用BERT实现漏洞报告多标签分类，自动判断严重性和类型。
Advancing Vulnerability Classification with BERT: A Multi-Objective Learning Model
- 基于BERT构建多目标学习模型，联合预测漏洞严重性与类型。
- 在最新NVD数据上训练，损失值随训练轮次下降，表现稳定。
- 提供实时接口和网页界面，适合安全团队快速处理漏洞报告。
网络安全漏洞数量激增，亟需自动化分析工具对漏洞报告进行分类。本文提出一种新型漏洞报告分类器，利用BERT（双向编码器表示变换）模型对来自国家漏洞数据库（NVD）的通用漏洞披露（CVE）报告进行多标签分类，可同时预测漏洞严重性（低、中、高、严重）和漏洞类型（如缓冲区溢出、XSS）。我们设计了一种定制训练流程，采用组合损失函数——严重性使用交叉熵，类型使用带逻辑值的二元交叉熵，并集成至Hugging Face Trainer子类中。在近期NVD数据上的实验表明，评估损失随训练轮次持续下降，系统性能稳定。该模型已通过REST API和Streamlit界面部署，支持实时漏洞分析。本工作为网络安全从业者提供了一个可扩展、开源的漏洞优先级处理解决方案。
原文摘要 · Abstract (English)
The rapid increase in cybersecurity vulnerabilities necessitates automated tools for analyzing and classifying vulnerability reports. This paper presents a novel Vulnerability Report Classifier that leverages the BERT (Bidirectional Encoder Representations from Transformers) model to perform multi-label classification of Common Vulnerabilities and Exposures (CVE) reports from the National Vulnerability Database (NVD). The classifier predicts both the severity (Low, Medium, High, Critical) and vulnerability types (e.g., Buffer Overflow, XSS) from textual descriptions. We introduce a custom training pipeline using a combined loss function-Cross-Entropy for severity and Binary Cross-Entropy with Logits for types-integrated into a Hugging Face Trainer subclass. Experiments on recent NVD data demonstrate promising results, with decreasing evaluation loss across epochs. The system is deployed via a REST API and a Streamlit UI, enabling real-time vulnerability analysis. This work contributes a scalable, open-source solution for cybersecurity practitioners to automate vulnerability triage.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。