# XLNet-Based Prediction Model for CVSS Metric Values
## 1 Introduction
### Background
#### 1.2.2 The Common Vulnerability Scoring System  
CVSS Overview  
The Common Vulnerability Scoring System (CVSS) is an open framework developed by FIRST.Org, Inc. (FIRST) to characterize and quantify vulnerabilities. CVSS consists of three metric groups: base metric group, temporal metric group, and environmental metric group. Since major vulnerability databases only provide base scores, the base metric group is the most used. The focus of this study is the base metric group. The base metric group reflects the inherent properties of vulnerabilities that remain unchanged over time and across user environments [9]. The base metric group generates scores ranging from 0 to 10. The score and severity mapping table defined by CVSS is shown in Table 1. The CVSS score can also be shown as a vector string, which is a textual and compact way of representing the metric value. The NVD, when using the CVSS, usually gives a string representation of the description and the corresponding vulnerability metric values. The composition and value range of the base metric group and the vector strings corresponding to the metric values for both versions are shown in Tables 2 and 3. When using CVSS for scoring, the metric values for each metric in Tables 2 and 3 are selected. The metric values are substituted into the CVSS quantification formula to obtain the base score. Finally, the base score can be converted into a vulnerability rating according to Table 1. The data in Tables 1-3 are from the CVSS official website [10; 11]. Figure 1: Vulnerability severity distribution over time(2000–2022). \begin{table}
\begin{tabular}{c c c c} \hline \hline \multicolumn{2}{c}{**CVSS v3.1**} & \multicolumn{2}{c}{**CVSS v2.0**} \\ \hline
**Rating** & **CVSS Score** & **Rating** & **CVSS Score** \\ \hline None & 0.0 & None & 0.0 \\ Low & 0.1–3.9 & Low & 0.1–3.9 \\ Medium & 4.0–6.9 & Medium & 4.0–6.9 \\ High & 7.0–8.9 & High & 7.0–10.0 \\ Critical & 9.0–10.0 & & \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Qualitative severity rating scale. \begin{table}
\begin{tabular}{l c} \hline \hline
**Metric Value** & **Possible Values** \\ \hline \multirow{3}{*}{Attack Vector (AV)} & Local (L) \\  & Adjacent Network (A) \\  & Network (N) \\ \hline \multirow{3}{*}{Access Complexity (AC)} & High (H) \\  & Medium (M) \\  & Low (L) \\ \hline \multirow{3}{*}{Authentication (Au)} & Single (S) \\  & None (N) \\  & Multiple (M) \\ \hline \multirow{3}{*}{Confidentiality Impact (C)} & None (N) \\  & Partial (P) \\  & Complete (C) \\ \hline \multirow{3}{*}{Integrity Impact (I)} & None (N) \\  & Partial (P) \\ \cline{1-1}  & Partial (P) \\ \cline{1-1}  & Partial (P) \\ \cline{1-1}  & Complete (C) \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Possible values for the base metric group of the CVSS v2 standard. \begin{table}
\begin{tabular}{c c c} \hline \hline \multicolumn{2}{c}{**Metric Value**} & **Possible Values** \\ \hline \multirow{3}{*}{Attack Vector (AV)} & Physical (P) \\  & Network (N) \\  & Local (L) \\  & Adjacent (A) \\ \hline \multirow{3}{*}{Attack Complexity (AC)} & Low (L) \\  & High (H) \\ \hline \multirow{3}{*}{Privileges Required (PR)} & None (N) \\  & Low (L) \\  & High (H) \\ \hline \multirow{3}{*}{User Interaction (UI)} & Required (R) \\  & None (N) \\ \hline \multirow{3}{*}{Scope (S)} & Unchanged (U) \\  & Changed (C) \\ \hline \multirow{3}{*}{Confidentiality (C)} & None (N) \\  & Low (L) \\  & High (H) \\ \hline \multirow{3}{*}{Integrity (I)} & None (N) \\  & Low (L) \\ \cline{1-1}  & High (H) \\ \hline \hline \end{tabular}
\end{table} 
Table 3: Possible values for the base metric group of the CVSS v3.1 standard. Introduction to CVSS Metrics  
* CVSS v2 base metric group interpretation
* Attack Vector
* This metric indicates the method of exploiting the vulnerability. The farther a potential attacker is, the higher its vulnerability score. * Access Complexity
* This metric measures how difficult it is to exploit the vulnerability. * This metric measures how frequently an attacker must authenticate to exploit a vulnerability.