{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,9,29]],"date-time":"2026-09-29T19:16:19Z","timestamp":1790709379140,"version":"4.1.0"},"reference-count":39,"publisher":"Springer Science and Business Media LLC","issue":"1","license":[{"start":{"date-parts":[[2024,11,7]],"date-time":"2024-11-07T00:00:00Z","timestamp":1730937600000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"},{"start":{"date-parts":[[2024,11,7]],"date-time":"2024-11-07T00:00:00Z","timestamp":1730937600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"}],"funder":[{"name":"The Catalyst: Strategic Cyber Security Research Programme of the Ministry of Business, Innovation, and Employment of New Zealand Government","award":["UOWX1911"],"award-info":[{"award-number":["UOWX1911"]}]},{"name":"The Catalyst: Strategic Cyber Security Research Programme of the Ministry of Business, Innovation, and Employment of New Zealand Government","award":["UOWX1911"],"award-info":[{"award-number":["UOWX1911"]}]}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":["Int. J. Inf. Secur."],"published-print":{"date-parts":[[2025,2]]},"DOI":"10.1007\/s10207-024-00922-z","type":"journal-article","created":{"date-parts":[[2024,11,7]],"date-time":"2024-11-07T03:48:02Z","timestamp":1730951282000},"update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":11,"title":["Ai-enabled automated common vulnerability scoring from common vulnerabilities and exposures descriptions"],"prefix":"10.1007","volume":"24","author":[{"ORCID":"https:\/\/orcid.org\/0000-0001-6535-5134","authenticated-orcid":false,"given":"Zijing","family":"Zhang","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-4955-3058","authenticated-orcid":false,"given":"Vimal","family":"Kumar","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-3732-5787","authenticated-orcid":false,"given":"Bernhard","family":"Pfahringer","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-8339-7773","authenticated-orcid":false,"given":"Albert","family":"Bifet","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"297","published-online":{"date-parts":[[2024,11,7]]},"reference":[{"key":"922_CR1","doi-asserted-by":"publisher","unstructured":"Mell, P., Scarfone, K., Romanosky, S.: et\u00a0al., in Published by FIRST-forum of incident response and security teams, 1(1), p.\u00a023. (2007) https:\/\/doi.org\/10.1049\/iet-ifs:20060055","DOI":"10.1049\/iet-ifs:20060055"},{"key":"922_CR2","doi-asserted-by":"publisher","unstructured":"FIRST, E.: (2019). https:\/\/doi.org\/10.35940\/ijeat.f9302.088619","DOI":"10.35940\/ijeat.f9302.088619"},{"key":"922_CR3","doi-asserted-by":"publisher","unstructured":"first.org, f.: About first. https:\/\/doi.org\/10.1097\/00000446-194205000-00028. https:\/\/www.first.org\/about\/","DOI":"10.1097\/00000446-194205000-00028"},{"key":"922_CR4","doi-asserted-by":"publisher","unstructured":"U.S. Department of Commerce . NVD - Vulnerability Metrics. https:\/\/doi.org\/10.1007\/978-3-642-27739-9_1772-1. https:\/\/nvd.nist.gov\/vuln-metrics\/cvss","DOI":"10.1007\/978-3-642-27739-9_1772-1"},{"key":"922_CR5","doi-asserted-by":"publisher","DOI":"10.1145\/3287921.3287968","author":"J Spring","year":"2018","unstructured":"Spring, J., Hatleback, E., Manion, A., Shic, D.: Software Engineering Institute, Carnegie Mellon University. Tech. Rep (2018). https:\/\/doi.org\/10.1145\/3287921.3287968","journal-title":"Tech. Rep"},{"issue":"2","key":"922_CR6","doi-asserted-by":"publisher","first-page":"74","DOI":"10.1109\/msec.2020.3044475","volume":"19","author":"J Spring","year":"2021","unstructured":"Spring, J., Hatleback, E., Householder, A., Manion, A., Shick, D.: