Identifying the vulnerabilities exploited during cyberattacks is essential for enabling timely responses and effective mitigation in software security. This paper directly examines the process of predicting software vulnerabilities, specifically Common Vulnerabilities and Exposures (CVEs), from unstructured descriptions of attacks reported in cybersecurity news articles. We propose a semantic similarity-based approach utilizing the multi-qa-mpnet-base-dot-v1 (MPNet) sentence transformer model to generate a ranked list of the most likely CVEs corresponding to each news report. To assess the accuracy of the predicted vulnerabilities, we implement four complementary validation methods: filtering predictions based on similarity thresholds, conducting manual validation, performing semantic comparisons with the first vulnerability explicitly mentioned in each report, and comparing against all CVEs referenced within the report. Experimental results, drawn from a dataset of 100 SecurityWeek news articles, demonstrate that the model attains a precision of 81 percent when employing threshold-based filtering. Manual evaluations report that 70 percent of the predictions are relevant, while comparisons with the initially mentioned CVEs reveal agreement rates of 80 percent with the first listed vulnerability and 78 percent across all referenced CVEs. In 57 percent of the news reports analyzed, at least one predicted vulnerability precisely matched a CVE-ID mentioned in the article. These findings underscore the model's potential to facilitate automated vulnerability identification from real-world cyberattack news reports.

翻译：识别网络攻击中被利用的漏洞对于实现软件安全的及时响应和有效缓解至关重要。本文直接研究了从网络安全新闻报道的非结构化攻击描述中预测软件漏洞（特别是通用漏洞披露CVE）的过程。我们提出了一种基于语义相似度的方法，利用多问答MPNet基础点积模型（multi-qa-mpnet-base-dot-v1）生成与每篇新闻报道最可能对应的CVE排序列表。为评估预测漏洞的准确性，我们实施了四种互补的验证方法：基于相似度阈值的预测过滤、人工验证、与每篇报道中明确提及的首个漏洞进行语义对比，以及与报道中引用的所有CVE进行比对。基于100篇SecurityWeek新闻报道数据集的实验结果表明，采用阈值过滤时模型精确率达到81%。人工评估显示70%的预测具有相关性，而与首次提及CVE的对比显示：与首列漏洞的吻合率为80%，与所有引用CVE的总体吻合率为78%。在分析的新闻报道中，57%的案例中至少有一个预测漏洞与文章中提及的CVE-ID完全匹配。这些发现凸显了该模型在从现实世界网络攻击新闻报道中实现自动化漏洞识别的潜力。