Abstract: A method (300) for linking a common vulnerability and exposure, CVE, (106) with at least one synthetic common platform enumeration, CPE, (112) wherein the CVE (106) comprises a summary of a vulnerability, is disclosed. The method (300) comprising: receiving (S302) the summary of the CVE (106) from a vulnerability database, VD, (104); extracting (S304) information from the summary of the CVE (106) using a Natural Language Processing, NLP, model; building (S306) at least one synthetic CPE (112) based on the extracted information; and linking (S308) the CVE (106) with the at least one synthetic CPE (112).

Abstract: Open-source software is prevalent in the development of new technologies. Monitoring software updates for vulnerabilities is expensive and time consuming. Online discussions surrounding new software updates can often provide vital information regarding emerging risks. It is presented a novel approach for automating surveillance of software through the use of natural language processing methods on open-source issues. Further, the potential of virtual adversarial training, a popular semi-supervised learning technique, is used to leverage the vast amounts of unlabeled data available to achieve improved performance. On industry data, it is found that a hierarchical attention network with virtual adversarial training that utilizes the innate document structure to encapsulate the text can be used with good results.