Weaknesses in computer systems such as faults, bugs and errors in the architecture, design or implementation of software provide vulnerabilities that can be exploited by attackers to compromise the security of a system. Common Weakness Enumerations (CWE) are a hierarchically designed dictionary of software weaknesses that provide a means to understand software flaws, potential impact of their exploitation, and means to mitigate these flaws. Common Vulnerabilities and Exposures (CVE) are brief low-level descriptions that uniquely identify vulnerabilities in a specific product or protocol. Classifying or mapping of CVEs to CWEs provides a means to understand the impact and mitigate the vulnerabilities. Since manual mapping of CVEs is not a viable option, automated approaches are desirable but challenging. We present a novel Transformer-based learning framework (V2W-BERT) in this paper. By using ideas from natural language processing, link prediction and transfer learning, our method outperforms previous approaches not only for CWE instances with abundant data to train, but also rare CWE classes with little or no data to train. Our approach also shows significant improvements in using historical data to predict links for future instances of CVEs, and therefore, provides a viable approach for practical applications. Using data from MITRE and National Vulnerability Database, we achieve up to 97% prediction accuracy for randomly partitioned data and up to 94% prediction accuracy in temporally partitioned data. We believe that our work will influence the design of better methods and training models, as well as applications to solve increasingly harder problems in cybersecurity.

翻译：计算机系统中的弱点,如缺陷、错误和软件结构、设计或实施中的错误和缺陷等,都提供了弱点,攻击者可以利用这些弱点来损害系统的安全。常见的弱点编号(CWE)是一套按等级设计的软件弱点字典,它提供了一种理解软件缺陷、其开发的潜在影响以及减轻这些缺陷的手段。常见弱点和暴露(CVE)是简短的低层次描述,它独特地识别了特定产品或协议中的弱点。CWE的分类或绘图为CWES提供了一种理解影响和减轻脆弱性的手段。由于CVE的手工绘图越来越不可行,因此自动方法是可取的,但具有挑战性。我们在本文中提出了一个新的基于变换软件的学习框架(V2W-BERT),它提供了理解软件缺陷的方法。通过使用自然语言处理、链接预测和传输学习的构想,我们的方法不仅超越了CWE的以往方法,而且极少有或根本没有数据可训练的CWE类。我们的方法还表明,在使用历史数据来预测更精确的准确性方法方面有了显著的改进,因此,我们在利用CVE和精确性数据库中可以相信,我们利用CVE的精确性的方法,在数据库中可以预测中可以预测中可以取得更精确性的数据。