A software vulnerability assessment method based on continuous learning

Abstract

The application provides a software vulnerability evaluation method based on continuous learning, and belongs to the technical field of software engineering. The technical problem of decline in evaluation accuracy caused by catastrophic forgetting when dealing with dynamic data flow is solved. The technical scheme comprises the following steps: (1) collecting and processing vulnerability severity prediction related data sets, and dividing the data sets into several tasks; (2) using model confidence to replay the number of old tasks; (3) fusing source code and vulnerability description, inputting into CodeT5 for model and prompt template training; (4) introducing an EWC regularization term to ensure that the parameters will not have large deviations when training new tasks; (5) fusing source code and vulnerability description by means of a hybrid prompt template, inputting into the model and completing severity prediction. The application has the beneficial effect that, by means of prompt fine-tuning and fusion of source code and vulnerability description, vulnerability evaluation is carried out according to dynamic data of real projects, and the problem of catastrophic forgetting is alleviated.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of software engineering, and particularly relates to a software vulnerability evaluation method based on continuous learning. BACKGROUND

[0002] Software vulnerabilities can pose a serious threat to the security and reliability of computer systems and can cause significant economic losses. In particular, with the emergence of new technologies increasing the complexity of the Internet, the frequency of vulnerabilities has increased, but due to the complexity of software and limited repair resources, it is not possible to complete the repair of vulnerabilities in a short period of time. Therefore, it is necessary for us to identify high-risk vulnerabilities and prioritize repairs.

[0003] Common Vulnerability Scoring System is a general vulnerability evaluation framework that considers various aspects of vulnerabilities and generates vulnerability severity scores based on expert knowledge. Therefore, there is an urgent need for automated evaluation tools or models to help software workers screen out which vulnerabilities need to be addressed.

[0004] To solve this problem, researchers use the information obtained to build a vulnerability evaluation model to predict the severity of vulnerabilities. Compared with the fine-tuning method based on pre-trained language models, traditional models have fallen behind. However, there are two problems if you directly use pre-trained language models to carry out downstream tasks. On the one hand, it is challenging for pre-trained language models to learn sample-specific knowledge, and on the other hand, fine-tuning requires a large amount of data to perform well. The emergence of prompt learning has alleviated the above problems. In addition, existing research basically only predicts one type of information (source code or vulnerability description), and cannot fully exploit vulnerability information. Therefore, it is necessary to study a more advanced software vulnerability severity prediction method that integrates source code and vulnerability description to better solve the software vulnerability evaluation problem.

[0005] How to solve the above technical problems has become a problem faced by the present application. SUMMARY

[0006] The purpose of the present application is to provide a software vulnerability evaluation method based on continuous learning, which can predict the severity of software vulnerabilities.

[0007] The idea of the present application is that the software vulnerability evaluation method based on continuous learning proposed by the present application constructs a double-modal input by designing a hybrid prompt template for source code and vulnerability description, designs a mapping method, adds mapping words corresponding to the categories, inputs the double-modal information into the pre-trained model CodeT5 for training, maps the natural language output of the model to specific categories through the mapping method constructed, compares the performance changes, and uses the early stopping strategy to construct the optimal software vulnerability severity prediction model, thereby more accurately and efficiently evaluating software vulnerabilities.

[0008] The application is realized by the following measures: a software vulnerability evaluation method based on continuous learning, comprising the following steps:

[0009] (1) Collecting vulnerability-related data including CVE ID, vulnerability code, vulnerability severity, vulnerability description, etc. by mining CVE vulnerability database and actual software development projects based on Git platform, preprocessing these data, and constructing dataset D; wherein the vulnerability severity contains types: LOW, MEDIUM, HIGH and CRITICAL, comprising the following steps:

[0010] (1-1) Extracting all code changes related to the vulnerability from open source projects based on Git website by obtaining CVE ID, vulnerability severity, and vulnerability description of the vulnerability in CVE, and extracting the source code before modification;

[0011] (1-2) Preprocessing the source code, including removing comments, blank lines, and line comments, and finally forming the vulnerability dataset D.

