CVSS-BERT: Explainable Natural Language Processing to Determine the\n Severity of a Computer Security Vulnerability from its Description

2021/11/16 by Mustafizur R. Shahid, Shahid, Mustafizur, Hervé Debar +1 · 6 citations
Computer Science · #Artificial Intelligence (cs.AI) #Computation and Language (cs.CL) #Explainable Artificial Intelligence (XAI) #FOS: Computer and information sciences #Information and Cyber Security #Machine Learning (cs.LG) #Topic Modeling

paper · pdf · doi:10.48550/arxiv.2111.08510

openalex publication_date 2021/11/16 · openalex created_date 2025/10/10 · openalex updated_date 2026/07/28

Abstract

When a new computer security vulnerability is publicly disclosed, only a\ntextual description of it is available. Cybersecurity experts later provide an\nanalysis of the severity of the vulnerability using the Common Vulnerability\nScoring System (CVSS). Specifically, the different characteristics of the\nvulnerability are summarized into a vector (consisting of a set of metrics),\nfrom which a severity score is computed. However, because of the high number of\nvulnerabilities disclosed everyday this process requires lot of manpower, and\nseveral days may pass before a vulnerability is analyzed. We propose to\nleverage recent advances in the field of Natural Language Processing (NLP) to\ndetermine the CVSS vector and the associated severity score of a vulnerability\nfrom its textual description in an explainable manner. To this purpose, we\ntrained multiple BERT classifiers, one for each metric composing the CVSS\nvector. Experimental results show that our trained classifiers are able to\ndetermine the value of the metrics of the CVSS vector with high accuracy. The\nseverity score computed from the predicted CVSS vector is also very close to\nthe real severity score attributed by a human expert. For explainability\npurpose, gradient-based input saliency method was used to determine the most\nrelevant input words for a given prediction made by our classifiers. Often, the\ntop relevant words include terms in agreement with the rationales of a human\ncybersecurity expert, making the explanation comprehensible for end-users.\n

Cited by

• ReVul-CoT: Towards Effective Software Vulnerability Assessment with Retrieval-Augmented Generation and Chain-of-Thought Prompting
• Prompting the Priorities: A First Look at Evaluating LLMs for Vulnerability Triage and Prioritization
• A Modality-Aware Cooperative Co-Evolutionary Framework for Multimodal Graph Neural Architecture Search
• VLAI: A RoBERTa-Based Model for Automated Vulnerability Severity Classification
• SVA-ICL: Improving LLM-based Software Vulnerability Assessment via In-Context Learning and Information Fusion
• Enhancing Vulnerability Reports with Automated and Augmented Description Summarization

Related

• V2W-BERT: A Framework for Effective Hierarchical Multiclass\n Classification of Software Vulnerabilities
• Vulnerability Clustering and other Machine Learning Applications of Semantic Vulnerability Embeddings
• Can LLMs Classify CVEs? Investigating LLMs Capabilities in Computing CVSS Vectors
• Advancing Vulnerability Classification with BERT: A Multi-Objective Learning Model
• Common Vulnerability Scoring System Prediction based on Open Source Intelligence Information Sources