IEEE Security & Privacy 19(2), 74 (2021). https:\/\/doi.org\/10.1109\/msec.2020.3044475","journal-title":"IEEE Security & Privacy"},{"key":"922_CR7","doi-asserted-by":"publisher","DOI":"10.1201\/b16132-39","author":"S Christey","year":"2013","unstructured":"Christey, S., Kenderdine, J., Mazella, J., Miles, B.: Mitre Corporation (2013). https:\/\/doi.org\/10.1201\/b16132-39","journal-title":"Mitre Corporation"},{"key":"922_CR8","doi-asserted-by":"publisher","unstructured":"MITRE, P.: Common weakness enumeration (2006). https:\/\/doi.org\/10.2337\/diabetes.55.03.06.db05-1237. https:\/\/cwe.mitre.org\/data\/definitions\/79.html","DOI":"10.2337\/diabetes.55.03.06.db05-1237"},{"key":"922_CR9","doi-asserted-by":"publisher","first-page":"512","DOI":"10.1109\/iceta.2017.8102476","volume":"8","author":"S Gupta","year":"2017","unstructured":"Gupta, S., Gupta, B.B.: International Journal of System Assurance Engineering and Management 8, 512 (2017). https:\/\/doi.org\/10.1109\/iceta.2017.8102476","journal-title":"International Journal of System Assurance Engineering and Management"},{"key":"922_CR10","doi-asserted-by":"publisher","unstructured":"Joachims, T.: A probabilistic analysis of the rocchio algorithm with tfidf for text categorization. Tech. rep., Carnegie-mellon univ pittsburgh pa dept of computer science (1996). https:\/\/doi.org\/10.1007\/3-540-60925-3_58","DOI":"10.1007\/3-540-60925-3_58"},{"key":"922_CR11","doi-asserted-by":"publisher","unstructured":"Kramer, O.: in Machine learning for evolution strategies (Springer, 2016), pp. 45\u201353.https:\/\/doi.org\/10.1007\/978-3-319-33383-0_5","DOI":"10.1007\/978-3-319-33383-0_5"},{"issue":"12","key":"922_CR12","doi-asserted-by":"publisher","first-page":"1565","DOI":"10.1038\/nbt1206-1565","volume":"24","author":"WS Noble","year":"2006","unstructured":"Noble, W.S.: Nature biotechnology 24(12), 1565 (2006). https:\/\/doi.org\/10.1038\/nbt1206-1565","journal-title":"Nature biotechnology"},{"key":"922_CR13","doi-asserted-by":"publisher","unstructured":"Kibriya, A.M., Frank, E., Pfahringer, B., Holmes, G.: in Australasian Joint Conference on Artificial Intelligence (Springer, 2004), pp. 488\u2013499. https:\/\/doi.org\/10.1007\/978-3-540-30549-1_43","DOI":"10.1007\/978-3-540-30549-1_43"},{"key":"922_CR14","doi-asserted-by":"publisher","unstructured":"Iyyer, M., Manjunatha, V., Boyd-Graber, J., Daum\u00e9\u00a0III, H.: in Proceedings of the 53rd annual meeting of the association for computational linguistics and the 7th international joint conference on natural language processing (volume 1: Long papers) (2015), pp. 1681\u20131691.https:\/\/doi.org\/10.3115\/v1\/p15-1162","DOI":"10.3115\/v1\/p15-1162"},{"key":"922_CR15","doi-asserted-by":"publisher","unstructured":"Kitaev, N., Kaiser, \u0141., Levskaya, A.: arXiv preprint arXiv:2001.04451 (2020). https:\/\/doi.org\/10.1002\/9783527809080.cataz17850","DOI":"10.1002\/9783527809080.cataz17850"},{"key":"922_CR16","doi-asserted-by":"publisher","unstructured":"Vaswani, A., Shazeer, N., Parmar, N., Uszkoreit, J., Jones, L., Gomez, A.N., Kaiser, \u0141., Polosukhin, I.: Advances in neural information processing systems 30 (2017). https:\/\/doi.org\/10.4324\/9781315457055-26","DOI":"10.4324\/9781315457055-26"},{"key":"922_CR17","doi-asserted-by":"publisher","unstructured":"Cer, D., Yang, Y., Kong, S.y., Hua, N., Limtiaco, N., John, R.S., Constant, N., Guajardo-Cespedes, M., Yuan, S., Tar, C.: et\u00a0al., arXiv preprint arXiv:1803.11175 (2018). https:\/\/doi.org\/10.18653\/v1\/d18-2029","DOI":"10.18653\/v1\/d18-2029"},{"key":"922_CR18","doi-asserted-by":"publisher","unstructured":"Brown, T., Mann, B., Ryder, N., Subbiah, M., Kaplan, J.D., Dhariwal, P., Neelakantan, A., Shyam, P., Sastry, G., Askell, A. et\u00a0al.: Advances in neural information processing systems 33, 1877 (2020). https:\/\/doi.org\/10.18653\/v1\/2020.emnlp-main.375","DOI":"10.18653\/v1\/2020.emnlp-main.375"},{"key":"922_CR19","doi-asserted-by":"publisher","unstructured":"Sn\u00e6bjarnarson, V., S\u00edmonarson, H.B., Ragnarsson, P.O., Ing\u00f3lfsd\u00f3ttir, S., J\u00f3nsson, H.P., \u00deorsteinsson, V., Einarsson, H.: arXiv preprint arXiv:2201.05601 (2022). https:\/\/doi.org\/10.1109\/access.2022.3182505","DOI":"10.1109\/access.2022.3182505"},{"key":"922_CR20","doi-asserted-by":"publisher","unstructured":"S.\u00a0Goodman, in Seminars in hematology, vol.\u00a045 (Elsevier, 2008), vol.\u00a045, pp. 135\u2013140. https:\/\/doi.org\/10.1053\/j.seminhematol.2008.04.003","DOI":"10.1053\/j.seminhematol.2008.04.003"},{"issue":"3","key":"922_CR21","doi-asserted-by":"publisher","first-page":"179","DOI":"10.1038\/nmeth.3288","volume":"12","author":"LG Halsey","year":"2015","unstructured":"Halsey, L.G., Curran-Everett, D., Vowler, S.L., Drummond, G.B.: Nature methods 12(3), 179 (2015). https:\/\/doi.org\/10.1038\/nmeth.3288","journal-title":"Nature methods"},{"key":"922_CR22","doi-asserted-by":"publisher","unstructured":"Power analysis, statistical significance, and effect size. https:\/\/doi.org\/10.4324\/9781315456539-39. https:\/\/meera.snre.umich.edu\/power-analysis-statistical-significance-effect-size.html#:~:text=Generally%2C%20effect%20size%20is%20calculated,of%20one%20of%20the%20groups","DOI":"10.4324\/9781315456539-39"},{"key":"922_CR23","doi-asserted-by":"publisher","unstructured":"C.N.A. CNA. Key details phrasing - cve (2023). https:\/\/doi.org\/10.1093\/oed\/9217800699. https:\/\/www.cve.org\/Resources\/General\/Key-Details-Phrasing.pdf","DOI":"10.1093\/oed\/9217800699"},{"issue":"3","key":"922_CR24","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1145\/3498537","volume":"31","author":"H Guo","year":"2022","unstructured":"Guo, H., Chen, S., Xing, Z., Li, X., Bai, Y., Sun, J.: ACM Transactions on Software Engineering and Methodology (TOSEM) 31(3), 1 (2022). https:\/\/doi.org\/10.1145\/3498537","journal-title":"ACM Transactions on Software Engineering and Methodology (TOSEM)"},{"key":"922_CR25","doi-asserted-by":"publisher","unstructured":"Sumoto, K., Kanakogi, K., Washizaki, H., Tsuda, N., Yoshioka, N., Fukazawa, Y., Kanuka, H.: in 2022 IEEE 23rd International Conference on Information Reuse and Integration for Data Science (IRI) (IEEE, 2022), pp. 164\u2013165. https:\/\/doi.org\/10.1109\/iri54793.2022.00045","DOI":"10.1109\/iri54793.2022.00045"},{"key":"922_CR26","doi-asserted-by":"publisher","unstructured":"Zhang, S., Zhang, M., Zhao, L.: in IFIP Annual Conference on Data and Applications Security and Privacy (Springer, 2023), pp. 386\u2013403. https:\/\/doi.org\/10.1007\/978-3-031-37586-6_23","DOI":"10.1007\/978-3-031-37586-6_23"},{"key":"922_CR27","doi-asserted-by":"publisher","first-page":"18","DOI":"10.1016\/j.cose.2015.04.012","volume":"53","author":"H Holm","year":"2015","unstructured":"Holm, H., Afridi, K.K.: Computers & Security 53, 18 (2015). https:\/\/doi.org\/10.1016\/j.cose.2015.04.012","journal-title":"Computers & Security"},{"key":"922_CR28","doi-asserted-by":"publisher","unstructured":"Yamamoto, Y., Miyamoto, D., Nakayama, M.: in 2015 4th International Workshop on Building Analysis Datasets and Gathering Experience Returns for Security (BADGERS) (IEEE, 2015), pp. 