[0012] (2) Dividing the dataset, first simulating dynamic learning in the continuous learning scenario to divide the dataset task, then dividing each task dataset into training set, validation set and test set according to the ratio of 8:1:1, and using stratified sampling method to ensure that the vulnerability severity distribution in the two sets remains consistent;

[0013] (3) Using a replay method based on model confidence to replay the dataset of old tasks. Before each model training, we select data in old tasks for replay according to the confidence of the model, and combine the replayed data with the current task data and divide them into training set, validation set and test set according to the ratio of 8:1:1. Stratified sampling method is used to ensure that the vulnerability severity distribution in the two sets remains consistent;

[0014] (3-1) We consider all datasets of each task before the current task and combine them as D train and train the model f.

[0015] (3-2) We calculate the confidence of each sample x train in the training set D i . The confidence of x i comes from the prediction probability of the model, and the maximum probability is taken as the confidence. The confidence formula is designed as follows:

[0016]

[0017] where K is the number of categories, is the logit of class j, is xi logit of the predicted class, is the sum of the exponentials of all class logits, used for normalization.

[0018] (3-3) We sort the samples in D train in ascending order of their confidence scores, obtaining sorted samples . Then, we select the N samples with the lowest confidence scores from the training set for replay, denoted as D replay . Finally, we combine the training set of the current task with the selected low-confidence samples, as follows:

[0019]

[0020] (4) For the dataset processed in step (3), extract the source code and vulnerability description, combine them with the mixed prompt template we constructed to form new inputs, and input them into the pre-trained model CodeT5 to train the software vulnerability severity prediction model and the mixed prompt template through prompt fine-tuning, which includes the following steps:

[0021] (4-1) Construct the prompt template: use hard prompts to distinguish between source code and vulnerability description, and add “The code snippet:” and “The vulnerability description:” respectively. For severity classification, use the [SOFT] label to create a soft prompt, which is initialized as “Classify the severity:” during training, and use the [MASK] label to predict or fill in the missing information;

[0022] (4-2) Construct the mapping method: map the natural language output of the model to specific categories. If the output is “low” or “slight”, map it to LOW; if it is “medium” or “moderate”, map it to MEDIUM; if it is “high” or “severe”, map it to HIGH; if it is “critical” or “significant”, map it to CRITICAL;

[0023] (4-3) Input the dual-modal information into the pre-trained model CodeT5 for prompt fine-tuning and mixed prompt template training.

[0024] (5) In the training of the model, the EWC loss function is used. When training a new task, the parameters (weights) of the model are restricted to be close to the optimal parameters of the previous task, ensuring that the learning process of the new task does not significantly change the parameters that are crucial to the old task, thereby alleviating catastrophic forgetting.

[0025] (5-1) We use the traditional stochastic gradient descent (SGD) method to train the neural network model, and train the initial task model. During the training process, the data is randomly shuffled and processed in small batches. After completing the training of the initial task, we save the trained model parameters.

[0026] (5-2) Calculate the Fisher information matrix to quantify the importance of each parameter to the initial task. We use the training data A to calculate the Fisher information matrix item of each parameter. Specifically, the Fisher information matrix item I(θ) is obtained by calculating the gradient of the loss function of each parameter θ, and taking the square expectation value of these gradients, which is:

[0027]

[0028] In practice, this is usually approximated by calculating the average of the squared gradients of the training data:

[0029]

[0030] where is the log-likelihood loss function.

[0031] (5-3) After calculating the Fisher information matrix and the importance weight of each parameter, they will be saved for use in subsequent tasks. When training a new task, we use a loss function with a regularization term to ensure that the model parameters do not deviate too much from the parameters of the initial task. EWC prevents catastrophic forgetting by adding a penalty term to the loss function. This regularization term is weighted according to the Fisher information matrix. The formula definition of the loss function is as follows:

[0032]

[0033] where L B (θ) is the loss function of the current task, λ is the hyperparameter used to balance the importance of the new task and the old task, F i is the Fisher information matrix of the i-th parameter, θ i is the i-th parameter of the current task, is the i-th parameter trained in the initial task. This formula adds a penalty term during the training process of the new task to prevent the model parameters from deviating from the optimal parameters learned in the previous task.

