|国家科技期刊平台
首页|期刊导航|信息安全研究|基于BiGRU TextCNN框架的漏洞自动分类技术研究

基于BiGRU TextCNN框架的漏洞自动分类技术研究OA北大核心CSTPCD

An Automatic Vulnerability Classification Framework Based on BiGRU TextCNN

中文摘要英文摘要

通用缺陷枚举(CVE)信息可以用于记录已知漏洞并提供标准化的语义描述,利用CWE信息对漏洞进行分类,可以为漏洞挖掘提供更丰富的背景知识和更详细的预防措施.但由于人工分类的不确定性和漏洞本身信息参数的变化,在具体实践中漏洞分类的准确性亟待提高,此外大量且不断增加的新漏洞对人工分类的效率和准确性也提出了巨大挑战.为解决这一问题,提出了一个基于BiGRU TextCNN模型的漏洞分类方法,可用于对漏洞信息的处理、训练和预测,并根据漏洞自身所表征的描述信息自动进行分类.为验证所提方法的适用性和可行性,首先对不同分类模型进行对比分析,然后利用所提出的框架模型通过对漏洞所表征的描述信息进行预测分类,结果证明了所提方法的正确性.

Common Vulnerabilities and Exposures(CVE)serve as a repository for recording known vulnerabilities with standardized descriptions.Utilizing Common Weakness Enumeration(CWE)to classify vulnerabilities,it provides richer background knowledge and more detailed mitigation measures.However,due to the negligence on manual classification and the evolution of vulnerabilities.Additionally,the ever-increasing number of vulnerabilities presents a substantial challenge to the efficiency and accuracy of manual classification.To address these issues,we propose a vulnerability classification framework based on BiGRU TextCNN model,which processes,trains,predicts to automatically classify vulnerabilities into weaknesses based on the description of vulnerability.To validate the performance and feasibility of the proposed framework,we conduct comparison experiments on different text classification models and demonstrate the correctness of the proposed method by predicting vulnerabilities'classifications utilizing the propsosed framework.

张浩;何东昊

河南合众电力技术有限公司 郑州 450006

计算机与自动化

漏洞分类文本分类条件抽取深度学习安全告警

vulnerability classificationtext classificationconditional extractiondeep learningsecurity advisory

《信息安全研究》 2024 (005)

446-452 / 7

国网公司科技项目(521702240011)

10.12379/j.issn.2096-1057.2024.05.08

评论