用本地开源模型预测漏洞严重度，兼顾隐私与效率
On Predicting Vulnerability Severity Using In-Context Learning: An Industrial Case Study
- 通过上下文学习，用代码片段直接预测CVSS v3.1分值
- CodeLlama2-7B在轻量提示下逼近云端最佳表现，MSE更低
- 适合需要隐私保护的工业安全团队快速评估漏洞
现代软件系统需更早、更高效地评估漏洞严重度，以减少高影响安全缺陷的暴露风险。安全分析师通常手动分配CVSS分数，但该方法难以应对漏洞数量激增，且依赖云大模型服务带来数据泄露隐患。本文基于工业案例研究，探索使用本地可部署的开源大模型，通过上下文学习从脆弱的C/C++代码片段中直接预测CVSS v3.1分值。我们对比了专有数据与Big-Vul数据集，发现两者CVSS分布高度一致，表明可用Big-Vul作为构建提示测试集的可靠代理。进一步在CodeLlama2-7B、CodeLlama2-13B、Mistral-7B、gpt-oss和GPT4o-mini上测试不同上下文配置与模型参数，采用均方误差（MSE）和可行性指标评估。结果表明，中等规模开源模型如CodeLlama2-7B，在轻量输出约束提示引导下，可实现接近云端最优性能的严重度回归，为工业场景中的严重度分类提供一种实用且隐私保护的解决方案。
原文摘要 · Abstract (English)
Modern software systems require earlier and more scalable vulnerability severity assessment to reduce exposure to high-impact security flaws. Security analysts typically assign CVSS scores, but this manual triage does not scale with the growth of disclosed vulnerabilities and often depends on cloud LLM services that raise confidentiality concerns. This paper presents an industrial case study on predicting CVSS v3.1 scores directly from vulnerable C/C++ snippets using in-context learning with locally deployable, open-source LLMs. We compare proprietary data with the Big-Vul dataset, showing sufficiently aligned CVSS distributions to justify Big-Vul as a proxy for industrial data when constructing prompt-based testbeds. We then vary in-context configurations and model parameters, evaluating CodeLlama2-7B, CodeLlama2-13B, Mistral-7B, gpt-oss, and GPT4o-mini using mean squared error (MSE) and feasibility metrics. Our results show that medium-sized open-source code models, particularly CodeLlama2-7B, can approximate the best cloud performance for CVSS regression when guided by lightweight, output-constraining prompts, offering a practical, privacy-preserving building block for severity triage in industrial settings.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。