A Lightweight K-Means Clustering Method for Vulnerability Classification with SHA-256 Integrity Verification

Software vulnerability databases add tens of thousands of records each year, and their sources, formats, and forms of expression are highly mixed. Manual classification by reading each record is slow and varies from person to person: descriptions written by different researchers for the same underlying flaw may differ greatly, making prioritization based on them almost unreliable. This study proposes a lightweight vulnerability classification method that combines K-Means clustering with Secure Hash Algorithm 256 (SHA-256) integrity verification. Five numerical features are extracted from each vulnerability record—the Common Vulnerability Scoring System (CVSS) score, access complexity, privileges required, scope, and exploitability—and are standardized before being input into K-Means. The number of clusters K is determined by the elbow method rather than by experience, and each centroid vector obtained by clustering is then hashed separately so that any subsequent modification can be detected. On 600 National Vulnerability Database (NVD)-style records, when K = 4, the silhouette coefficient is 0.4043 and the Calinski-Harabasz index is 1187.05, while the complete SHA-256 verification adds only 0.1167 ms of overhead. The method requires only a few milliseconds on an ordinary laptop and is suitable for vulnerability triage in teaching laboratories or resource-constrained security dashboards.