Predicting CVSS Base Metrics of Software Vulnerabilities Using MultiCNN

The continuous emergence of software vulnerabilities necessitates efficient and accurate risk assessment for effective threat mitigation. Prioritizing vulnerabilities for remediation requires a thorough evaluation of their potential impact. This study focuses on predicting common vulnerability scoring system (CVSS) base metrics directly from vulnerability descriptions using convolutional neural networks (CNNs). To achieve this, the study introduces a MultiCNN model, an ensemble of multiple CNNs, where each CNN specializes in predicting a specific CVSS metric, such as attack vector, attack complexity, user interaction, scope, confidentiality impact, and availability impact. The individual CNNs are trained on textual vulnerability descriptions alongside their corresponding CVSS metrics, both sourced from the National Vulnerability Database. This research demonstrates that the MultiCNN model offers an innovative solution to CVSS metric prediction, leveraging the strengths of its architecture to achieve accurate predictions. The practical implication of this work includes significant improvements in automated vulnerability risk assessment, facilitating better decision-making in cybersecurity.