FVulPri: Fine-grained vulnerability prioritization based on BERT-BGRU and multiple indicators

Introduction:

Extensive efforts have been made to mitigate the impact of software vulnerabilities on information security. The researchers aim to prioritize vulnerabilities after they are disclosed and then take remediation actions. However, existing methods have problems such as a low degree of automation, coarse-grained granularity and insufficient scoring indicators.

Objectives:

This paper aims to provide a new approach to vulnerability prioritization, bridging the existing shortcomings with a more comprehensive evaluation system, improving the automation of the process and providing fine-grained scoring.

Methods:

In this paper, we propose FVulPri, a fine-grained vulnerability prioritization method that ranks software vulnerabilities at the function-level for the first time. FVulPri employs the BERT-BGRU model to evaluate vulnerability severity, introduces a novel code learning approach to analyze vulnerability-related functions and integrates multiple indicators to provide a comprehensive assessment.

Results:

The experimental results show that FVulPri has a more reasonable distribution compared to the CVSS (Common Vulnerability Scoring System) scores, achieves an average of 69.06% effectiveness on newly added function-level metrics, and its ranking results show a stronger alignment with expert assessments than those of CVSS, effectively enhancing the quality of vulnerability prioritization.

Conclusion:

This paper presents a Fine-grained Vulnerability Prioritization Method that leverages BERT-BGRU and multiple indicators to assess 14 metrics across three dimensions, namely necessity, function level, and scope of impact, thereby improving the efficiency and quality of vulnerability prioritization.