A Lightweight K-Means Clustering Method for Vulnerability Classification with SHA-256 Integrity Verification
Main Article Content
Keywords
K-Means clustering, vulnerability classification, SHA-256, integrity verification, lightweight security
Abstract
Software vulnerability databases add tens of thousands of records each year, and their sources, formats, and forms of expression are highly mixed. Manual classification by reading each record is slow and varies from person to person: descriptions written by different researchers for the same underlying flaw may differ greatly, making prioritization based on them almost unreliable. This study proposes a lightweight vulnerability classification method that combines K-Means clustering with Secure Hash Algorithm 256 (SHA-256) integrity verification. Five numerical features are extracted from each vulnerability record—the Common Vulnerability Scoring System (CVSS) score, access complexity, privileges required, scope, and exploitability—and are standardized before being input into K-Means. The number of clusters K is determined by the elbow method rather than by experience, and each centroid vector obtained by clustering is then hashed separately so that any subsequent modification can be detected. On 600 National Vulnerability Database (NVD)-style records, when K = 4, the silhouette coefficient is 0.4043 and the Calinski-Harabasz index is 1187.05, while the complete SHA-256 verification adds only 0.1167 ms of overhead. The method requires only a few milliseconds on an ordinary laptop and is suitable for vulnerability triage in teaching laboratories or resource-constrained security dashboards.
References
- [1]National Institute of Standards and Technology. National Vulnerability Database [EB/OL]. https://nvd.nist.gov, 2026.
- [2]Li Z, Zou D, Xu S, et al. VulDeePecker: A deep learning-based system for vulnerability detection[J]. arXiv preprint arXiv:1801.01681, 2018.
- [3]Ghosh A, Goyal S. Hierarchical clustering of CVE entries[C]//Proceedings of the 2019 ACM SIGSAC Conference. 2019: 211-220.
- [4]Chen J, Liu X, Wang Y, et al. Transformer-based vulnerability embedding[C]//Proceedings of the 32nd USENIX Security Symposium. 2023: 1023-1040.
- [5]National Institute of Standards and Technology. FIPS PUB 180-4: Secure Hash Standard (SHS)[S]. Gaithersburg: NIST, 2015.
- [6]Chan P K, Stolfo S J. Sharing distributed data with secure hashes[C]//Proceedings of the 2005 IEEE Symposium on Security and Privacy. 2005: 78-85.
- [7]Ester M, Kriegel H P, Sander J, et al. A density-based algorithm for discovering clusters in large spatial databases with noise[C]//Proceedings of the 2nd International Conference on Knowledge Discovery and Data Mining. 1996: 226-231.
- [8]Pedregosa F, Varoquaux G, Gramfort A, et al. Scikit-learn: Machine Learning in Python[J]. Journal of Machine Learning Research, 2011, 12: 2825-2830.
- [9]Cover T M, Thomas J A. Elements of Information Theory[M]. 2nd ed. Hoboken: John Wiley & Sons, 2006.
- [10]Pandey N, Solanki V. Vulnerability classification using machine learning[J]. Journal of Information Security, 2021, 12(3): 45-58.
- [11]FIRST. CVSS v3.1 Specification Document [S]. https://www.first.org/cvss/, 2019.
Article Sidebar
This work is licensed under a Creative Commons Attribution 4.0 International License.