Improving security vulnerability assessment with attention-guided hierarchical code simplification
摘要
Software vulnerability assessment (SVA) based on pre-trained language models (PLMs) has shown promising capability in modeling vulnerability severity. However, existing PLM-based SVA methods are still constrained by limited input length, which makes it difficult to process long source code effectively and may introduce substantial irrelevant content into model inputs. Although code simplification offers a potential solution, naive simplification may remove vulnerability-relevant information and degrade assessment quality. To address this problem, we propose CS-SVA, an attention-guided hierarchical code simplification method for PLM-based SVA. CS-SVA first partitions source code into structurally meaningful code snippets through a keywords-based code splitting criterion. It then estimates token-level and statement-level importance signals using PLMs, and performs hierarchical simplification through statement selection and token pruning. In this way, CS-SVA reduces redundant code while preserving vulnerability-relevant information for severity assessment. The simplified code snippets are finally used as input for PLM fine-tuning. Experiments on real-world C/C++ vulnerabilities aligned with CVSS 3.0 show that CS-SVA provides a favorable balance between predictive performance and computational efficiency under the current setting. Compared with the evaluated baselines, CS-SVA achieves stronger overall predictive performance while reducing computational cost on PLM-based models. In addition, ablation results further show that the hierarchical simplification design is effective for balancing structure preservation and fine-grained pruning. These findings suggest that attention-guided hierarchical code simplification is a promising direction for improving PLM-based SVA.