Toward Extracting Learning Pattern: A Comparative Study of GPT-4o-mini and BERT Models in Predicting CVSS Base Vectors

Software vulnerabilities represent significant threats to the security of systems and data. Timely mitigation of these vulnerabilities is crucial to prevent exploitation. The Common Vulnerability Scoring System (CVSS) is widely used to quantify the severity of vulnerabilities, but manually assigning CVSS base vectors to newly discovered vulnerabilities is time-consuming and error-prone. This paper investigates the potential of large language models (LLMs) to automate this task. We conducted a comparative study of GPT-4o-mini and BERT models for predicting CVSS base vectors. Both models were trained and evaluated on a dataset of vulnerabilities extracted from the National Vulnerability Database (NVD), using vulnerability descriptions as input. Our results demonstrate that BERT outperforms GPT-4o-mini in terms of prediction accuracy for CVSS base vectors. BERT’s ability to capture contextual information within the vulnerability descriptions enables it to make more accurate predictions. To gain insights into the decision-making process of the GPT-4o-mini model, we performed a keyword analysis. This analysis provides a foundation for further research into the explainability of LLMs in security applications.