A Hybrid CNN–LSTM Approach for Predicting Software Vulnerability Exploitability

Objectives: Software vulnerabilities pose a serious threat to cybersecurity. When vulnerabilities are publicly disclosed, organizations must quickly determine which vulnerability requires immediate attention. This study focuses on predicting software vulnerability exploitability at disclosure time using textual information, enabling timely prioritization to reduce the risk of exploitation. Methods: A hybrid model combining Convolutional Neural Network (CNN) and Long Short-Term Memory (LSTM) is used to predict disclosure-time exploitability of a vulnerability. The model uses textual vulnerability information available at disclosure, which includes CVE descriptions and associated CWE names. Vulnerability records are obtained from the National Vulnerability Database (NVD), and exploitability labels are derived from ExploitDB based on the availability of public exploits. Performance is evaluated using accuracy, precision, recall, and F1-score. Findings: The proposed CNN–LSTM model effectively predicts software vulnerability exploitability using textual data. The model achieved an accuracy of 92.33% and an F1-score of 92.08% when using a combined textual input consisting of CVE descriptions and CWE names. Comparative and ablation studies show that the CNN–LSTM architecture outperforms standalone CNN and CNN–BiLSTM models in overall effectiveness. Novelty: The study investigates how CWE information contributes to predicting software vulnerability exploitability. It explores the use of a hybrid CNN–LSTM model to classify the exploitability of vulnerabilities using textual data. The model is also evaluated on recently disclosed vulnerabilities to assess its generalization to new, unseen data and its usefulness for early prioritization. Keywords: Exploitability prediction, software vulnerability, deep learning, convolutional neural network, Common Weakness Enumeration (CWE)