![](bg2.png)
2018). Therefore, for security measures, it is im-
portant to collect information on vulnerabilities and
threats appropriately and take immediate action.
The Technical Report on Vulnerability Re-
sponse(Kurotani and Kameyama, 2019, Sect. 2.2.2)
lists vulnerability information, the latest news, ven-
dor sites, and security alerts from public organiza-
tions as information to be obtained. If many pieces of
the information can be quickly collected and properly
utilized, early measures can be taken before security
risks become apparent. A security alert is a public no-
tification issued by security-related organizations or
vendors. Typically, experts from such organizations
take the time to manually determine whether it is a ne-
cessity of a security alert based on the published vul-
nerability information, threats, and damages caused
by the attacks to warn the public of high-risk vulnera-
bilities or cyberattacks. In some cases, system admin-
istrators review their security measures after receiv-
ing a security alert. Therefore, security alerts are one
of the necessary pieces of information for prioritizing
vulnerabilities to be addressed. However, concerning
the publication of security alerts, it takes some time
(few hours or few days long) after a certain vulnera-
bility is disclosed before a security alert based on that
vulnerability is published due to the careful consid-
erations by security experts. If this time gap can be
eliminated, it will be an advantage for security mea-
sures. In addition, when a vulnerability is disclosed,
if it can be determined whether the vulnerability is se-
rious enough to warrant a security alert of public au-
thorities, we can recognize it as a critical vulnerability
that causes harmful damage.
For this reason, the authors have proposed a
method to estimate the severity of vulnerability infor-
mation using machine learning as a method to sup-
port security measures. Our proposal applies the past
alerts and the vulnerability information as labels and
training data and uses machine learning to determine
whether a new vulnerability is a necessity of a se-
curity alert. In this paper, we describe the proposed
method and also report on the evaluation test con-
ducted to assess its accuracy. In the actual application
of machine learning estimation, the present and fu-
ture are predicted from past facts. Therefore, we also
conduct evaluations using training and test data at dif-
ferent periods to know the more accurate performance
of the proposed method.
2 RELATED WORK
The Common Vulnerability Exposure (CVE)(Mann
and Christey, 1999) has been established to facilitate
the sharing of vulnerability information. With this
CVE, each vulnerability is currently managed by as-
signing a unique CVE-ID (ex. NVD, JVN). In addi-
tion to CVE, the Common Vulnerability Scoring Sys-
tem (CVSS) is widely used to evaluate the severity of
vulnerabilities. In CVSS, quantitative scoring meth-
ods are defined, but the calculation of the CVSS ba-
sic values uses such information that the ease of at-
tacks and the value of the information assets to be
protected and does not take into account whether the
related attacks are actually in the wild or not. There-
fore, the policy of prioritizing the vulnerabilities with
high CVSS scores is ineffective in dealing with actual
malicious attacks. To deal with this problem, methods
that take into account the possibility of the generation
of exploit codes that may cause damage to the IT sys-
tem have been studied (Bozorgi et al., 2010; Sabottke
et al., 2015; Xiao et al., 2018; Jacobs et al., 2021;
Yosifova et al., 2021). For example, Exploit Predic-
tion Scoring System (EPSS) (Jacobs et al., 2021) re-
alizes a method to determine the severity of a new
vulnerability by machine learning, using the past vul-
nerability information and whether the correspond-
ing exploit code has been generated as training data.
The EPSS has achieved a Receiver Operating Char-
acteristic Area Under Curve (ROC–AUC) of 0.838
and Precision Recall Area Under Curve (PR–AUC)
of 0.266 in the evaluation. In addition to the studies,
machine learning methods have been used for various
vulnerability responses(Yosifova et al., 2021; Liakos
et al., 2020). For example, they have been used to
classify CVE assigned classes(Yosifova et al., 2021),
and the evaluations have shown that they are suitable
methods for automated vulnerability type classifica-
tion. Although such studies and research have been
conducted, there has been no study on determining
the severity of vulnerabilities using machine learning,
with an index based on whether the vulnerability is
subject to a security alert issued by a public organiza-
tion.
3 SETUP FOR PREDICTING THE
SEVERITY OF
VULNERABILITY
INFORMATION
In this section, our proposed method for predicting
whether or not a vulnerability has a severity that war-
rants a security alert determined by security experts is
described. Specifically, the acquisition and process-
ing of various data as preparation, the machine learn-
ing algorithm used are denoted.
ICISSP 2023 - 9th International Conference on Information Systems Security and Privacy
314