大模型能自动给漏洞打分，但描述不清会影响准确性。
From Description to Score: Can LLMs Quantify Vulnerabilities?
- 用大模型分析3万+漏洞描述，自动生成评分
- 模型对影响范围判断准，对复杂度评估较弱
- 适合安全团队减轻人工评分负担
手动为漏洞分配评分（如CVSS）耗时且易受主观影响。本研究考察了ChatGPT、Llama、Grok、DeepSeek、Gemini等通用大语言模型在分析超过31,000条近期CVE条目中的自动化评分潜力。结果显示，大模型在某些指标上表现显著优于基线（如“可用性影响”），而在其他指标上提升有限（如“攻击复杂度”）。不同模型家族及具体CVSS指标间性能差异明显，其中ChatGPT-5精度最高。分析发现，模型常在同一类CVE上出错，集成元分类器仅小幅提升性能。进一步研究表明，漏洞描述普遍缺乏关键上下文或存在模糊表述，是导致系统性误判的重要原因。这凸显了改进漏洞描述质量、补充更丰富上下文对实现可靠自动化推理的关键作用，有助于缓解待处理CVE积压问题。
原文摘要 · Abstract (English)
Manual vulnerability scoring, such as assigning Common Vulnerability Scoring System (CVSS) scores, is a resource-intensive process that is often influenced by subjective interpretation. This study investigates the potential of general-purpose large language models (LLMs), namely ChatGPT, Llama, Grok, DeepSeek, and Gemini, to automate this process by analyzing over 31{,}000 recent Common Vulnerabilities and Exposures (CVE) entries. The results show that LLMs substantially outperform the baseline on certain metrics (e.g., \textit{Availability Impact}), while offering more modest gains on others (e.g., \textit{Attack Complexity}). Moreover, model performance varies across both LLM families and individual CVSS metrics, with ChatGPT-5 attaining the highest precision. Our analysis reveals that LLMs tend to misclassify many of the same CVEs, and ensemble-based meta-classifiers only marginally improve performance. Further examination shows that CVE descriptions often lack critical context or contain ambiguous phrasing, which contributes to systematic misclassifications. These findings underscore the importance of enhancing vulnerability descriptions and incorporating richer contextual details to support more reliable automated reasoning and alleviate the growing backlog of CVEs awaiting triage.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。