A Survey on Data-driven Software Vulnerability Assessment and Prioritization

Abstract

Software Vulnerabilities (SVs) are increasing in complexity and scale, posing great security risks to many software systems. Given the limited resources in practice, SV assessment and prioritization help practitioners devise optimal SV mitigation plans based on various SV characteristics. The surges in SV data sources and data-driven techniques such as Machine Learning and Deep Learning have taken SV assessment and prioritization to the next level. Our survey provides a taxonomy of the past research efforts and highlights the best practices for data-driven SV assessment and prioritization. We also discuss the current limitations and propose potential solutions to address such issues.

arXiv commentAccepted for publication in the ACM Computing Surveys journal (CSUR), 2022

References in corpus (32)

• XGBoost: A Scalable Tree Boosting System
• Distributed Representations of Words and Phrases and their Compositionality
• Neural Machine Translation by Jointly Learning to Align and Translate
• Semi-Supervised Classification with Graph Convolutional Networks
• Distributed Representations of Sentences and Documents
• Character-level Convolutional Networks for Text Classification
• Multilayer Networks
• Supervised Topic Models
• Model Evaluation, Model Selection, and Algorithm Selection in Machine Learning
• $\mu$VulDeePecker: A Deep Learning-Based System for Multiclass Vulnerability Detection
• Deep Learning for Source Code Modeling and Generation: Models, Applications and Challenges
• Evaluation Metrics for Unsupervised Learning Algorithms
• Evolution of statistical analysis in empirical software engineering research: Current state and steps forward
• Predicting Exploitation of Disclosed Software Vulnerabilities Using Open-source Data
• 500+ Times Faster Than Deep Learning (A Case Study Exploring Faster Methods for Text Mining StackOverflow)
• Automated Software Vulnerability Assessment with Concept Drift
• The Impact of a Major Security Event on an Open Source Project: The Case of OpenSSL
• A Survey on Neural Network Interpretability
• A Large-scale Study of Security Vulnerability Support on Developer Q&A Websites
• Generating Informative CVE Description From ExploitDB Posts by Extractive Summarization
• Classifying Web Exploits with Topic Modeling
• PUMiner: Mining Security Posts from Developer Question and Answer Websites with PU Learning
• Analyzing Evolving Stories in News Articles
• Learning to Catch Security Patches
• Toward Validation of Textual Information Retrieval Techniques for Software Weaknesses
• Cleaning the NVD: Comprehensive Quality Assessment, Improvements, and Analyses
• Automated Mapping of Vulnerability Advisories onto their Fix Commits in Open Source Repositories
• On the Use of Fine-grained Vulnerable Code Statements for Software Vulnerability Assessment Models
• V2W-BERT: A Framework for Effective Hierarchical Multiclass Classification of Software Vulnerabilities
• Predicting Missing Information of Key Aspects in Vulnerability Reports
• Software Security Patch Management -- A Systematic Literature Review of Challenges, Approaches, Tools and Practices
• Legal Risks of Adversarial Machine Learning Research

Cited by in corpus (4)

• Toward Improved Deep Learning-based Vulnerability Detection
• Automated Code-centric Software Vulnerability Assessment: How Far Are We? An Empirical Study in C/C++
• An Overview of Integration of the Virtualization of Network Functions in the Context of Information Centric Networks
• Automated Security Assessment for the Internet of Things