## 6 Hybrid Vulnerability Scoring Model
### Model Evaluation
However, it struggles significantly with 'Attack Complexity' (AC), especially 'High' AC ((50.00%) precision, (12.50%) recall), and 'Confidentiality' (C), particularly 'High' C ((100.00%) precision but only (25.00%) recall). Similar to other models, it shows (0%) precision and recall for some low-support classes. The results of the traditional ML models show varying performance across the models, with overall accuracies ranging from approximately (46.7%) to (60%). The GloVe + Logistic Regression model demonstrate the weakest performance, particularly struggling with the 'High' class where it shows very low recall and F1 score, suggesting a strong bias towards predicting 'Low' instances. In contrast, the SVM (TF-IDF) model emerges as the most balanced and robust performer, achieving the highest macro F1 score and more comparable F1 scores for both 'High' and 'Low' classes, indicating a better overall ability to classify both categories. The TF-IDF + Logistic Regression and USE + Logistic Regression models, while achieving reasonable accuracy ((60%) and (53.3%), respectively), exhibit a clear tendency to favor the 'High' class, demonstrating high recall for 'High' but significantly lower recall and F1 scores for the 'Low' class, implying they often misclassify 'Low' instances as 'High'. In conclusion, while no model achieves exceptionally high accuracy, SVM (TF-IDF) provides the most reliable and equitable performance across both classes, whereas the other models often showed a clear imbalance in their predictive capabilities. To assess the effectiveness of AI-assisted vulnerability scoring, a hybrid approach was applied using outputs from four large language models (LLMs)--ChatGPT, DeepSeek, Copilot, and Google Gemini--and a traditional machine learning model for Attack Complexity. The hybrid model employed majority voting among LLMs or prediction aggregation in the case of ML. Evaluation was conducted against expert annotations for eight CVSS v4.0 base metrics across 15 attacks. The following analysis details the hybrid model's performance per attribute. **Attack Vector:** The hybrid model correctly predicted 10 out of 15 values, yielding a 66.7% match with expert annotations. Errors were most common in distinguishing between _Local_, _Adjacent_, and _Network_, whereas _Physical_ and _Network_ vectors were more consistently identified. A summary of these results is provided in Table 13, which highlights the strengths of the model and the misclassifications patterns across different attack vectors. Attack Complexity:Predicted via machine learning, the model achieved 9 out of 15 correct predictions (60.0%). This result aligns closely with the model's internal validation performance. The model exhibited better performance in recognizing _High_ complexity than _Low_, particularly when contextual factors were less obvious.These findings are summarized in Table 14, which highlights the model's accuracy and the influence of context on classification performance. Attack Requirements:Also reaching a 60.0% match (9/15), the hybrid model performed moderately in identifying whether specific conditions or requirements were necessary before an attack could be successfully executed. This metric appeared sensitive to implicit contextual cues, which may not be fully captured by LLMs. A detailed breakdown of these results is presented in Table 15, illustrating the model's strengths and contextual limitations. Privileges Required:This metric showed the weakest performance, with only 7 out of 15 correct predictions (46.7%). Confusion was prevalent between _None_, _Low_, and _High_ privileges, indicating a need for deeper contextual comprehension or enriched training data. These results are summarized in Table 16, which details the model's confusion across privilege levels. User Interaction:Achieving the highest accuracy (14/15, or 93.3%), the hybrid model was very effective at determining whether human intervention was necessary.