Large language model-based vulnerability remediation action descriptions
A vulnerability documentation system detects vulnerabilities having outdated or undocumented formatted descriptions for corresponding remediation actions. A web crawler crawls the Internet for configuration data for software/firmware affected by the detected vulnerabilities and descriptive content for the remediation actions. The vulnerability documentation system prompts and LLM with a prompt for each detected vulnerability comprising instructions to generate a formatted description for remediation actions using the crawled configuration data/descriptive content. The vulnerability documentation system then populates natural language descriptions of remediation actions from the formatted descriptions and pushes the natural language descriptions to affected devices.
1 . A method comprising:
based on detecting a first vulnerability not having a formatted description of first one or more remediation actions for software affected by the first vulnerability, retrieving configuration data for software and website content describing the first one or more remediation actions,
wherein retrieving the website content comprises,
crawling a trusted uniform resource locator (URL) known to describe a remediation for the first vulnerability; and
processing at least one of JavaScript® content, HyperText Markup Language content, and Portable Document Format content in one or more HyperText Transfer Protocol responses from the trusted URL;
generating a prompt comprising the configuration data, the website content, example configuration data and example website content for second one or more vulnerabilities, and example formatted descriptions of second one or more remediation actions for software affected by each of the second one or more vulnerabilities, wherein the prompt comprises a set of one or more task instructions to generate a formatted description of the first one or more remediation actions;
prompting a foundation model with the prompt to obtain a formatted description of the first one or more remediation actions; and
storing the formatted description of the first one or more remediation actions in association with the first vulnerability.
2 . The method of claim 1 , further comprising generating a natural language description for the first one or more remediation actions based, at least in part, on the formatted description of the first one or more remediation actions.
3 . The method of claim 1 , wherein the formatted descriptions of the second one or more remediation actions comprise indications of vendors, products, and product versions for affected software products and vendors, and product versions for patched software products.
4 . The method of claim 3 , wherein the prompt indicates that version numbers for product versions of affected software products are to be less than version numbers for product versions of patched software products indicated in the formatted description of the first one or more remediation actions.
5 . The method of claim 3 , further comprising, based on a determination that, in the formatted description of the first one or more remediation actions, a product version indicated for an affected software product is less than a product version indicated for a patched software product, at least one of cleaning the formatted description of the first one or more remediation actions and blocking the formatted description of the first one or more remediation actions from storage.
6 . The method of claim 1 , wherein the trusted URL comprises a URL for a vendor associated with the software affected by the first vulnerability.
7 . The method of claim 1 , wherein the formatted descriptions of the first one or more remediation actions and the second one or more remediation actions are in the JavaScript® Object Notation format.
8 . The method of claim 1 , wherein the foundation model comprises a large language model.
9 . A non-transitory machine-readable medium having program code stored thereon, the program code comprising instructions to:
detect a first vulnerability having at least one of undocumented and outdated formatted descriptions for first one or more remediation actions of the first vulnerability;
retrieve configuration data for affected software and website content describing the first one or more remediation actions, wherein the instructions to retrieve the website content comprise instructions to,
crawl a trusted uniform resource locator (URL) known to describe a remediation for the first vulnerability; and
process at least one of JavaScript® content, HyperText Markup Language content, and Portable Document Format content in one or more HyperText Transfer Protocol responses from the trusted URL;
generate a prompt comprising a set of one or more task instructions to generate a formatted description of the first one or more remediation actions based, at least in part, on the configuration data and the website content;
prompt a foundation model with the prompt to obtain a formatted description of the first one or more remediation actions; and
store the formatted description of the first one or more remediation actions in association with the first vulnerability.
10 . The non-transitory machine-readable medium of claim 9 , wherein the program code further comprises instructions to generate a natural language description for the first one or more remediation actions based, at least in part, on the formatted description of the first one or more remediation actions.
11 . The non-transitory machine-readable medium of claim 9 , wherein the prompt comprises example configuration data and website content for second one or more vulnerabilities, and example formatted descriptions of second one or more remediation actions for software affected by each of the second one or more vulnerabilities.
12 . The non-transitory machine-readable medium of claim 11 , wherein the formatted descriptions of the second one or more remediation actions comprise indications of vendors, products, and product versions for affected software and vendors, products, and product versions for patched software products.
13 . The non-transitory machine-readable medium of claim 9 , wherein the formatted description of the first one or more remediation actions is in the JavaScript® Object Notation format.
14 . The non-transitory machine-readable medium of claim 9 , wherein the foundation model comprises a large language model.
15 . An apparatus comprising:
a processor; and
a machine-readable medium having instructions stored thereon that are executable by the processor to cause the apparatus to,
detect vulnerabilities having at least one of undocumented and outdated formatted descriptions for corresponding remediation actions;
retrieve configuration data for software affected by the detected vulnerabilities and descriptive content for remediation actions for the detected vulnerabilities, wherein the instructions to retrieve the descriptive content comprise instructions executable by the processor to cause the apparatus to,
crawl a first trusted website known to describe a remediation for the detected vulnerabilities; and
process at least one of JavaScript® content, HyperText Markup Language content, and Portable Document Format content in one or more HyperText Transfer Protocol responses from the first trusted website; and
for each vulnerability of the detected vulnerabilities,
generate a prompt comprising one or more task instructions to generate a formatted description of first one or more remediation actions for the vulnerability based, at least in part, on retrieved configuration data and retrieved descriptive content for the vulnerability;
prompt a foundation model with the prompt to obtain the formatted description; and
store the formatted description in association with the vulnerability.
16 . The apparatus of claim 15 , wherein the machine-readable medium further has stored thereon instructions executable by the processor to cause the apparatus to:
generate natural language descriptions from the formatted descriptions for remediation actions of the detected vulnerabilities; and
push the natural language descriptions to devices affected by corresponding ones of the detected vulnerabilities.
17 . The apparatus of claim 15 , wherein the prompt comprises example configuration data and descriptive content for second one or more vulnerabilities, and example formatted descriptions of second one or more remediation actions for at least one of software affected by each of the second one or more vulnerabilities.
18 . The apparatus of claim 15 , wherein the instructions to retrieve the descriptive content comprise instructions executable by the processor to cause the apparatus to,
crawl a second trusted website known to describe remediations for the vulnerabilities, wherein the second trusted website is indicated in web pages of the first trusted website; and
process HyperText Transfer Protocol (HTTP) responses from the second trusted website to obtain the descriptive content.
19 . The apparatus of claim 15 , wherein the formatted description of the first one or more remediation actions is in the JavaScript® Object Notation format.
20 . The apparatus of claim 15 , wherein the foundation model comprises a large language model.