A Deep Learning Framework for Software Vulnerability Classification Using Transfer Learning

Organizations use the data gathered by central intelligence agencies for cyber security to stop or lessen cyberattacks. Numerous security products worldwide use the National Vulnerability Database (NVD) and Common Vulnerabilities and Exposures (CVE). These databases are essential for gathering information about cyber threats. Prior research has demonstrated that these vulnerability databases frequently include errors and redundancies, requiring security specialists to perform a human assessment. Such redundancies complicate efforts to prevent attacks and compromise the integrity of the products. A deep framework is proposed for automatic software vulnerability classification using Bidirectional Encoder Representations from Transformers (BERT) and Robustly Optimized BERT (RoBERTa) to assist security analysts in validating vulnerability databases with greater accuracy and efficiency. The proposed architecture employs transfer learning in the deep neural network, specifically utilizing BERT and RoBERTa, to identify the type of software vulnerability from the description text within a report. A total of 202,273 vulnerability reports from the CVE Database are used, leveraging BERT and RoBERTa to evaluate the performance of the vulnerability classification system. The experimental results demonstrate that the RoBERTa-Deep Neural Network (DNN) model surpasses both the BERT-DNN model and the existing state-of-the-art models and gains 99.97% accuracy, confirming the methodology's effectiveness for minimizing cyber-attacks.