67\u201373. https:\/\/doi.org\/10.1109\/badgers.2015.018","DOI":"10.1109\/badgers.2015.018"},{"issue":"2","key":"922_CR29","doi-asserted-by":"publisher","first-page":"148","DOI":"10.1016\/j.jides.2016.10.002","volume":"3","author":"A Beck","year":"2016","unstructured":"Beck, A., Rass, S.: Journal of Innovation in Digital Ecosystems 3(2), 148 (2016). https:\/\/doi.org\/10.1016\/j.jides.2016.10.002","journal-title":"Journal of Innovation in Digital Ecosystems"},{"key":"922_CR30","doi-asserted-by":"publisher","unstructured":"Shahid, M.R., Debar, H.: in 2021 20th IEEE International Conference on Machine Learning and Applications (ICMLA) (IEEE, 2021), pp. 1600\u20131607. https:\/\/doi.org\/10.1109\/icmla52953.2021.00256","DOI":"10.1109\/icmla52953.2021.00256"},{"key":"922_CR31","doi-asserted-by":"publisher","DOI":"10.1109\/access.2022.3179692","author":"JC Costa","year":"2022","unstructured":"Costa, J.C., Roxo, T., Sequeiros, J.B., Proen\u00e7a, H., In\u00e1cio, P.R.: IEEE Access (2022). https:\/\/doi.org\/10.1109\/access.2022.3179692","journal-title":"IEEE Access"},{"key":"922_CR32","doi-asserted-by":"publisher","unstructured":"NVD, N.: A brief history of the nvd. https:\/\/doi.org\/10.4102\/satnt.v11i1.521. https:\/\/nvd.nist.gov\/general\/brief-history","DOI":"10.4102\/satnt.v11i1.521"},{"key":"922_CR33","doi-asserted-by":"publisher","unstructured":"Nowak, M., Walkowski, M., Sujecki, S.: in International Conference on Computational Science (Springer, 2021), pp. 255\u2013269. https:\/\/doi.org\/10.1007\/978-3-030-77967-2_21","DOI":"10.1007\/978-3-030-77967-2_21"},{"issue":"2","key":"922_CR34","doi-asserted-by":"publisher","first-page":"129","DOI":"10.1016\/j.aci.2017.12.002","volume":"15","author":"J Ruohonen","year":"2019","unstructured":"Ruohonen, J.: Applied Computing and Informatics 15(2), 129 (2019). https:\/\/doi.org\/10.1016\/j.aci.2017.12.002","journal-title":"Applied Computing and Informatics"},{"key":"922_CR35","doi-asserted-by":"publisher","unstructured":"Abadi, M., Agarwal, A., Barham, P., Brevdo, E., Chen, Z., Citro, C., Corrado, G.S., Davis, A., Dean, J., Devin, M., Ghemawat, S., Goodfellow, I., Harp, A., Irving, G., Isard, M., Jia, Y., Jozefowicz, R., Kaiser, L., Kudlur, M., Levenberg, J., Man\u00e9, D., Monga, R., Moore, S., Murray, D., Olah, C., Schuster, M., Shlens, J., Steiner, B., Sutskever, I., Talwar, K., Tucker, P., Vanhoucke, V., Vasudevan, V., Vi\u00e9gas, F., Vinyals, O., Warden, P., Wattenberg, M., Wicke, M., Yu, Y., Zheng, X.: TensorFlow: Large-scale machine learning on heterogeneous systems (2015). https:\/\/doi.org\/10.1109\/fpl.2015.7293751. https:\/\/www.tensorflow.org\/. Software available from tensorflow.org","DOI":"10.1109\/fpl.2015.7293751"},{"issue":"7825","key":"922_CR36","doi-asserted-by":"publisher","first-page":"357","DOI":"10.1038\/s41586-020-2649-2","volume":"585","author":"CR Harris","year":"2020","unstructured":"Harris, C.R., Millman, K.J., van der Walt, S.J., Gommers, R., Virtanen, P., Cournapeau, D., Wieser, E., Taylor, J., Berg, S., Smith, N.J., Kern, R., Picus, M., Hoyer, S., van Kerkwijk, M.H., Brett, M., Haldane, A., del R\u00edo, J.F., Wiebe, M., Peterson, P., G\u00e9rard-Marchant, P., Sheppard, K., Reddy, T., Weckesser, W., Abbasi, H., Gohlke, C., Oliphant, T.E.: Nature 585(7825), 357 (2020). https:\/\/doi.org\/10.1038\/s41586-020-2649-2","journal-title":"Nature"},{"key":"922_CR37","doi-asserted-by":"publisher","unstructured":"F.\u00a0Pedregosa, G.\u00a0Varoquaux, A.\u00a0Gramfort, V.\u00a0Michel, B.\u00a0Thirion, O.\u00a0Grisel, M.\u00a0Blondel, P.\u00a0Prettenhofer, R.\u00a0Weiss, V.