[0034] (6) During the model training process, use the early stopping strategy. If the validation set index decreases continuously for 10 times, stop training to prevent overfitting problems, and return the constructed optimal software vulnerability severity prediction model and corresponding prompt template, which includes the following steps: ​

[0035] (6-1) The F1 index value of the calculation model on the validation set changes.

[0036] (6-2) When the F1 value does not exceed the current best performance for 10 consecutive rounds, stop training and return the best vulnerability severity prediction model and mixed prompt template.

[0037] (7) For the software vulnerability to be evaluated, the source code and vulnerability description information of the vulnerability can be extracted, fused with the trained mixed prompt template P, and finally input into the software vulnerability severity prediction model M constructed above to complete the severity prediction of the target software vulnerability.

[0038] (7-1) Extract the source code and vulnerability description of the vulnerability to be evaluated, and fuse them with the trained mixed prompt template P;

[0039] (7-2) Input the fused data into the trained prediction model M to generate an output in natural language form;

[0040] (7-3) Map the natural language result output by the model to a specific severity level and return the final prediction result.

[0041] Compared with the prior art, the beneficial effects of the present application are: the software vulnerability evaluation method based on continuous learning proposed in the present application takes the dual-modal information fusion of vulnerability source code and vulnerability description as input, uses an advanced pre-trained language model and performs prompt fine-tuning, and considers the use scenario of continuous learning, better mines vulnerability information, can more accurately and reliably classify vulnerability severity, and at the same time to a certain extent, alleviates the problem of catastrophic forgetting caused by the model due to the increase of data over time in real projects. BRIEF DESCRIPTION OF DRAWINGS

[0042] The accompanying drawings are included to provide a further understanding of the present application, and constitute a part of the specification, which together with the embodiments of the present application, serve to explain the present application, and do not constitute a limitation of the present application.

[0043] Figure 1 A system framework diagram of the software vulnerability evaluation method based on continuous learning provided by the present application. DETAILED DESCRIPTION

[0044] In order to make the purpose, technical scheme and advantages of the present application clearer, the present application will be further described in detail below in combination with the drawings and embodiments. Of course, the specific embodiments described herein are only used to explain the present application, and do not limit the present application.

[0045] Example 1

[0046] The technical scheme of the embodiment is a software vulnerability evaluation method based on continuous learning, which comprises the following contents Figure 1 The technical scheme of the embodiment is a software vulnerability evaluation method based on continuous learning, which comprises the following contents

[0047] (1) The CVE vulnerability database and the actual software development project are mined based on the Git platform, and the vulnerability related data including CVE ID, vulnerability code, vulnerability severity, vulnerability description, etc. is collected. The data is preprocessed to construct a data set D. The vulnerability severity includes types: LOW, MEDIUM, HIGH and CRITICAL, and comprises the following steps:

[0048] (1-1) The CVE ID, vulnerability severity and vulnerability description of the vulnerability in the CVE are obtained, all code changes related to the vulnerability are extracted from the open source project based on the Git website, and the source code before modification is extracted;

[0049] (1-2) The source code is preprocessed, including removing comments, blank lines and line comments, and finally forming a vulnerability data set D.

[0050] (2) The data set is divided. First, the dynamic learning in the continuous learning scene is simulated to divide the data set task, and then the data set of each task is divided into training set, validation set and test set according to the ratio of 8:1:1. The division process should use stratified sampling method to ensure that the vulnerability severity distribution in the two sets is consistent;

[0051] (3) The replay method based on model confidence is used to replay the data set of the old task. Before each model training, we select the data in the old task according to the confidence of the model to replay and combine the replayed data with the data of the current task, and then divide them into training set, validation set and test set according to the ratio of 8:1:1. The division process should use stratified sampling method to ensure that the vulnerability severity distribution in the two sets is consistent;

[0052] (3-1) We consider all data sets of each task before the current task, and combine them into D train and train the model f.

