Security
Towards Early Warning of Real-World Vulnerabilities: An Evidence-Aware Decoupled Method for CVSS Vector Prediction Based on Unstructured Disclosures
arXiv cs.CR0 views
arXiv:2611.06477v1 Announce Type: new Abstract: Early assessment of Common Vulnerability Scoring System (CVSS) vectors from Open Source Intelligence (OSINT) can reduce the delay between initial public disclosure and official National Vulnerability Database (NVD) scoring. Existing predictors, trained mainly on standardized late-stage descriptions, degrade on noisy and incomplete pre-NVD reports. We introduce PARSE, a vulnerability-disclosure lifecycle model, and VPre, an early assessment framework built on two-level Evidence-Aware Decoupling. Decoupling Level I, Security-Evidence Screening, separates security-relevant evidence from noisy early reports at the report and sentence levels. Decoupling Level II, Evidence-Matched Routing, decouples the prediction task of the eight CVSS metrics into a scattered-evidence class and an explicit-evidence class based on validation-set measurements, matching each with a targeted predictor: large-language-model reasoning for the former, lightweight supervised classification for the latter. On the 851-report held-out test split of the 5,581-report VPre-Bench, VPre achieves a mean absolute error of 0.7239 -- 44.7% below the reproduced BERT-Small-NVD early-transfer baseline; paired timestamps across the full benchmark show an average 38-day lead before official scoring (observed range 21-60 days). Under the 38:1 PARSE-Triage noise setting, STDU's report-level screening reaches 0.98 precision, 1.00 recall, and 0.99 F1. Controlled ablations support the contributions of both decoupling levels.
Source:https://arxiv.org/abs/2611.06477PreviousShoot on (Core)Sight: Re-enabling Secure Debug on the RP2350 with Photon-Emission Microscopy and Laser Fault InjectionNextSigned but Steerable: Measuring and Closing the Text-Vector Integrity Gap in Offline Retrieval-Augmented Generation
Related posts
Reassessing Dataset Quality and Fine-Tuning Practices for Vulnerability Detection on PrimeVul dataset
0arXiv cs.SE
AQUA - A Modular Authentication Quality Modeling Framework
0arXiv cs.CR
Security Tip: Your PHP Version Could Be Out of Support — Check Before Year-End
0dev.to Security
Want to Rent an Internet Address at the White House?
0Hacker News New

What Is the Biggest Risk of a WordPress Website Getting Hacked? Findings From My Security Research
0dev.to Security

まだNode.js 20をお使いですか?11月11日のセキュリティリリースではパッチが提供されません
0dev.to News