基于序列标注的漏洞信息结构化抽取方法  

STRUCTURED EXTRACTION METHOD FOR VULNERABILITY INFORMATION BASED ON SEQUENCE LABELING

作　　者：陈钧衍 陶非凡 张源[1] Chen Junyan;Tao Feifan;Zhang Yuan(School of Computer Science,Fudan University,Shanghai 201203,China;Shanghai General Recognition Technology Research Institute,Shanghai 201114,China)

机构地区：[1]复旦大学软件学院,上海201203 [2]上海通用识别技术研究所,上海201114

出　　处：《计算机应用与软件》2020年第2期266-271,276,共7页Computer Applications and Software

基　　金：国家自然科学基金项目(U1636204,61602123,U1836210,U1736208,U1836213,61602121);国家重点基础研究发展计划项目(2015CB358800);上海市青年科技英才扬帆计划项目(16YF1400800)。

摘　　要：从漏洞信息当中抽取结构化信息对于安全研究而言有重要意义。安全研究者常需要在大规模的CVE数据中按特定要求进行筛选,或对漏洞进行自动化的分析测试。然而现有的CVE数据库中只包含了非结构化的文本描述和并不完备的辅助信息。从描述文本抽取结构化的信息能帮助研究者更好地组织与分析CVE。总结漏洞描述包含的七种核心要素,为结构化抽取建立模型,并将信息抽取转换为一个序列标注模型,构建数据集对其进行训练。实验表明,该模型能够以较高的准确率从CVE文本中抽取出各类关键信息。It is very important for security research to extract structured information from vulnerability information.Security researchers often need to screen according to specific requirements in large-scale CVE data,or perform automatic analysis and testing of vulnerabilities.However,the existing CVE database only contains unstructured text description and incomplete auxiliary information.Extracting structured information from descriptive texts can help researchers better organize and analyze CVE.This paper summarizes the seven key elements of vulnerability description,establishes a model for structured extraction,transforms information extraction into a sequence labeling model,and constructs a data set to train it.Experimental results show that the model can extract all kinds of key information from CVE text with high accuracy.

关 键 词：CVE 机器学习 自然语言处理 

分 类 号：TP309.02[自动化与计算机技术—计算机系统结构]