Automated vulnerability score prediction through lightweight generative AI

Given the constantly increasing number of newly published vulnerabilities, manually assessing their scores (e.g., under the Common Vulnerability Scoring System) has become unfeasible. Recently, learning-based systems have been proposed to automatically predict vulnerability scores. Such systems use vulnerability indexing databases to train deep learning algorithms. However, their practical applicability has important limitations, including a high dependency on the quality and diversity of training data, and high computational requirements. In addition, vulnerability descriptions often do not follow the standard templates and are not rich enough with respect to the expected features. In this paper, we propose a novel architecture that takes advantage of both generative artificial intelligence and lightweight deep learning techniques to provide an efficient and effective solution for automated vulnerability scoring. Data extracted from the National Vulnerability Dataset is fed into a large language model layer, whose output (i.e., an augmented dataset) is then used in a lightweight fine-tuned BERTsmall layer. We provide the results of an extensive experimental assessment of the effect of both each layer of the architecture and end-to-end performances. The results suggest that the combination of GPT3.5-Turbo and BERTsmall provides the most effective accuracy-time trade-off. We also compare the performance of the proposed architecture with other LLMs, BERT models, and cutting-edge approaches. The results show good improvements in prediction quality also when compared to a recent technique that incorporates data from 66 different sources, including the NVD.