This question is related to an earlier questions: 1 & 2 about the limitations in web application vulnerability scoring/automated vulnerability scoring. Indeed, scoring vulnerabilities detected in web and REST-based applications is not straight-forward, and challenging to automate. While software packages are scored using the CVSS (e.g. NVD maintains CVE for reported vulnerabilities and assigns appropriate scores), web applications are not scored centrally. However, there are several sources of vulnerability information for web applications which could be leveraged e.g. CWE. Can machine learning approaches e.g. text vectorization be used to solve this challenge since several problems in security have benefitted from machine learning ?
An example : If a detected web application vulnerability is described as "A XSS attack was reflected in a JSON response, this might leave content consumers vulnerable to attack if they don't appropriately handle the data (response)." and assigned CWE Id 79. Can a text matching algorithm grap specified keywords in the description e.g. "XSS attack" and "JSON response" for analysis and compute severity scores using sources e.g. CWE and CVSS ?
A short research leads me to tensorflow's word2vec model, can it potentially solve this challenge ?
I will be happy to hear if such techniques exist within the security community or if this kinds of approaches are limited in certain ways.
Note: I have asked the same question on Data Science and it recives no attention probably because the problem space is very specific.