Abstract: Abstract: The Common Vulnerability Scoring System (CVSS) serves as the core foundation for vulnerability prioritization, remediation decision-making, and compliance auditing. In real-world Security Operations Centers (SOCs), semi-structured data—such as ports, protocols, services, banners, and version numbers—captured by scanners often arrives prior to the formal Common Vulnerabilities and Exposures (CVE) descriptions. Existing automated scoring methods largely rely on structured vulnerability description text, making them ill-suited for workflows where scanner output precedes vulnerability disclosure. Furthermore, the CVSS base vector comprises eight distinct metrics—Attack Vector, Attack Complexity, Privileges Required, User Interaction, Scope, and the impact on Confidentiality, Integrity, and Availability. A misjudgment in any single field can significantly alter the risk prioritization of a vulnerability. Consequently, a model must not only predict individual labels but also generate a semantically consistent and verifiable complete base vector in a single pass.To address these challenges, we propose VulXbert, an interpretable multi-label prediction model for CVSS v3.1 base vectors. The model employs a dual-channel semantic alignment framework to encode vulnerability description text and host scan outputs independently, leveraging the security-domain pre-trained language model SecureBERT to enhance the representation of vulnerability terminology, service names, port protocols, and semi-structured symbols. During the training phase, the model utilizes temperature-scaled cross-entropy contrastive learning to map inputs from both description and scan channels into a unified embedding space, thereby narrowing the expression gap between public vulnerability disclosures and raw scan logs. During the prediction phase, the model utilizes the shared representation as input to a shared architecture with eight task-specific softmax classification heads, enabling the output of all CVSS v3.1 base vector fields in a single forward pass.To mitigate the impact of class imbalance on minority label performance, we introduce category-weighted cross-entropy, with weights normalized by label frequency in the training set. Furthermore, by incorporating input-gradient saliency analysis, the model provides token-level key evidence for each prediction. This allows security analysts to pinpoint the specific fields supporting judgments on attack vectors, privileges required, or scope, thereby improving the transparency, auditability, and efficiency of human review. Experiments were conducted using approximately 60,000 records from the National Vulnerability Database (NVD) (2016–2024) containing complete CVSS v3.1 base vectors, augmented with real-world scan data. Compared to existing methods such as CVSS-BERT, BERT-multi, Costa et al.’s methods, Kühn et al.’s open-source intelligence-based approach, and AutoCVSS, VulXbert achieved a Macro-F1 of 0.89, Micro-F1 of 0.91, Hamming Loss of 0.054, and Exact Match Accuracy of 68%. Metric-specific analysis demonstrates that VulXbert achieves more stable performance across Attack Vector, Privileges Required, Scope, and the three impact metrics. Ablation studies confirm that the security-domain pre-trained encoder, cross-source semantic alignment, and the joint multi-head prediction structure each contribute significantly to model performance. In summary, by utilizing cross-source semantic alignment, joint multi-label prediction, and evidence-based interpretability, VulXbert provides a scalable solution for automated, interpretable CVSS base vector generation in environments where scan logs arrive ahead of vulnerability descriptions.

摘要： 摘 要： 通用漏洞评分系统（Common Vulnerability Scoring System，CVSS）是漏洞优先级排序、修复决策和合规审计中的核心依据。在真实安全运营中心中，扫描器输出的端口、协议、服务、横幅和版本号等半结构化信息往往早于通用漏洞与披露（Common Vulnerabilities and Exposures，CVE）描述到达，而现有自动化评分方法大多依赖结构完整的漏洞描述文本，难以适配“扫描数据先到、漏洞描述滞后”的处置流程。同时，CVSS基础向量由攻击途径、攻击复杂度、所需权限、用户交互、作用域以及保密性、完整性和可用性影响等8项指标共同组成，任一字段误判都可能改变漏洞风险排序，因此模型不仅需要预测单项标签，还需要一次性生成语义一致、可复核的完整基础向量。针对上述问题，本文提出一种面向CVSSv3.1基础向量的可解释多标签预测模型VulXbert。该模型采用双通道语义对齐框架，分别对漏洞描述文本和主机扫描输出进行编码，并利用安全领域预训练语言模型SecureBERT增强对漏洞术语、服务名称、端口协议和半结构化符号的表达能力。在训练阶段，模型通过归一化温度标度交叉熵对比学习将描述侧与扫描侧输入映射到统一嵌入空间，从而缩小公开漏洞描述与真实扫描日志之间的表达差异；在预测阶段，模型以共享表征为输入，构建8个任务特定的softmax分类头，一次前向传播同时输出CVSSv3.1基础向量的全部字段。为降低类别不平衡对少数类标签的影响，本文引入类别加权交叉熵，并在训练集中按标签频率归一化权重。此外，本文结合输入—梯度显著性分析，为每一项预测结果输出词元级关键证据，使安全分析人员能够定位支撑攻击途径、所需权限或影响范围判断的关键字段，提升模型结果的透明度、可审计性和人工复核效率。实验基于国家漏洞数据库（National Vulnerability Database，NVD）中2016年至2024年包含完整CVSSv3.1基础向量的约6万条记录及真实扫描数据构建，并在统一数据划分和统一评价指标下与CVSS-BERT、BERT-multi、Costa等提出的CVSS指标预测方法、Kühn等提出的基于开源情报信息源的CVSS向量预测方法以及AutoCVSS方法进行对比。结果表明，VulXbert在Macro-F1、Micro-F1、Hamming Loss和Exact Match Accuracy上分别达到0.89、0.91、0.054和68%。进一步的逐指标实验显示，VulXbert在攻击途径、所需权限、作用域和三项影响指标上均取得更稳定表现；消融实验表明，安全领域预训练编码器、跨来源语义对齐和联合多头预测结构均对模型性能有明显贡献。综上，VulXbert通过跨来源语义对齐、多标签联合预测和证据级解释输出，为扫描日志先到条件下的自动化、可解释CVSS基础向量生成提供了一种可扩展方案。