LLM-based Vulnerability Sourcing from Unstructured Data

Abstract

While open source software (OSS) components are integral to modern software development, they can introduce security risks due to potential unknown vulnerabilities. The shift left approach from DevSecOps recommends to inte-grate security measures from the early stages of development. However, the existing Common Vulnerabilities and Exposures (CVE) program has limitations in covering all vulnerabilities, leading to delays in their publication. Additionally, vulnerabilities are increasingly reported through unconventional channels, such as blog posts, newsletters, and emails, in unstructured formats. This poses challenges in processing and integrating vulnerability information into existing vulnerability management systems. To address this issue, we propose leveraging Large Language Models (LLMs) for extracting vulnerability in-formation from unstructured sources and converting them into a machine-readable CSAF VEX format. In this research paper, we present a prototype implementation that extracts information from supplier communication emails and gener-ates it in CSAF VEX format. It can be incorporated into the corresponding DevSecOps workflow, supporting a shift left approach. Our approach can help organizations to improve their vulnerability management practices by enabling the early detection and remediation of vulnerabilities in software supply chains.