Search papers, labs, and topics across Lattice.
This paper introduces EAVA, a novel framework that enhances automated software vulnerability (SV) assessment by integrating large language models (LLMs) to provide supporting evidence alongside predictions. By leveraging rich-text content and contextual project information, EAVA employs a two-stage training pipeline that combines supervised instruction tuning and reinforcement learning to improve reasoning capabilities. Experimental results show that EAVA significantly outperforms existing methods, with improvements ranging from 5.3% to 35.2% across various metrics, while a user study confirms its practical utility for security analysts.
EAVA not only predicts software vulnerabilities but also provides crucial evidence, making automated assessments more reliable and actionable for security experts.
Software vulnerability (SV) assessment helps prioritize remediation by characterizing reported vulnerabilities. Existing automated methods predict assessment results from SV reports (SVRs), but often overlook information in rich text, such as screenshots and code snippets, as well as contextual information about vulnerable projects. They also focus on prediction accuracy without providing explanations or supporting evidence, limiting their practical use when analysts must validate imperfect predictions. We propose EAVA, a framework that uses large language models (LLMs) to assess SVs and provide supporting evidence. EAVA employs specialized LLM agents to process rich-text content and project information, and builds a dedicated assessment model through a two-stage training pipeline. It first uses supervised instruction tuning on automatically annotated reasoning trajectories to inject domain knowledge, and then applies reinforcement learning to improve intrinsic reasoning. EAVA also retrieves similar historical vulnerabilities as supplementary evidence. Experiments on a newly collected SVR dataset show that EAVA outperforms the strongest baseline by 5.3 to 35.2 percent across multiple metrics. Ablation studies confirm the effectiveness of assessment-specific model training and information enrichment. A user study with security experts further demonstrates that the evidence provided by EAVA is useful and practical for real-world SV assessment.
