CVE-LLM : Ontology-Assisted Automatic Vulnerability Evaluation Using Large Language Models
Fuente:
arXiv
Saved in:
| Main Authors: | , , , , , |
|---|---|
| Format: | Preprint |
| Published: |
2025
|
| Subjects: | |
| Online Access: | |
| Tags: |
Add Tag
No Tags, Be the first to tag this record!
|
| _version_ | 1866916625565876224 |
|---|---|
| author | Ghosh, Rikhiya von Stockhausen, Hans-Martin Schmitt, Martin Vasile, George Marica Karn, Sanjeev Kumar Farri, Oladimeji |
| author_facet | Ghosh, Rikhiya von Stockhausen, Hans-Martin Schmitt, Martin Vasile, George Marica Karn, Sanjeev Kumar Farri, Oladimeji |
| contents | The National Vulnerability Database (NVD) publishes over a thousand new vulnerabilities monthly, with a projected 25 percent increase in 2024, highlighting the crucial need for rapid vulnerability identification to mitigate cybersecurity attacks and save costs and resources. In this work, we propose using large language models (LLMs) to learn vulnerability evaluation from historical assessments of medical device vulnerabilities in a single manufacturer's portfolio. We highlight the effectiveness and challenges of using LLMs for automatic vulnerability evaluation and introduce a method to enrich historical data with cybersecurity ontologies, enabling the system to understand new vulnerabilities without retraining the LLM. Our LLM system integrates with the in-house application - Cybersecurity Management System (CSMS) - to help Siemens Healthineers (SHS) product cybersecurity experts efficiently assess the vulnerabilities in our products. Also, we present guidelines for efficient integration of LLMs into the cybersecurity tool. |
| format | Preprint |
| id |
arxiv_https___arxiv_org_abs_2502_15932 |
| institution | arXiv |
| publishDate | 2025 |
| record_format | arxiv |
| spellingShingle | CVE-LLM : Ontology-Assisted Automatic Vulnerability Evaluation Using Large Language Models Ghosh, Rikhiya von Stockhausen, Hans-Martin Schmitt, Martin Vasile, George Marica Karn, Sanjeev Kumar Farri, Oladimeji Computation and Language Cryptography and Security The National Vulnerability Database (NVD) publishes over a thousand new vulnerabilities monthly, with a projected 25 percent increase in 2024, highlighting the crucial need for rapid vulnerability identification to mitigate cybersecurity attacks and save costs and resources. In this work, we propose using large language models (LLMs) to learn vulnerability evaluation from historical assessments of medical device vulnerabilities in a single manufacturer's portfolio. We highlight the effectiveness and challenges of using LLMs for automatic vulnerability evaluation and introduce a method to enrich historical data with cybersecurity ontologies, enabling the system to understand new vulnerabilities without retraining the LLM. Our LLM system integrates with the in-house application - Cybersecurity Management System (CSMS) - to help Siemens Healthineers (SHS) product cybersecurity experts efficiently assess the vulnerabilities in our products. Also, we present guidelines for efficient integration of LLMs into the cybersecurity tool. |
| title | CVE-LLM : Ontology-Assisted Automatic Vulnerability Evaluation Using Large Language Models |
| topic | Computation and Language Cryptography and Security |
| url | https://arxiv.org/abs/2502.15932 |