Machine learning techniques for generating common vulnerability scoring system vectors

1 . A method for generating common vulnerability scoring system (CVSS) vectors of vulnerabilities for use by a vulnerability scanning system in scanning a computing environment for the vulnerabilities, each particular one of the CVSS vectors comprising values of a plurality of risk metrics determined for a vulnerability associated with the particular CVSS vector, the method comprising:

using at least one computer hardware processor to perform:

generating, using a plurality of trained machine learning (ML) models corresponding to the plurality of risk metrics, a CVSS vector for each particular vulnerability in a set of one or more vulnerabilities to obtain one or more CVSS vectors, the generating comprising:

obtaining a textual description of the particular vulnerability;

generating a CVSS vector for the particular vulnerability using the textual description of the particular vulnerability and the plurality of trained ML models corresponding to the plurality of risk metrics, each of the plurality of trained ML models having been trained to produce an output indicating a value of a respective one of the plurality of risk metrics for the particular vulnerability, the generating comprising:

generating inputs for each of the plurality of ML models using the textual description of the particular vulnerability, the generating comprising:

tokenizing the textual description of the vulnerability to obtain a plurality of tokens; and

embedding the plurality of tokens using an embedding model to obtain a numerical representation of the textual description of the vulnerability;

providing the inputs to the plurality of ML models to obtain outputs indicating values of the plurality of risk metrics for the particular vulnerability, the providing comprising providing the numerical representation as input to each of the plurality of ML models; and

storing the values of the plurality of risk metrics indicated by the outputs of the plurality of ML models in a vector to obtain the CVSS vector for the particular vulnerability;

scanning, using the vulnerability scanning system, the computing environment for one or more vulnerabilities in the set of one or more vulnerabilities using the one or more CVSS vectors generated for the set of one or more vulnerabilities;

detecting at least one of the set of one or more vulnerabilities in the computing environment during the scanning; and

in response to detecting the at least one vulnerability in the computing environment:

applying at least one patch in the computing environment to mitigate risk caused by the at least one vulnerability.

2 . The method of claim 1 , wherein the plurality of trained ML models comprises a plurality of trained neural networks.

3 . The method of claim 2 , wherein the plurality of trained neural networks is a plurality of 1-dimensional (1D) convolutional neural networks (CNNs).

4 . The method of claim 3 , wherein each of the plurality of 1D CNNs comprises:

an embedding layer;

a plurality of convolutional layers; and

a plurality of fully-connected layers.

5 . The method of claim 2 , wherein:

generating the inputs for the plurality of trained ML models comprises:

generating numerical representations of words in the textual description of the vulnerability; and

providing the numerical representations of the words to embedding layers of the plurality of neural networks to obtain the plurality of inputs for the plurality of ML models.

6 . The method of claim 1 , wherein the plurality of trained ML models comprises:

a first ML model trained to produce an output indicating a value of a first one of the plurality of risk metrics; and

a second ML model trained to produce an output indicating a value of a second one of the plurality of risk metrics, wherein the second ML model is a different type of ML model than the first ML model.

7 . The method of claim 1 , wherein the plurality of trained ML models comprises one or more of a naïve Bayes (NB) model, a large language model (LLM), a logistic regression model, a random forest model, a gradient-boosted decision tree, a support vector machine (SVM), or a neural network.

8 . The method of claim 1 , further comprising:

replacing, in the vulnerability scanning system, one or more default CVSS vectors previously used to scan for the set of one or more vulnerabilities with the one or more generated CVSS vectors; and

scanning, using the vulnerability scanning system, the computing environment for the set of one or more vulnerabilities after replacing the one or more default CVSS vectors with the one or more generated CVSS vectors.

9 . The method of claim 1 , further comprising:

receiving, from at least one computing device, one or more requests to generate the one or more CVSS vectors for the set of one or more vulnerabilities, the one or more requests indicating a textual description of each of the set of one or more vulnerabilities; and

generating the CVSS vector for each particular vulnerability in the set of one or more vulnerabilities to obtain the one or more CVSS vectors in response to receiving the one or more requests.

10 . The method of claim 1 , wherein the plurality of risk metrics comprises an attack vector, an attack complexity, a level of privileges required, whether a user interaction is required, a scope, a confidentiality impact, an integrity impact, and/or an availability impact.

11 . The method of claim 1 , wherein storing the values of the plurality of risk metrics in a vector to obtain the CVSS vector for the vulnerability comprises:

storing a string value for each of the plurality of risk metrics in the vector.

