<i>Mujaz</i> : A Summarization-Based Approach for Normalized Vulnerability Description

Public vulnerability databases are an indispensable source of information for tracking vulnerabilities and ensuring their consistency and readability is crucial for developers and organizations to patch and update their products accordingly. While the prior works improve consistency, unifying and standardizing vulnerability descriptions is mostly unexplored. In this paper, we present <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">Mujaz</i>, a multi-task natural language processing-based system to normalize and summarize vulnerability descriptions. In doing so, we introduce a parallel and manually annotated corpus of vulnerability summaries and annotations that emphasizes several constituent entities representing a particular aspect of the description. <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">Mujaz</i> employs pre-trained language models, fine-tuned for our summarization tasks, allowing for joint and independent training for those tasks and producing operational results in terms of ROUGE score and compression ratio. Using human evaluation metrics, we also show <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">Mujaz</i> produces complete, correct, understandable, fluent, and uniform summaries. Experts evaluation was conducted to investigate <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">Mujaz</i>'s effectiveness, providing simplified, coherent, and understandable descriptions.