VulnBERTa: On Automating CWE Weakness Assignment and Improving the Quality of Cybersecurity CVE Vulnerabilities Through ML/NLP

Vulnerability management is a critical industry activity driven by compliance and regulations aiming to efficiently allocate best-fitted resources to address vulnerabilities. The cybersecurity community is global; thus, the produced vulnerability reports vary in quality and perspective. To tackle the discrepancies, machine learning (ML) has shown promise in automating vulnerability assignments. While some existing ML approaches have demonstrated feasibility, there is room for improvement. Additionally, gaps remain in the literature in understanding how the specific terminology used in vulnerability databases and reports influences ML interpretation. In this paper, we aim to close several such gaps. First, based on the RoBERTa transformer architecture, we introduce a systematic methodology to assign Common Weakness Enumerations (CWE)-related information to a vulnerability description automatically. For that purpose, we develop a cybersecurity-focused model, VulnBERTa. Second, we apply our VulnBERTa model(s) to retroactively and automatically assign CWEs to unassigned National Institute of Standards and Technology (NIST) National Vulnerability Database (NVD) entries, thus improving the quality of open cybersecurity data. Our pre-liminary results are on par with comparable state-of-the-art while achieving higher classification granularity and scale.