sumitp76/cve-exploitability

1---2license: mit3library_name: pytorch4pipeline_tag: text-classification5tags:6- security7- cve8- vulnerability-management9- exploit-prediction10- sbom11---12 13# CVE Exploitability Model14 15Predicts the probability that a CVE is **exploited in the wild** (CISA KEV as the positive label),16for prioritising vulnerabilities surfaced from an SBOM. Two-branch deep model: a **TextCNN** over the17CVE description fused with an **MLP** over CVSS v3 metadata + CWE.18 19## Held-out test metrics20| Model | ROC-AUC | PR-AUC | Precision@10% | Recall@10% |21|---|---|---|---|---|22| Deep (TextCNN + CVSS fusion) | 0.934 | 0.763 | 0.782 | 0.473 |23| Baseline: CVSS score only | 0.746 | 0.316 | 0.347 | 0.210 |24| Baseline: logistic reg (structured) | 0.819 | 0.440 | 0.463 | 0.280 |25 26## Usage27```python28# pip install huggingface_hub torch numpy pandas29import importlib.util, sys30from huggingface_hub import hf_hub_download31spec = importlib.util.spec_from_file_location("hf_model", hf_hub_download("sumitp76/cve-exploitability", "hf_model.py"))32m = importlib.util.module_from_spec(spec); sys.modules["hf_model"] = m; spec.loader.exec_module(m)33 34pp, net = m.load_model("sumitp76/cve-exploitability")35 36import pandas as pd, torch37df = pd.DataFrame([{"description": "Remote code execution via crafted request ...",38                     "base_score": 9.8, "severity": "CRITICAL", "AV": "NETWORK", "AC": "LOW",39                     "PR": "NONE", "UI": "NONE", "S": "UNCHANGED", "C": "HIGH", "I": "HIGH",40                     "A": "HIGH", "has_v3": 1, "v2_base_score": None, "year": 2024, "cwe": "CWE-94"}])41Xt = torch.tensor(pp.transform_text(df.description.tolist()))42Xs = torch.tensor(pp.transform_struct(df), dtype=torch.float32)43print("exploit probability:", torch.sigmoid(net(Xt, Xs)).item())44```45 46## Labels47- `1` = listed in CISA KEV (known exploited in the wild)48- `0` = not known-exploited (sampled from NVD)49 50## Data sources51- **Labels:** CISA KEV (`cisagov/kev-data`)52- **Features:** NVD (`fkie-cad/nvd-json-data-feeds`) — description, CVSS v3, CWE53 54## Limitations55KEV is a weak/incomplete label; the training class prevalence is inflated versus the real-world56(<1%); CVEs seen during training score optimistically; novel patterns (e.g. supply-chain backdoors)57are hard. Evaluate with a time-based split before operational use. This model assists triage and is58not a substitute for human judgement.59