Wallarm Inc., a leading developer of AI-based Web Application security solutions, and Vulners.com, the security database of software vulnerabilities in machine-readable format, today announced the release of a free vulnerability assessment tool that utilizes a unique neutral neural network algorithm to automatically predict the severity of a vulnerability, and its potential negative impact, providing a Common Vulnerability score (CVSSv2) for any vulnerability in a matter of seconds. The tool is accessible via a web interface for free public use: https://vulners.com/apiscan-help
The training set for the algorithm comes from many years of Wallarm protecting hundreds of thousands of applications and tracking traffic & attack statistics, and Vulners’ extensive database of known security vulnerabilities. The software to predict the future of vulnerabilities was developed by Wallarm’s research team and is open source. Wallarm and Vulners have created a free public web-based tool which allows any user to easily access the neural network algorithm and run an automated vulnerability analysis. The average accuracy of predictions was measured at 87%.
This tool allows security professionals to drastically reduce zero day vulnerability windows by obtaining automated severity score as soon as vulnerabilities are discovered and descriptions are available. By contrast, NIST’s national vulnerability database takes one to three days to include scored vulnerabilities into their feed. The tool also provides an independent assessment criteria so that the teams can focus their limited resources on the vulnerability that scored high by both human and AI scorers.
Software vendors and white hat security professionals who run bounty programs or discover new vulnerabilities can use the tool to predict the severity and prioritize fixes before the vulnerability is released to the public.
The Wallarm team has done an amazing job. Together, we have made a huge step on the path to Vulnerability Intelligence as it should be. With only one compute node we have analyzed whole 679,000 vulnerabilities in our database in less than one day. And the results are brilliant — using Vulners DB with neural scoring network, you can get a CVSS score for absolutely any vulnerability. No need to guess “how harmful this exploit is” any more. The final countdown for manual CVSS filling and human vulnerability analysis has started.— said Kir Ermakov, Vulners CEO.
Under the hood of the CVSS risk prediction
Training Set.
Wallarm has exported 121Mb of raw text of the vulnerability bulletins from vulners.com database classified by CVSSv2 clusters from 1.0 to 10.0 (91 classes total). The maximum number of samples in each class to 1000. Finally we received 37796 of unique vulnerability descriptions. The total vocabulary in this data was about 850k unique words.
Neural Networks.
We use a convolution group consisting of three classic convolution layers with different size of kernels which enables recognition of words and collocations.
for i, filter_size in enumerate(filter_sizes):
with tf.name_scope("conv-maxpool-%s" % filter_size):
# Convolution Layer
filter_shape = [filter_size, embedding_size, 1, num_filters]
W = tf.Variable(tf.truncated_normal(filter_shape, stddev=0.1), name="W")
b = tf.Variable(tf.constant(0.1, shape=[num_filters]), name="b")
conv = tf.nn.conv2d( self.embedded_chars_expanded, W, strides=[1, 1, 1, 1], padding="VALID", name="conv")
# Apply nonlinearity
self.h = tf.nn.relu(tf.nn.bias_add(conv, b), name="relu")
# Max-pooling over the outputs
P = tf.nn.max_pool( self.h, ksize=[1, max_pool_size, 1, 1], strides=[1, max_pool_size, 1, 1], padding='VALID', name="pool")
pooled = tf.reshape(P, [-1, reduced, num_filters])
pooled_outputs.append(P)
To create this classifier we used tensorflow rnn_cell to be able to predict CVSSv2 classes not only by sets of words but also by contextual awareness of the word combinations.
lstm_cell = tf.nn.rnn_cell.GRUCell(num_units=hidden_unit) lstm_cell = tf.nn.rnn_cell.DropoutWrapper(lstm_cell, output_keep_prob=self.dropout_keep_prob)
Neural Network DiagramNeural networks can do anything nowadays, from image recognition to predicting epidemics. They have also proven to be an invaluable tool for information security as well. For this project, we have created a convolution recurrent network to predict CVSSv2 score for the vulnerabilities by text description, and the results have exceeded all expectations. Now security researchers have a free, powerful and reliable tool for vulnerability assessment and impact prediction — said Ivan Novikov, CEO and co-founder of Wallarm.