\u00a0Dubourg, et\u00a0al., the Journal of machine Learning research 12, 2825 (2011). https:\/\/doi.org\/10.1016\/j.neuroimage.2010.05.065","DOI":"10.1016\/j.neuroimage.2010.05.065"},{"key":"922_CR38","doi-asserted-by":"publisher","unstructured":"IBM. Common Vulnerability Scoring System (CVSS). https:\/\/doi.org\/10.1007\/978-1-4614-1860-3_3. https:\/\/www.ibm.com\/docs\/en\/qradar-on-cloud?topic=vulnerabilities-common-vulnerability-scoring-system-cvss","DOI":"10.1007\/978-1-4614-1860-3_3"},{"key":"922_CR39","doi-asserted-by":"publisher","unstructured":"NVD, N.: National vulnerability database (2022).https:\/\/doi.org\/10.1007\/978-981-19-3486-5_10","DOI":"10.1007\/978-981-19-3486-5_10"}],"container-title":["International Journal of Information Security"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s10207-024-00922-z.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/article\/10.1007\/s10207-024-00922-z\/fulltext.html","content-type":"text\/html","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s10207-024-00922-z.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,2,12]],"date-time":"2025-02-12T00:14:01Z","timestamp":1739319241000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1007\/s10207-024-00922-z"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2024,11,7]]},"references-count":39,"journal-issue":{"issue":"1","published-print":{"date-parts":[[2025,2]]}},"alternative-id":["922"],"URL":"https:\/\/doi.org\/10.1007\/s10207-024-00922-z","relation":{},"ISSN":["1615-5262","1615-5270"],"issn-type":[{"value":"1615-5262","type":"print"},{"value":"1615-5270","type":"electronic"}],"subject":[],"published":{"date-parts":[[2024,11,7]]},"assertion":[{"value":"7 November 2024","order":1,"name":"first_online","label":"First Online","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"This research partially fulfills the requirements for the Ph.D. by publication at the University of Waikato in New Zealand. The Ministry of Business, Innovation, and Employment (MBIE) of the New Zealand Government funded this research under the Catalyst program for cybersecurity research. Z.Z. conducted the experiments presented in this paper independently without any financial incentives or Conflict of interest other than the MBIE funding and the prospected doctorial degree reward from the University of Waikato. All commercial entities mentioned in this research are present, solely due to the nature of CVE exposures. None of the aforementioned companies contacted the authors to influence the research results. There is no ethical approval needed for this research. The data involved in this research are publicly available from the National Vulnerability Database and the Common Vulnerabilities and Exposures database, crawled and stored in a public GitLab repository\n                      \n                      . The machine learning models and tools used in this research are open-source and publicly available in TensorFlow and Hugging Face. Z.Z. proposed the research methods, conducted the experiments, and composed the manuscript. V.K., the main supervisor of Z.Z., peer-reviewed weekly on the experiments with expertise in cybersecurity and administrated the research with aspects of funding, resources, and general guidance. B.P. offered machine learning insights and inspirations on machine learning methods in our weekly seminars. A.B. provided machine learning infrastructure through New Zealand Artificial Intelligence Institute and revised the manuscript.","order":1,"name":"Ethics","group":{"name":"EthicsHeading","label":"Declarations"}}],"article-number":"16"}}