[8] Find a way how to get project name from NVD CVE data

[msrb]

Description

Mapping CVE entries to actual package names is much easier when we at least know name of a project (e.g. "Apache NiFi", or "Apache POI") that is affected by given vulnerability. Knowing the project name will help us to get better results and less false positives.

The output of this task should be a function that takes one NVD CVE record on input and returns list of possible project name candidates. Having confidence score for each candidate would be nice, but is not necessary.

Sub tasks for sprint #2433

• Have a set of labeled data to train, validate and test accuracy with.
  Update: It is possible to use label the NVD feeds that reference GitHub and hence the project name can be infered from the description of the CPE. This set however might not be sufficient and the approach should be further discussed.
• Discover whether the data evinces latent pattern.
• Model selection based on the description pattern properties
  Update: Based on the description properties, Naive Bayes classifier was selected for the implementation.
• Classifier implementation
• Accuracy evaluation
  Update: Accuracy has been evaluated on a relatively small dataset (cca 20% of real data) due to lack of labeled data.

[CermakM]

A sub task has been added. In order to be able to at least estimate the accuracy of a model, we need an accessible toy set of labeled data.

[krishnapaparaju]

@CermakM can you please share the approach for retrieving the project name ? Which ecosystems being considered for this work ?

[CermakM]

@krishnapaparaju sure thing,
This approach is not ecosystem specific, since it is based on project name extraction from CPE description only, without using any external search engines.

In the notebook you can see a suggestion of the approach that could greatly improve our current approach (also a slight comparison is present in the ntb).
This is still a WIP and a lot of things need to be discussed / implemented / verified.
Also, please expect and tolerate some slapdash code.

[msrb]

This experiment will continue in Sprint 147.

@CermakM please update this issue, thanks 👍

[CermakM]

Conclusion for the current sprint #2433

We were able to prove that the description data evince a pattern. With a suitable feature extractor, a classifier can be trained to provide a decent predictions of a project name candidate. Such candidates are evaluated with a numeric confidence score and can be further processed (ordered, filtered, etc.)

To be done in sprint #2775 :

• It is yet unknown whether the accuracy of the classifier is sufficient, only basic accuracy evaluation has been implemented atm, cross-validation remains to be done, as suggested by @rootAvish .
• Also, the classifier used for this proof was an implicit one and can be further improved to provide more flexible and more suitable way to integrate with our current tools. The decision about the implementation will be based on cross-validation results and team members opinions.

cc @msrb