The Common Vulnerabilities and Exposures (CVE) are pivotal information for proactive cybersecurity measures, including service patching, security hardening, and more. However, CVEs typically offer low-level, product-oriented descriptions of publicly disclosed cybersecurity vulnerabilities, often lacking the essential attack semantic information required for comprehensive weakness characterization and threat impact estimation. This critical insight is essential for CVE prioritization and the identification of potential countermeasures, particularly when dealing with a large number of CVEs. Current industry practices involve manual evaluation of CVEs to assess their attack severities using the Common Vulnerability Scoring System (CVSS) and mapping them to Common Weakness Enumeration (CWE) for potential mitigation identification. Unfortunately, this manual analysis presents a major bottleneck in the vulnerability analysis process, leading to slowdowns in proactive cybersecurity efforts and the potential for inaccuracies due to human errors. In this research, we introduce our novel predictive model and tool (called CVEDrill) which revolutionizes CVE analysis and threat prioritization. CVEDrill accurately estimates the CVSS vector for precise threat mitigation and priority ranking and seamlessly automates the classification of CVEs into the appropriate CWE hierarchy classes. By harnessing CVEDrill, organizations can now implement cybersecurity countermeasure mitigation with unparalleled accuracy and timeliness, surpassing in this domain the capabilities of state-of-the-art tools like ChaptGPT.

翻译：通用漏洞与暴露（CVE）是主动网络安全防御（包括服务补丁、安全加固等）的关键信息源。然而，CVE通常仅提供面向产品的低层级公开网络安全漏洞描述，往往缺乏全面描述缺陷特征与评估威胁影响所需的攻击语义信息。这种关键性洞察对于CVE优先级排序和潜在应对措施识别至关重要，尤其是在处理大量CVE时。当前工业实践采用人工评估方式，通过通用漏洞评分系统（CVSS）评定攻击严重程度，并将其映射至通用缺陷枚举（CWE）以识别潜在缓解措施。遗憾的是，这种人工分析构成了漏洞分析流程的主要瓶颈，导致主动网络安全防御效率降低，并因人为失误引入潜在不准确性。在本研究中，我们提出了一种新型预测模型与工具（命名为CVEDrill），该工具彻底革新了CVE分析与威胁优先级排序流程。CVEDrill能精确估计CVSS向量以实现精准威胁缓解与优先级排序，并自动化地将CVE分类至相应的CWE层级结构类别。通过部署CVEDrill，组织机构能够以前所未有的准确性和时效性实施网络安全对抗措施，在该领域超越如ChatGPT等现有先进工具的能力。