Repurposing Vulnerability Tickets to Predict Severity Levels: An Introduction to Natural Language Processing and Classification Algorithms

No ratings

Presented at BSides Las Vegas 2022 by

Brittany Bahk

The process of manually determining severity levels for detected vulnerabilities is susceptible to inaccuracy and inconsistency. The main reason is because individuals and teams approach this decision with varying backgrounds and perspectives. Similarly, depending on the complexity of the vulnerability and/or experience level of the team member, manual fulfillment can also contribute to fluctuating completion times; ultimately, impacting operational progress. Eventually, an org can accumulate a repository of vulnerability tickets with little to no discernible justification process for the prioritization of detected vulns.