基於CVE開放數據之自動化資安威脅情資分級與評估系統設計與實作

Design and Implementation of an Automated Cyber Threat Intelligence Triage and Assessment System Based on Open CVE Data

隨著自動化駭客攻擊與5G複雜網路環境的演進，企業每日面臨海量且變種頻繁的資安威脅，傳統仰賴專家經驗的靜態安全評估機制已面臨技術瓶頸。為建構高效且標準化的風險管理流程，本研究研製一套以先進深度預訓練語言模型為核心的資安事件CVSS危險等級自動化評估系統。本系統設計端到端的自動化管線，遞迴擷取GitHub上CVE Program所揭露之2020至2024年間半結構化JSON格式大數據，經由資料清洗、格式扁平化與語意融合拼接等特徵工程，將多維技術特徵與漏洞描述文本轉化為密集的數值張量。在模型實作面，本研究分別導入RoBERTa與DeBERTa兩種尖端雙向Transformer架構，客製化設計一維連續型回歸網路層，以微調訓練預測CVSS基礎分數（Base Score）。實驗結果顯示，在中等資料量（30，319筆樣本）的限制下，RoBERTa模型展現出優異的經驗收斂性與泛化魯棒性，其最佳超參數組合達成平均絕對誤差（MAE）為0.1479、決定係數（$R^2$）達0.9843，整體推論效能優於結構較複雜的DeBERTa模型。最後，系統整合動態資料視覺化模組，透過淡色調散點圖與混淆矩陣熱力圖清晰呈現模型效能，大幅提升AI決策之可解釋性。本研究成果不僅可作為漏洞威脅情資自動化分級之關鍵工具，亦能無縫整合企業SOAR防禦體系，對優化現代資安營運治理（SecOps）具有實質之應用價值。

With the rapid evolution of automated cyberattacks and complex 5G network environments, enterprises are confronted with a deluge of frequent and polymorphic cyber threats, posing a significant technical bottleneck for traditional static security assessment mechanisms that rely heavily on expert experience. To construct a highly efficient and standardized risk management pipeline, this study develops an automated risk level assessment system for cybersecurity incidents powered by advanced pre-trained language models. The proposed system designs an end-to-end automated data pipeline that recursively extracts semi-structured JSON big data published by the CVE Program on GitHub between 2020 and 2024. Through rigorous data cleansing, flattening, and semantic fusion concatenation, multi-dimensional technical features and vulnerability description texts are transformed into dense numerical tensors. In terms of model implementation, two cutting-edge bidirectional Transformer architectures, RoBERTa and DeBERTa, are introduced and fine-tuned with a customized one-dimensional continuous regression head to predict the CVSS Base Scores. Experimental results indicate that under the constraint of a moderate dataset (30,319 annotated samples), the RoBERTa model demonstrates superior empirical convergence and generalized robustness. Its optimal hyperparameter configuration achieves a Mean Absolute Error (MAE) of 0.1479 and a Coefficient of Determination ($R^2$) of 0.9843, outperforming the more complex DeBERTa architecture. Finally, the system integrates a dynamic data visualization module that clearly depicts model performance using low-saturation scatter plots and confusion matrix heatmaps, substantially enhancing the explainability of AI-driven decisions. The empirical outcomes of this study not only serve as a critical tool for automated cyber threat intelligence triage but can also be seamlessly integrated into enterprise SOAR frameworks, offering substantial practical value for optimizing modern SecOps governance.