AI 中文总结
研究针对现有自动化漏洞评估方法缺乏证据支持的问题，提出EAVA框架，通过LLM智能体和两阶段训练流程实现更优性能，且提供的证据对安全专家实用。
AI 中文摘要
软件漏洞（SV）评估通过对已报告漏洞进行特征刻画，帮助确定修复的优先级。现有的自动化方法从软件漏洞报告（SVR）中预测评估结果，但往往忽略截图、代码片段等富文本内容，以及易受攻击项目的上下文信息。这些方法还专注于预测准确率，却未提供解释或支持证据，当分析师必须验证不完美的预测时，限制了其实际应用。我们提出EAVA，一个使用大语言模型（LLMs）评估软件漏洞并提供支持证据的框架。EAVA采用专门的LLM智能体处理富文本内容和项目信息，并通过两阶段训练流程构建专用评估模型：首先对自动标注的推理轨迹进行监督指令微调以注入领域知识，然后应用强化学习改进内在推理。EAVA还检索相似的历史漏洞作为补充证据。在新收集的SVR数据集上的实验表明，EAVA在多个指标上的性能优于最强基线模型，幅度为5.3%至35.2%。消融研究证实了评估专用模型训练和信息增强的有效性。针对安全专家的用户研究进一步表明，EAVA提供的证据对于实际的软件漏洞评估是有用且实用的。
英文摘要
Software vulnerability (SV) assessment helps prioritize remediation by characterizing reported vulnerabilities. Existing automated methods predict assessment results from SV reports (SVRs), but often overlook information in rich text, such as screenshots and code snippets, as well as contextual information about vulnerable projects. They also focus on prediction accuracy without providing explanations or supporting evidence, limiting their practical use when analysts must validate imperfect predictions. We propose EAVA, a framework that uses large language models (LLMs) to assess SVs and provide supporting evidence. EAVA employs specialized LLM agents to process rich-text content and project information, and builds a dedicated assessment model through a two-stage training pipeline. It first uses supervised instruction tuning on automatically annotated reasoning trajectories to inject domain knowledge, and then applies reinforcement learning to improve intrinsic reasoning. EAVA also retrieves similar historical vulnerabilities as supplementary evidence. Experiments on a newly collected SVR dataset show that EAVA outperforms the strongest baseline by 5.3 to 35.2 percent across multiple metrics. Ablation studies confirm the effectiveness of assessment-specific model training and information enrichment. A user study with security experts further demonstrates that the evidence provided by EAVA is useful and practical for real-world SV assessment.
Commentsaccepted by ISSTA 26
