arXiv proposes VPre for early CVSS vector prediction
Original title: Towards Early Warning of Real-World Vulnerabilities: An Evidence-Aware Decoupled Method for CVSS Vector Prediction Based on Unstructured Disclosures
PARSE and VPre decouple evidence screening and routing to predict CVSS vectors 38 days early with 0.7239 MAE.
Existing predictors degrade on noisy pre-NVD reports. PARSE models the vulnerability disclosure lifecycle. VPre uses two-level Evidence-Aware Decoupling: security-evidence screening at report and sentence levels, and evidence-matched routing separating tasks for LLM reasoning or lightweight classification. On the 851-report VPre-Bench test split, VPre achieves 0.7239 mean absolute error, 44.7% below the BERT-Small-NVD baseline, with an average 38-day lead before official scoring. Under 38:1 noise, report-level screening reaches 0.98 precision, 1.00 recall, and 0.99 F1.
- Mean absolute error of 0.7239 on held-out test split.
- 38-day average lead before official scoring, range 21-60 days.
- STDU's report-level screening reaches 0.98 precision under 38:1 noise.
- Both decoupling levels contribute to performance.
- Pair timestamps show average 38-day lead.
From the original article
1 min read at arxiv.orgEarly assessment of Common Vulnerability Scoring System (CVSS) vectors from Open Source Intelligence (OSINT) can reduce the delay between initial public disclosure and official National Vulnerability Database (NVD) scoring. Existing predictors, trained mainly on standardized late-stage descriptions, degrade on noisy and incomplete pre-NVD reports.
By Jianhong Ma · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.