English (United Kingdom)

https://curated-unify.zendy.io/wp-json/zendy-region/v1/featured_content/oa?rat=en

https://curated-unify.zendy.io/wp-json/zendy-region/v1/highlighted_journal/

Global: Zendy Plus annual

Presents the access of premium content as premium feature

Premium Content

Presents the keyphrase highlighting as premium feature

Keyphrase Highlighting

Presents the summarisation as premium feature

Summarisation

Insights

Presents the pdf analysis as premium feature

PDF Analysis

Presents the zaia usage as premium feature

ZAIA

Global: Zendy Plus monthly

Global: Zendy Tools annual

Global: Zendy Tools monthly

Global: Zendy Free Plan

When a new computer security vulnerability is publicly disclosed, only atextual description of it is available. Cybersecurity experts later provide ananalysis of the severity of the vulnerability using the Common VulnerabilityScoring System (CVSS). Specifically, the different characteristics of thevulnerability are summarized into a vector (consisting of a set of metrics),from which a severity score is computed. However, because of the high number ofvulnerabilities disclosed everyday this process requires lot of manpower, andseveral days may pass before a vulnerability is analyzed. We propose toleverage recent advances in the field of Natural Language Processing (NLP) todetermine the CVSS vector and the associated severity score of a vulnerabilityfrom its textual description in an explainable manner. To this purpose, wetrained multiple BERT classifiers, one for each metric composing the CVSSvector. Experimental results show that our trained classifiers are able todetermine the value of the metrics of the CVSS vector with high accuracy. Theseverity score computed from the predicted CVSS vector is also very close tothe real severity score attributed by a human expert. For explainabilitypurpose, gradient-based input saliency method was used to determine the mostrelevant input words for a given prediction made by our classifiers. Often, thetop relevant words include terms in agreement with the rationales of a humancybersecurity expert, making the explanation comprehensible for end-users.

CVSS-BERT: Explainable Natural Language Processing to Determine the Severity of a Computer Security Vulnerability from its Description