Cybersecurity vulnerability information is often recorded by multiple
channels, including government vulnerability repositories,
individual-maintained vulnerability-gathering platforms, or
vulnerability-disclosure email lists and forums. Integrating vulnerability
information from different channels enables comprehensive threat assessment and
quick deployment to various security mechanisms. Efforts to automatically
gather such information, however, are impeded by the limitations of today's
entity alignment techniques. In our study, we annotate the first
cybersecurity-domain entity alignment dataset and reveal the unique
characteristics of security entities. Based on these observations, we propose
the first cybersecurity entity alignment model, CEAM, which equips GNN-based
entity alignment with two mechanisms: asymmetric masked aggregation and
partitioned attention. Experimental results on cybersecurity-domain entity
alignment datasets demonstrate that CEAM significantly outperforms
state-of-the-art entity alignment methods.

本研究针对当前实体对齐技术的局限性，通过标注第一个网络安全领域实体对齐数据集，并揭示了安全实体的独特特征，提出了第一个网络安全实体对齐模型，CEAM，具有不对称遮蔽聚合和分区关注两种机制，实验结果表明 CEAM 在网络安全领域的实体对齐数据集上显著优于同类别实体对齐方法。

网络安全实体对齐：基于掩码图注意力网络的方法

Cybersecurity Entity Alignment via Masked Graph Attention Networks

Despite the massive investments in information security technologies and
research over the past decades, the information security industry is still
immature. In particular, the prioritization of remediation efforts within
vulnerability management programs predominantly relies on a mixture of
subjective expert opinion, severity scores, and incomplete data. Compounding
the need for prioritization is the increase in the number of vulnerabilities
the average enterprise has to remediate. This paper produces the first open,
data-driven framework for assessing vulnerability threat, that is, the
probability that a vulnerability will be exploited in the wild within the first
twelve months after public disclosure. This scoring system has been designed to
be simple enough to be implemented by practitioners without specialized tools
or software, yet provides accurate estimates of exploitation. Moreover, the
implementation is flexible enough that it can be updated as more, and better,
data becomes available. We call this system the Exploit Prediction Scoring
System, EPSS.

本文提出了第一个开放的数据驱动的漏洞威胁评估框架，即漏洞在公开披露后的 12 个月内被利用的概率评分系统，该系统被设计为足够简单，可以由非技术专家实践者实现，同时提供准确的利用估计，且可根据更多更好的数据进行更新。我们称之为 Exploit Prediction Scoring System (EPSS)。