从描述到评分：大语言模型能否量化漏洞？
From Description to Score: Can LLMs Quantify Vulnerabilities?
AI总结：
本研究探讨了大语言模型在自动化CVSS评分中的潜力，发现其在某些指标上表现优异，但存在分类错误问题，需改进漏洞描述以提升自动化评分的可靠性。
摘要：
手动对漏洞进行评分，如分配通用漏洞评分系统（CVSS）分数，是一个资源消耗大的过程，往往受主观解释影响。本研究探讨了通用大型语言模型（LLMs），即ChatGPT、Llama、Grok、DeepSeek和Gemini，能否通过分析超过31,000个最近的通用漏洞和暴露（CVE）条目来自动化这一过程。结果表明，LLMs在某些指标（如可用性影响）上显著优于基线，而在其他指标（如攻击复杂性）上提供更加温和的提升。此外，模型性能在LLM家族和个别CVSS指标上有所不同，ChatGPT-5在精度上达到最高。我们的分析发现，LLMs倾向于错误分类许多相同的CVE条目，基于元分类器的集成仅略微提升性能。进一步检查显示，CVE描述通常缺乏关键上下文或包含模糊的措辞，这导致了系统性的错误分类。这些发现强调了增强漏洞描述并融入更丰富的上下文细节以支持更可靠的自动化推理和缓解日益增长的CVES待处理 backlog 的重要性。
英文摘要：
Manual vulnerability scoring, such as assigning Common Vulnerability Scoring System (CVSS) scores, is a resource-intensive process that is often influenced by subjective interpretation. This study investigates the potential of general-purpose large language models (LLMs), namely ChatGPT, Llama, Grok, DeepSeek, and Gemini, to automate this process by analyzing over 31{,}000 recent Common Vulnerabilities and Exposures (CVE) entries. The results show that LLMs substantially outperform the baseline on certain metrics (e.g., \textit{Availability Impact}), while offering more modest gains on others (e.g., \textit{Attack Complexity}). Moreover, model performance varies across both LLM families and individual CVSS metrics, with ChatGPT-5 attaining the highest precision. Our analysis reveals that LLMs tend to misclassify many of the same CVEs, and ensemble-based meta-classifiers only marginally improve performance. Further examination shows that CVE descriptions often lack critical context or contain ambiguous phrasing, which contributes to systematic misclassifications. These findings underscore the importance of enhancing vulnerability descriptions and incorporating richer contextual details to support more reliable automated reasoning and alleviate the growing backlog of CVEs awaiting triage.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
