiency, including automated data labeling and new terminology detection.

Findings

Achieved an F1 score of 95.48% in CPE extraction

Outperformed prior methods by over 9% on all metrics

Automated data generation and labeling process implemented

Abstract

With the drastic increase in the number of new vulnerabilities in the National Vulnerability Database (NVD) every year, the workload for NVD analysts to associate the Common Platform Enumeration (CPE) with the Common Vulnerabilities and Exposures (CVE) summaries becomes increasingly laborious and slow. The delay causes organisations, which depend on NVD for vulnerability management and security measurement, to be more vulnerable to zero-day attacks. Thus, it is essential to come out with a technique and tool to extract the CPEs in the CVE summaries accurately and quickly. In this work, we propose the CPE-Identifier system, an automated CPE annotating and extracting system, from the CVE summaries. The system can be used as a tool to identify CPE entities from new CVE text inputs. Moreover, we also automate the data generating and labeling processes using deep learning models. Due to the complexity of the CVE texts, new technical terminologies appear frequently. To identify novel words in future CVE texts, we apply Natural Language Processing (NLP) Named Entity Recognition (NER), to identify new technical jargons in the text. Our proposed model achieves an F1 score of 95.48%, an accuracy score of 99.13%, a precision of 94.83%, and a recall of 96.14%. We show that it outperforms prior works on automated CVE-CPE labeling by more than 9% on all metrics.