[0053] (3-2) We calculate the confidence of each sample x train in the training set D i . The confidence of x i comes from the prediction probability of the model, and the maximum probability is taken as the confidence. The confidence formula is designed as follows:

[0054]

[0055] where K is the number of categories, is the logit of class j, is x i the logit of the predicted class, is the sum of the exponentials of all class logits, used for normalization.

[0056] (3-3) We sort the samples in D train in ascending order of their confidence scores, obtaining sorted samples . Then, we select the N samples with the lowest confidence from the training set, denoted as D replay . Finally, we combine the training set of the current task with the selected low-confidence samples, as follows:

[0057]

[0058] (4) For the dataset processed in step (3), extract the source code and vulnerability description, combine them with the mixed prompt template we constructed to form new inputs, and input them into the pre-trained model CodeT5 to train the software vulnerability severity prediction model and the mixed prompt template through prompt fine-tuning, which includes the following steps:

[0059] (4-1) Construct the prompt template: use hard prompts to distinguish between source code and vulnerability description, and add “The code snippet:” and “The vulnerability description:” respectively. For severity classification, use the [SOFT] label to create a soft prompt, which is initialized as “Classify the severity:” during training, and use the [MASK] label to predict or fill in the missing information;

[0060] (4-2) Construct the mapping method: map the natural language output of the model to specific categories. If the output is “low” or “slight”, map it to LOW; if it is “medium” or “moderate”, map it to MEDIUM; if it is “high” or “severe”, map it to HIGH; if it is “critical” or “significant”, map it to CRITICAL;

[0061] (4-3) Input the dual-modal information into the pre-trained model CodeT5 for prompt fine-tuning and mixed prompt template training.

[0062] (5) In the training of the model, the EWC loss function is used. When training a new task, the parameters (weights) of the model are restricted to be close to the optimal parameters of the previous task, ensuring that the learning process of the new task does not significantly change the parameters that are crucial to the old task, thereby alleviating catastrophic forgetting.

[0063] (5-1) We use the traditional stochastic gradient descent (SGD) method to train the neural network model for the initial task. During training, the data is randomly shuffled and processed in mini-batches. After completing the initial task training, we save the trained model parameters.

[0064] (5-2) Calculate the Fisher information matrix to quantify the importance of each parameter to the initial task. We use the training data A to calculate the Fisher information matrix item for each parameter. Specifically, the Fisher information matrix item I(θ) is calculated by computed a loss function for each parameter θ. The gradient is obtained by taking the expected value of the squares of these gradients, and the formula is:

[0065]

[0066] In practice, this is usually approximated by calculating the average of the squared gradients of the training data:

[0067]

[0068] in It is the log-likelihood loss function.

[0069] (5-3) After calculating the Fisher information matrix and the importance weights of each parameter, these will be saved for use in subsequent tasks. When training a new task, we use a loss function with a regularization term to ensure that the model parameters do not deviate too much from the parameters of the initial task. EWC prevents catastrophic forgetting by adding a penalty term to the loss function. This regularization term is weighted according to the Fisher information matrix. The formula for the loss function is defined as follows:

[0070]

[0071] Where L B (θ) is the loss function for the current task, λ is a hyperparameter used to balance the importance of new and old tasks, and F i Let θ be the Fisher information matrix for the i-th parameter. i For the i-th parameter of the current task, Let be the i-th parameter trained in the initial task. This formula incorporates a penalty term during the training of the new task to prevent the model parameters from deviating from the optimal parameters learned in the previous task.

[0072] (6) In the model training process, the early stopping strategy is used, if the index of the validation set continuously decreases for 10 times, the training is stopped to prevent overfitting problem, and the optimal software vulnerability severity prediction model and the corresponding prompt template are returned, including the following steps:

[0073] (6-1) Calculate the F1 index value change of the model on the validation set.

