用AI从IoT问题报告中识别漏洞，提升安全响应速度。
Detecting Vulnerabilities from Issue Reports for Internet-of-Things
- 结合ML、LLM与NLP技术分析21个Eclipse IoT项目的问题报告。
- SVM模型基于BERT特征实现AUC 0.65，优于微调BERT的0.26准确率。
- 首次为IoT系统构建漏洞检测框架，适合安全开发与运维人员。
及时识别反映软件漏洞的问题报告对物联网（IoT）至关重要，因IoT系统分析速度慢于非IoT系统。尽管机器学习（ML）和大语言模型（LLMs）已在非IoT系统中用于检测漏洞相关问题，但其在IoT中的应用尚未探索。本文首次提出两种方法：(1) 结合ML、LLM与自然语言处理（NLP）技术，分析21个Eclipse IoT项目的漏洞指示性问题；(2) 在11,000个GitHub问题上微调预训练BERT掩码语言模型（MLM）以分类漏洞（\vul）。最佳结果为基于BERT特征训练的支持向量机（SVM），AUC达0.65；微调后的BERT准确率为0.26，凸显完整数据暴露的重要性。本研究为从问题报告中精准检测IoT漏洞奠定基础，类比非IoT系统。
原文摘要 · Abstract (English)
Timely identification of issue reports reflecting software vulnerabilities is crucial, particularly for Internet-of-Things (IoT) where analysis is slower than non-IoT systems. While Machine Learning (ML) and Large Language Models (LLMs) detect vulnerability-indicating issues in non-IoT systems, their IoT use remains unexplored. We are the first to tackle this problem by proposing two approaches: (1) combining ML and LLMs with Natural Language Processing (NLP) techniques to detect vulnerability-indicating issues of 21 Eclipse IoT projects and (2) fine-tuning a pre-trained BERT Masked Language Model (MLM) on 11,000 GitHub issues for classifying \vul. Our best performance belongs to a Support Vector Machine (SVM) trained on BERT NLP features, achieving an Area Under the receiver operator characteristic Curve (AUC) of 0.65. The fine-tuned BERT achieves 0.26 accuracy, emphasizing the importance of exposing all data during training. Our contributions set the stage for accurately detecting IoT vulnerabilities from issue reports, similar to non-IoT systems.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。