<p>Software vulnerability assessment (SVA) based on pre-trained language models (PLMs) has shown promising capability in modeling vulnerability severity. However, existing PLM-based SVA methods are still constrained by limited input length, which makes it difficult to process long source code effectively and may introduce substantial irrelevant content into model inputs. Although code simplification offers a potential solution, naive simplification may remove vulnerability-relevant information and degrade assessment quality. To address this problem, we propose CS-SVA, an attention-guided hierarchical code simplification method for PLM-based SVA. CS-SVA first partitions source code into structurally meaningful code snippets through a keywords-based code splitting criterion. It then estimates token-level and statement-level importance signals using PLMs, and performs hierarchical simplification through statement selection and token pruning. In this way, CS-SVA reduces redundant code while preserving vulnerability-relevant information for severity assessment. The simplified code snippets are finally used as input for PLM fine-tuning. Experiments on real-world C/C++ vulnerabilities aligned with CVSS 3.0 show that CS-SVA provides a favorable balance between predictive performance and computational efficiency under the current setting. Compared with the evaluated baselines, CS-SVA achieves stronger overall predictive performance while reducing computational cost on PLM-based models. In addition, ablation results further show that the hierarchical simplification design is effective for balancing structure preservation and fine-grained pruning. These findings suggest that attention-guided hierarchical code simplification is a promising direction for improving PLM-based SVA.</p>

错误:搜索内容不能为空,请输入英文关键词
错误:关键词超出字数限制,请精简
高级检索

Improving security vulnerability assessment with attention-guided hierarchical code simplification

  • Xiang Chen,
  • Shidie Liang,
  • Zongwen Shen,
  • Ziming Li,
  • Siyu Chen

摘要

Software vulnerability assessment (SVA) based on pre-trained language models (PLMs) has shown promising capability in modeling vulnerability severity. However, existing PLM-based SVA methods are still constrained by limited input length, which makes it difficult to process long source code effectively and may introduce substantial irrelevant content into model inputs. Although code simplification offers a potential solution, naive simplification may remove vulnerability-relevant information and degrade assessment quality. To address this problem, we propose CS-SVA, an attention-guided hierarchical code simplification method for PLM-based SVA. CS-SVA first partitions source code into structurally meaningful code snippets through a keywords-based code splitting criterion. It then estimates token-level and statement-level importance signals using PLMs, and performs hierarchical simplification through statement selection and token pruning. In this way, CS-SVA reduces redundant code while preserving vulnerability-relevant information for severity assessment. The simplified code snippets are finally used as input for PLM fine-tuning. Experiments on real-world C/C++ vulnerabilities aligned with CVSS 3.0 show that CS-SVA provides a favorable balance between predictive performance and computational efficiency under the current setting. Compared with the evaluated baselines, CS-SVA achieves stronger overall predictive performance while reducing computational cost on PLM-based models. In addition, ablation results further show that the hierarchical simplification design is effective for balancing structure preservation and fine-grained pruning. These findings suggest that attention-guided hierarchical code simplification is a promising direction for improving PLM-based SVA.