A Study on Multi-Task CVSS Metric Prediction via Fine-Tuned SLM (Fine-Tuned SLM 기반 Multi-Task CVSS Metric 예측 모델에 관한 연구)

Park Junhyuk (박준혁); Jaehee Lee (이재희); Hyo-Beom Ahn (안효범)

doi:10.9708/jksci.2025.30.11.063

A Study on Multi-Task CVSS Metric Prediction via Fine-Tuned SLM

Journal of The Korea Society of Computer and Information
Abbr : JKSCI
2025, 30(11), pp.63~70
DOI : 10.9708/jksci.2025.30.11.063
Publisher : The Korean Society Of Computer And Information
Research Area : Engineering > Computer Science
Received : September 10, 2025
Accepted : October 22, 2025
Published : November 28, 2025

Park Junhyuk ¹, Jaehee Lee ², Hyo-Beom Ahn ²

¹공주대학교(천안공과대학)
²국립공주대학교

Accredited

ABSTRACT

This study proposes a lightweight model for automatically predicting CVSS v3.1 Base Metrics from vulnerability descriptions. A multi-task architecture using DistilBERT as a shared encoder with parallel classification heads was trained on about 220,000 NVD records. Experiments showed improved efficiency and consistency over single-task approaches, with input token length identified as a key factor affecting performance. The results demonstrate the feasibility of automating CVSS metric prediction, and future work will extend to unstructured data and explainable AI to enhance reliability.

KEYWORDS

Small Language Model(SLM), Vulnerability Management, Automated Risk Scoring, CVSS, Multi-Task Learning

Journal Copyright Policy

No CCL information provided

Citation status

* References for papers published after 2025 are currently being built.

[other] J. D'Souza / 2023 / A Review of Transformer Models

[confproc] V. Sanh / 2019 / DistilBERT, a distilled version of BERT: smaller, faster, cheaper and lighter / Proc. of the EMC² Workshop at NeurIPS 2019

[confproc] A.K. Threatt / 2021 / Some Analysis of Common Vulnerabilities and Exposures (CVE) Data from the National Vulnerability Database (NVD) / UNCW Honors Research Symposium : 1~11

[journal] H. Kim / 2021 / A Software Vulnerability Risk Scoring System Using Public Vulnerability Information / Journal of the Korea Institute of Information and Communication Engineering 25(5) : 606~615

[journal] J. Kim / 2025 / An Attack Graph and Reinforcement Learning-Based Analysis of Attack Paths for Vulnerability Assessment / Journal of Korean Institute of Intelligent Systems 35(1) : 16~24

[confproc] M.R. Shahid / 2021 / CVSS-BERT: Explainable Natural Language Processing to Determine the Severity of a Computer Security Vulnerability from its Description / 2021 20th IEEE International Conference on Machine Learning and Applications (ICMLA) : 1600~1607

[other] Francesco Marchiori / 2025 / Can LLMs Classify CVEs? Investigating LLMs Capabilities in Computing CVSS Vectors

[web] MITRE Corporation / Common Vulnerabilities and Exposures (CVE) Program Overview / cve.org / https://www.cve.org/about/overview

[web] FIRST.Org, Inc. / Common Vulnerability Scoring System v3.1: Specification Document / first.org / https://www.first.org/cvss/v3-1/specification-document

[web] IBM / Fine-tuning AI models: what it is and how it works / ibm.com / https://www.ibm.com/kr-ko/think/topics/fine-tuning

[confproc] J. Devlin / 2019 / BERT: Pre-training of Deep Bidirectional Transformers for Language Understanding / Proceedings of the 2019 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies (NAACL-HLT) : 4171~4186

KJCKorea
Journal Central

Journal of The Korea Society of Computer and Information 2025 KCI Impact Factor : 1.01

A Study on Multi-Task CVSS Metric Prediction via Fine-Tuned SLM

ABSTRACT

KEYWORDS

Journal Copyright Policy

Citation status

* References for papers published after 2025 are currently being built.

Journal of The Korea Society of Computer and Information 2025 KCI Impact Factor : 1.01

A Study on Multi-Task CVSS Metric Prediction via Fine-Tuned SLM

ABSTRACT

KEYWORDS

Journal Copyright Policy

Statistics

Tools

Issue List

Citation status

KCI Citation Counts (0)

REFERENCES (11) * References for papers published after 2025 are currently being built.

Search PDF

Citation

* References for papers published after 2025 are currently being built.