On the Usage of NLP on CVE Descriptions for Calculating Risk

In order to conduct a risk analysis on an ecosystem the potential threats to its assets must first be identified. The Risk Modelling Tool (RMT) of the CitySCAPE Project uses CWE - CAPEC - threat relationships that were mapped for identifying the threats that vulnerabilities can pose on specific assets, namely in the context of multimodal transport use cases, based on already existing vulnerabilities. However, nearly one third of all CVEs do not have any CWEs assigned to them or have generic CWEs like “NVD-CWE-Other” that do not offer any information about that vulnerability, to then be linked back to a threat. This paper proposes the use of a Natural Language Processing model and more specifically a text classification model to be trained on CVE descriptions that can be traced back to a threat using the created mapping. The model will therefore be able to extrapolate the threat that a specific vulnerability will expose and be detected earlier, allowing security analysts to be able to deploy countermeasures to combat that risk. The resulting model has an accuracy of over 90% across a ten-fold validation process. As such a more complete and accurate risk analysis can be performed using the larger number of applicable vulnerabilities found using our ML model.