12 . The method of claim 1 , further comprising:

obtaining a training dataset comprising a plurality of CVSS vectors and a plurality of textual descriptions of vulnerabilities associated with the plurality of CVSS vectors;

obtaining, from the plurality of CVSS vectors, a set of values of each of the plurality of risk metrics thereby obtaining a plurality of sets of risk metric values corresponding to the plurality of risk metrics; and

using each of the plurality of sets of risk metric values and the textual descriptions of the vulnerabilities to train a respective ML model to produce an output indicating a value of a risk metric corresponding to the set of risk metric values to obtain the plurality of trained ML models.

13 . The method of claim 1 , wherein generating the CVSS vector for the particular vulnerability comprises generating a CVSS 3.1 vector.

14 . The method of claim 1 , wherein generating the CVSS vector for the particular vulnerability comprises generating a CVSS 4 vector.

15 . At least one non-transitory computer-readable storage medium storing instructions that, when executed by at least one computer hardware processor, cause the at least one computer hardware processor to perform a method for generating common vulnerability scoring system (CVSS) vectors for vulnerabilities to use by a vulnerability scanning system in scanning a computing environment for the vulnerabilities, each particular one of the CVSS vectors comprising values of a plurality of risk metrics that are used to determine a risk score for a vulnerability associated with the particular CVSS vector, the method comprising:

generating, using a plurality of trained machine learning (ML) models corresponding to the plurality of risk metrics, a CVSS vector for each particular vulnerability in a set of one or more vulnerabilities to obtain one or more CVSS vectors, the generating comprising:

obtaining a textual description of the particular vulnerability;

generating a CVSS vector for the particular vulnerability using the textual description of the particular vulnerability and the plurality of trained ML models corresponding to the plurality of risk metrics, each of the plurality of trained ML models having been trained to produce an output indicating a value of a respective one of the plurality of risk metrics for the particular vulnerability, the generating comprising:

generating inputs for each of the plurality of ML models using the textual description of the particular vulnerability, the generating comprising:

tokenizing the textual description of the vulnerability to obtain a plurality of tokens; and

embedding the plurality of tokens using an embedding model to obtain a numerical representation of the textual description of the vulnerability; providing the inputs to the plurality of ML models to obtain outputs indicating values of the plurality of risk metrics for the particular vulnerability,

the providing comprising providing the numerical representation as input to each of the plurality of ML models; and

storing the values of the plurality of risk metrics indicated by the outputs of the plurality of ML models in a vector to obtain the CVSS vector for the particular vulnerability;

scanning, using the vulnerability scanning system, the computing environment for one or more vulnerabilities in the set of one or more vulnerabilities using the one or more CVSS vectors generated for the set of one or more vulnerabilities;

detecting at least one of the set of one or more vulnerabilities in the computing environment during the scanning; and

in response to detecting the at least one vulnerability in the computing environment:

applying at least one patch in the computing environment to mitigate risk caused by the at least one vulnerability.

16 . A system for generating common vulnerability scoring system (CVSS) vectors of vulnerabilities for use by a vulnerability scanning system in scanning a computing environment for the vulnerabilities, each particular one of the CVSS vectors comprising values of a plurality of risk metrics determined for a vulnerability associated with the particular CVSS vector, the system comprising:

at least one computer hardware processor; and

at least one non-transitory computer-readable storage medium storing instructions that, when executed by the at least one computer hardware processor, causes the at least one computer hardware processor to perform:

generating, using a plurality of trained machine learning (ML) models corresponding to the plurality of risk metrics, a CVSS vector for each particular vulnerability in a set of one or more vulnerabilities to obtain one or more CVSS vectors, the generating comprising:

obtaining a textual description of the particular vulnerability;

generating a CVSS vector for the particular vulnerability using the textual description of the particular vulnerability and the plurality of trained ML models corresponding to the plurality of risk metrics, each of the plurality of trained ML models having been trained to produce an output indicating a value of a respective one of the plurality of risk metrics for the particular vulnerability, the generating comprising:

generating inputs for each of the plurality of ML models using the textual description of the particular vulnerability, the generating comprising:

tokenizing the textual description of the vulnerability to obtain a plurality of tokens; and

embedding the plurality of tokens using an embedding model to obtain a numerical representation of the textual description of the vulnerability;

providing the inputs to the plurality of ML models to obtain outputs indicating values of the plurality of risk metrics for the particular vulnerability, the providing comprising providing the numerical representation as input to each of the plurality of ML models; and storing the values of the plurality of risk metrics indicated by the outputs of the plurality of ML models in a vector to obtain the CVSS vector for the particular vulnerability;

scanning, using the vulnerability scanning system, the computing environment for one or more vulnerabilities in the set of one or more vulnerabilities using the one or more CVSS vectors generated for the set of one or more vulnerabilities; and

detecting at least one of the set of one or more vulnerabilities in the computing environment during the scanning; and

in response to detecting the at least one vulnerability in the computing environment:

applying at least one patch in the computing environment to mitigate risk caused by the at least one vulnerability.