Separate Bombs from Firecrackers: Intention-guided Vulnerability Assessment via LLM

Although modern vulnerability detection tools enable developers to efficiently identify numerous security flaws, indiscriminate remediation efforts often result in unnecessary development expenses. This is particularly true given that a substantial portion of detected vulnerabilities are either lowly exploitable or have a negligible impact in practical operational environments. Consequently, vulnerability severity assessment has emerged as a critical component in optimizing software development efficiency. Existing vulnerability assessment methods typically rely on manually crafted descriptions associated with source code artifacts. However, due to variability in description quality and subjectivity in intention interpretation, the performance of these methods is seriously limited. To address this issue, this paper introduces VulStamp, a novel intention-guided framework that facilitates description-free vulnerability assessment. Specifically, VulStamp employs static analysis in conjunction with a Large Language Model (LLM) to extract the intention information from vulnerable code. Based on the intention information, VulStamp employs a prompt-tuned model for vulnerability assessment. Furthermore, to mitigate the problem of imbalanced data associated with vulnerability types, VulStamp integrates a Reinforcement Learning (RL)-based prompt-tuning method to train the assessment model. Extensive experimental results demonstrate that VulStamp outperforms the state-of-the-art baselines by an average of 12.9%, 102.6%, 18.3%, and 54.1% in terms of AUC, precision, recall, and F1-score, respectively.