Scalable vulnerability triage using multi-agent ai systems and automated cvss assessment

Abstract

The increasing adoption of software applications, cloud services, mobile devices, and digital services has resulted in an increased number of cybersecurity vulnerabilities. Vulnerability databases and reporting tools have made it possible for security experts and even non-security professionals to discover vulnerabilities and report them. Although there is an ecosystem for discovering cybersecurity weaknesses, this has also introduced a new problem – vulnerability analysis and management are now time-consuming activities. Considering the fact that most security operations teams lack sufficient manpower, the process of manually analyzing and prioritizing cybersecurity vulnerabilities has become both expensive and inefficient. Triage of vulnerabilities requires analysts to read and understand security reports, analyze attack vectors, identify affected resources, predict the business impact of vulnerabilities, assess exploitability, and calculate severity. All of these processes require not only technical skills but also lots of time on the part of security experts. The rising volume of vulnerability reports leads to the risk of delays during the triage process, which can negatively affect the security posture. Moreover, inconsistencies might occur due to the differences in analysts' interpretation of information provided in vulnerability reports. This research aims to introduce an intelligent system for automation of vulnerability triage based on multi-agent systems and automatic CVSS scoring. In contrast to traditional approaches, the proposed solution will divide vulnerability triage into separate tasks performed by independent agents. Thus, one artificial intelligence agent will be responsible for parsing a vulnerability report, another agent – for analyzing proof of concept code, yet another one – for assessing exploitability. The last artificial intelligence agent will make decisions based on the output received from the other three components. As part of the proposed framework, the NLP and transformer models will be used to perform analysis of the text data associated with vulnerabilities, advisories, and technical reports. In particular, security-related textual data will be converted into structured form. This way, the system will be able to detect characteristics associated with vulnerabilities. To predict CVSS metrics, a multitask learning algorithm for the identification of vulnerabilities based on their description is developed. Namely, this model predicts such CVSS base metrics as Attack Vector (AV), Attack Complexity (AC), Privileges Required (PR), User Interaction (UI), Scope (S), Confidentiality Impact (C), Integrity Impact (I), and Availability Impact (A). However, apart from score prediction, cooperating agents are utilized to perform such tasks as evaluating exploit evidence, detecting duplicated or low-quality reports, estimating the urgency of vulnerability fixes, and providing explanations for decision-making. This aspect of the framework is particularly relevant in operational settings due to the need for explainability. Importantly, the framework is not intended to fully replace security specialists. Instead, by automating routine activities, analysts can dedicate their efforts to performing additional research. For the evaluation of the proposed approach's performance, several experiments were run using publicly available databases of vulnerabilities as well as curated security report collections. Different transformer architectures were compared in regard to accuracy, precision, recall, and F1-score. In addition, the automation capacity of the triaging system was assessed in terms of performance time and triaging effectiveness. Based on the results of experiments, the proposed framework is capable of predicting CVSS metrics accurately while reducing the time necessary for triaging operations significantly. Thus, the findings obtained during research suggest that multi-agent AI frameworks provide an effective means to solve contemporary vulnerability management challenges. Indeed, by combining the functionality of intelligent modules and automating CVSS score assessment, organizations will be able to ensure consistency, shorten the time frame for decisions, and improve the use of security resources. The proposed framework can prove useful for security operations centers, managed security services companies, software vendors, and bug bounty platforms handling high traffic levels. The main contributions of this thesis are as follows: it introduces a scalable multi-agent architecture for vulnerability triage, develops an automated CVSS assessment model based on multi-task learning, proposes an explainable decision-support workflow for analysts, and presents a thorough experimental evaluation. Future work could focus on real-time deployment, integration with threat intelligence feeds, multilingual vulnerability analysis, reinforcement learning for flexible prioritization, and incorporating large language models with better reasoning abilities.