WSymBERT: a weighted neuro-symbolic model for interpretable CVSS prediction

Abstract

Abstract The rapid growth in reported software vulnerabilities, combined with substantial delays in manual Common Vulnerability Scoring System (CVSS) assessment, has created a critical need for automated and interpretable vulnerability scoring tools. When vulnerabilities remain unscored for long periods, organizations face greater difficulty in prioritizing patches and mitigation actions, which can leave exploitable weaknesses insufficiently addressed during a critical exposure window. This challenge is particularly important for the CVSS Base metrics, which form the foundation for severity assessment and are essential for timely risk evaluation. This paper presents WSymBERT, a neuro-symbolic approach for predicting CVSS v3.1 Base metrics by combining contextual language representations with expert-derived symbolic guidance through a symbolic-guided weighted pooling mechanism. We evaluate WSymBERT on two benchmark datasets, achieving mean accuracies of 96.2% on NVD and 94.7% on Combine across the eight CVSS Base metrics. Across the reported evaluations, WSymBERT achieved higher observed performance than the evaluated baselines, while attribution-based analyses indicated greater emphasis on security-relevant evidence under the specified evaluation protocol.