Abstract
Vulnerability severity assessment is of paramount importance for the cybersecurity defense strategy, as it enables the timely identification of threats and their underlying capabilities, thereby maximizing the efficacy of defense actions. And natural language processing (NLP)-based methods are widely adopted to construct an end-to-end CVE severity predictor based on existing vulnerability description. However, the long-tail distribution in the sentence length and word frequency of vulnerability description significantly hampers the performance of current methodologies. Coping with this challenge, we introduce CVSS-Predictor-AS, which mitigates the long-tail distribution by incorporating auxiliary sentences pertinent to the context of the text. The incorporation of auxiliary sentences rebalances the length distribution of descriptive sentences and addresses the information gaps, particularly for rare words. Comparative experiments conducted on vulnerability descriptions sourced from CVEdetail demonstrate that CVSS-Predictor-AS exhibits notable advantages over existing methods.