It is increasingly suggested to identify emerging software vulnerabilities (SVs) through relevant development activities (e.g., issue reports) to allow early warnings to open source software (OSS) users. However, the support for the following assessment of the detected SVs has not yet been explored. SV assessment characterizes the detected SVs to prioritize limited remediation resources on the critical ones. To fill this gap, we aim to enable early vulnerability assessment based on SV-related issue reports (SIR). Besides, we observe and further propose an approach (namely proEVA) to address the following concerns of the existing assessment techniques: 1) the assessment output lacks rationale and practical value; 2) the associations between Common Vulnerability Scoring System (CVSS) metrics have been ignored; 3) insufficient evaluation sce-narios and metrics. Based on the observation of strong associations between CVSS metrics, we propose a prompt-based model to exploit such relations for CVSS metrics prediction. Moreover, we design a curriculum-learning (CL) schedule to guide the model better learn such hidden associations during training. Aside from the standard classification metrics adopted in existing works, we propose two severity-aware metrics to provide a more comprehensive evaluation regarding the prioritization of the high-severe SVs. Experimental results show that proEVA significantly outperforms the baselines in both types of metrics. We further discuss the transferability of the prediction model regarding the upgrade of the assessment system, an important yet overlooked evaluation scenario in existing works. The results verify that proEVA is more efficient and flexible in migrating to different assessment systems.
Wed 17 AprDisplayed time zone: Lisbon change
11:00 - 12:30 | AI & Security 1Research Track / Journal-first Papers at Grande Auditório Chair(s): Tevfik Bultan University of California at Santa Barbara | ||
11:00 15mTalk | Towards More Practical Automation of Vulnerability Assessment Research Track Shengyi Pan Zhejiang University, Lingfeng Bao Zhejiang University, Jiayuan Zhou Huawei, Xing Hu Zhejiang University, Xin Xia Huawei Technologies, Shanping Li Zhejiang University | ||
11:15 15mTalk | VGX: Large-Scale Sample Generation for Boosting Learning-Based Software Vulnerability Analyses Research Track Yu Nong Washington State University, Richard Fang Washington State University, Guangbei Yi Washington State University, Kunsong Zhao The Hong Kong Polytechnic University, Xiapu Luo The Hong Kong Polytechnic University, Feng Chen University of Texas at Dallas, Haipeng Cai Washington State University | ||
11:30 15mTalk | MalCertain: Enhancing Deep Neural Network Based Android Malware Detection by Tackling Prediction Uncertainty Research Track haodong li Beijing University of Posts and Telecommunications, Guosheng Xu Beijing University of Posts and Telecommunications, Liu Wang Beijing University of Posts and Telecommunications, Xusheng Xiao Arizona State University, Xiapu Luo The Hong Kong Polytechnic University, Guoai Xu Harbin Institute of Technology, Shenzhen, Haoyu Wang Huazhong University of Science and Technology | ||
11:45 15mTalk | Pre-training by Predicting Program Dependencies for Vulnerability Analysis Tasks Research Track Zhongxin Liu Zhejiang University, Zhijie Tang Zhejiang University, Junwei Zhang Zhejiang University, Xin Xia Huawei Technologies, Xiaohu Yang Zhejiang University | ||
12:00 15mTalk | Investigating White-Box Attacks for On-Device Models Research Track Mingyi Zhou Monash University, Xiang Gao Beihang University, Jing Wu Monash University, Kui Liu Huawei, Hailong Sun Beihang University, Li Li Beihang University | ||
12:15 7mTalk | VulExplainer: A Transformer-Based Hierarchical Distillation for Explaining Vulnerability Types Journal-first Papers Michael Fu Monash University, Van Nguyen Monash University, Kla Tantithamthavorn Monash University, Trung Le Monash University, Australia, Dinh Phung Monash University, Australia Link to publication DOI | ||
12:22 7mTalk | SIEGE: A Semantics-Guided Safety Enhancement Framework for AI-enabled Cyber-Physical Systems Journal-first Papers Jiayang Song University of Alberta, Xuan Xie University of Alberta, Lei Ma The University of Tokyo & University of Alberta DOI |