Systems and methods for a text mining approach for predicting exploitation of vulnerabilities
Various embodiments of a computer-implemented framework for predicting exploitation of software vulnerabilities are disclosed.
1. A method, comprising:
utilizing a neural network to learn a context-based distributed representation from data associated with the deep or dark web, the data including discussions about vulnerabilities and corresponding exploits; and
training a classifier utilizing the context-based distributed representation as a feature to the classifier such that the classifier is configured to output a classification for predicting an exploitation of a vulnerability associated with a communication, the classification considering a context of words from the communication,
wherein the classifier is implemented using a support vector machine with a radial basis kernel, wherein the support vector machine classifies communications by finding a set of hyper-planes that best separates each of the communications into a class.
2. The method of claim 1 , wherein the context-based distributed representation includes a paragraph embedding defined by a distributed representation of an entire post of the data to learn a global context of words in the entire post.
3. The method of claim 2 , wherein the context-based distributed representation comprises a word embedding that projects words in a lower-dimensional vector space with d dimensions, so that each word w i is represented by a d-dimensional vector.
4. The method of claim 1 , wherein the classifier utilizes further features including a frequency of mention or a common vulnerability scoring system (CVSS) score.