## 6 Hybrid Vulnerability Scoring Model
### Proposed Model  
This study proposes a novel hybrid Human-AI model for automated yet context-aware vulnerability scoring of sensor system threats, leveraging the strengths of both large language models (LLMs) and domain experts. The proposed model operates by dissecting the vulnerability scoring process into modular attribute-based components, following the CVSS v4.0 structure. Specifically, eight core attributes are used for scoring: attack vector, scope, user interaction, privilege required, confidentiality impact, integrity impact, availability impact, and attack complexity. Each of these attributes plays a fundamental role in defining the severity of a given cyber threat, yet presents varying levels of interpretability for AI models and human experts. As shown in Figure 7, for seven of these attributes--excluding attack complexity--the model aggregates the output of three LLMs: ChatGPT, DeepSeek, and Gemini. Each model processes a textual vulnerability description and outputs predicted CVSS values. Due to variability in model behavior and heuristic approaches, each attribute prediction is normalized and averaged across the three models. This ensemble approach mitigates model-specific biases and improves the overall robustness and generalizability of predictions. For instance, while ChatGPT may excel in extracting structured patterns from loosely described attack scenarios, DeepSeek applies rule-based classification, and Gemini incorporates a worst-case principle to reduce the underestimation risks in ambiguous contexts. The aggregation of these three perspectives leads to a more balanced attribute assessment. Figure 7: The proposed hybrid Human–AI model. In contrast, the attribute of attack complexity poses a unique challenge for AI models due to its reliance on nuanced contextual interpretation, such as the preconditions required for a successful exploit. As such, the model integrates two non-AI inputs for this attribute: expert scoring from domain professionals (e.g., automotive security researchers) and a dedicated machine learning classifier trained specifically on annotated CVE datasets. The expert input introduces contextual granularity, while the classifier brings scale and repeatability. These two inputs are averaged to produce a reliable value for attack complexity, enhancing the credibility of the hybrid model. Following attribute extraction, the hybrid model feeds the final averaged attribute values into a CVSS v4.0-based scoring algorithm, which calculates a composite base score for each identified vulnerability. This final hybrid score reflects a multi-dimensional assessment that is data-driven, context-aware, and validated by human expertise. The modular architecture also allows for future extension, such as the integration of additional AI models or context-specific weight tuning. Overall, this proposed hybrid Human-AI model highlights key limitations of automated vulnerability scoring in domain-specific settings.It bridges the gap between general-purpose AI capabilities and the contextual awareness required in safety-critical applications like autonomous vehicles. By combining statistical inference with expert judgment, the model enhances accuracy, reduces bias, and supports scalable, real-time security evaluations across sensor types and attack vectors. In contrast, the attribute of attack complexity poses a unique challenge for AI models due to its reliance on nuanced contextual interpretation, such as the preconditions required for a successful exploit. To address this, a dedicated machine learning classifier was trained specifically on annotated CVE datasets to assist in estimating attack complexity. However, this was complemented--and ultimately validated--by expert scoring from domain professionals (e.g., automotive security researchers), whose judgments were also used for all other CVSS attributes.