Logs2Vul: Vulnerability Detection from Logs for CSPM

Cloud Security Posture Management (CSPM) is gaining importance with the increase in the adoption of multicloud environments. CSPM focuses not only on visualization and monitoring security postures but also on automating tasks to ensure minimal interference. NIST and MITRE Corporation have invested a tremendous effort in collecting, classifying, and publishing vulnerability incidences as CVE (Common Vulnerabilities and Exposures) datasets. They have also been publishing CWE (Common Weakness Enumerations) data year after year, strengthening Vulnerability Classification by including new Weakness Enumerations. To exploit this wealth of information in the CVE/CWE database in real-time contexts such as CSPM, the outcome of vulnerability classification should respond to some real-time signals or alerts. Although many research efforts use CWE/CVE databases for vulnerability classification, none of them use real-time alerts/signals as input. The research work presented here exploits CVE and CWE databases for the classification of cloud error logs and identifies vulnerabilities in real-time. Cloud error logs being the real-time indicators of the system health, vulnerability classification based on cloud error logs can go far in the automation of CSPM. The framework not only indicates the vulnerability classes corresponding to cloud error logs but also computes a CVS Score (Common Vulnerabilities Severity Score) against each error log. CVS Score indicates the seriousness of threats and thus provides key information for CSPM. The framework uses Deep Learning algorithms such as CNN, LSTM and transformers to build Machine Learning models that are trained on Cloud error logs augmented with CVE descriptions.