Multi-Source Vulnerability Event Graphs with NLP and Code Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing vulnerability data sets lack standardization and comprehensive representation of event attributes, making it difficult to intuitively understand and analyze vulnerabilities, and existing knowledge graphs struggle to represent event attributes such as triggering conditions, causes, and consequences.
Innovation Solution
An automatic event graph construction method for multi-source vulnerability information using BERT+BiLSTM+CRF models to extract event elements and relations, completing missing information from multiple databases, and representing vulnerability codes with AST, CFG, and PDG, then visualizing the data into a graph.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If traditional knowledge graphs are used to represent vulnerability information, then basic attributes such as product names and CVSS scores can be stored, but event attributes such as triggering conditions, causes, and consequences cannot be properly represented
Solution Approach 1:
The patent segments the vulnerability representation into two distinct parts: basic attributes (product names, CVSS scores) and event attributes (triggering conditions, causes, consequences). By using event graphs instead of traditional knowledge graphs, the system can separately model and represent these different types of attributes, allowing proper representation of temporal and causal relationships while maintaining basic vulnerability information.
Solution Approach 2:
The patent transitions from a traditional knowledge graph structure to an event graph structure, adding temporal and causal dimensions to the representation. This dimensional change enables the system to represent event attributes like triggering conditions, causes, and consequences that were previously impossible to capture in traditional vulnerability knowledge graphs.
2Manufacturing precision
If manual construction of vulnerability data sets is performed, then high-quality and standardized data can be obtained, but human resources and time consumption increase significantly
Solution Approach 1:
The system performs self-service by automatically extracting event attributes from vulnerability reports using NLP techniques. The event graph construction system autonomously processes vulnerability data, identifying triggering conditions, causes, and consequences without requiring manual annotation or curation, thereby maintaining data standardization while significantly reducing human resource requirements and construction time.
Solution Approach 2:
The patent replaces manual mechanical processing of vulnerability data with automated NLP-based extraction systems. Instead of manually parsing and standardizing vulnerability reports, the system uses computational methods to automatically extract event attributes, transforming the construction process from manual labor to automated processing while maintaining high data quality and standardization.
3Adaptability or versatility
If multi-source vulnerability information is integrated, then comprehensive vulnerability coverage is achieved, but information complexity and messiness increase
Solution Approach 1:
The patent merges multiple sources of vulnerability information (CVE, NVD, IBM X-Force Exchange) into a unified event graph structure. By combining data from these diverse sources and standardizing them into a common representation format, the system achieves comprehensive vulnerability coverage while reducing information complexity through consistent structuring and normalization.
Solution Approach 2:
The system applies parameter changes by transforming diverse vulnerability information from multiple sources into standardized event graph parameters. Each vulnerability record is converted into a consistent structure with standardized fields for triggering conditions, causes, and consequences, thereby maintaining comprehensive coverage while simplifying the information structure through uniform parameterization.
Data Source
AI summary
Provided is an automatic event graph construction method for multi-source vulnerability information. The method includes the following steps. A vulnerability report is crawled from a vulnerability database, a cause of vulnerability is taken as an event trigger word, and a vulnerability type is determined through the cause of vulnerability. An attacker, consequence, location and other information in a description are identified by named-entity recognition, and information completion is performed. An explicit relation between events is extracted by using text information, an implicit relation between events is extracted by using text similarity, and vulnerability-related code representation is performed. Obtained vulnerability event information is visualized into an event graph through a visualization tool.