[0074] (6-2) When the F1 value continuously does not exceed the current best performance for 10 rounds, the training is stopped, and the best vulnerability severity prediction model and the mixed prompt template are returned.

[0075] (7) For the software vulnerability to be evaluated, the vulnerability source code and vulnerability description information can be extracted, fused with the trained mixed prompt template P, and finally input into the above constructed software vulnerability severity prediction model M to complete the severity prediction of the target software vulnerability.

[0076] (7-1) Extract the source code and vulnerability description of the vulnerability to be evaluated, and fuse them with the trained mixed prompt template P;

[0077] (7-2) Input the fused data into the trained prediction model M to generate an output in natural language form;

[0078] (7-3) Map the natural language result output by the model to a specific severity level, and return the final prediction result.

[0079] (8) Compare the method of the present application and the existing software vulnerability evaluation method on the same data set, use two performance indicators (F1 source and MCC) from the field of software vulnerability evaluation research to automatically evaluate the quality of the model:

[0080] Table 1 Comparison table of the results of the method of the present application and the remaining methods

[0081]

[0082] Experiments show that the software vulnerability evaluation method based on continuous learning proposed in the present application has higher F1 score and MCC than the baseline method, and therefore can make more reliable and accurate software vulnerability severity prediction. Specifically, the method of the present application uses a continuous learning method based on model confidence and EWC, fuses source code and vulnerability description, and can better mine vulnerability information while reducing forgetting of old task data compared to baseline, and is a more advanced method. Among them, for F1 score, the method of the present application is compared with the highest performance CWM XGB8% higher performance; for MCC, the method of the present application is 12% higher than the best Fun LGBM 12% higher performance. These results show the competitiveness of the method of the present application.

[0083] Example 2

[0084] On the basis of Example 1, the method of the present application and the methods using different regularization methods are compared using different regularization methods, and two performance indicators from the field of software vulnerability evaluation research (F1 source and MCC) are used to automatically evaluate the quality of the model:

[0085] Table 2 Comparison table of results of the method of the present application and the rest of the methods

[0086]

[0087] Experiments show that the software vulnerability evaluation method based on continuous learning proposed in the present application has the highest F1 score and MCC compared to using other regularization methods, and thus can make more reliable and accurate software vulnerability severity predictions. For F1 score, the method of the present application is 15% and 9% higher than the models using Rwalk and SI as regularization methods, respectively; for MCC, the method of the present application is 19% and 12% higher than the models using Rwalk and SI as regularization methods, respectively. These results show the competitiveness of the method of the present application.

[0088] Example 3

[0089] On the basis of Example 1, the method of the present application and the method using random replay as replay are compared using different replay methods, and two performance indicators from the field of software vulnerability evaluation research (F1 source and MCC) are used to automatically evaluate the quality of the model:

[0090] Table 3 Comparison table of results of the method of the present application and the rest of the methods

[0091]

[0092] Experiments show that the software vulnerability evaluation method based on continuous learning proposed in the present application has the highest F1 score and MCC compared to using random replay as replay, and thus can make more reliable and accurate software vulnerability severity predictions. For F1 score, the method of the present application is 4% higher than the method using random replay as replay; for MCC, the method of the present application is 10% higher than the method using random replay as replay. These results show the competitiveness of the method of the present application.

[0093] Example 4

[0094] On the basis of Example 1, the weight parameter λ of the EWC of the application is changed, the method of the application and the method using different λ are compared, and two performance indicators (namely F1 source and MCC) from the field of software vulnerability evaluation research are used to automatically evaluate the quality of the model:

[0095] Table 4 Comparison table of results of the method of the application and the remaining methods

[0096]

[0097] Experiments show that the software vulnerability evaluation method based on continuous learning proposed in the application has the highest F1 score and MCC compared to the method using other λ as parameters, and thus can make more reliable and accurate software vulnerability severity prediction. For F1 score, the method of the application is at most 9% higher than the method using other λ as parameters; for MCC, the method of the application is at most 14% higher than the method using other λ as parameters. These results show the competitiveness of the method proposed in the application.

[0098] Example 5

[0099] On the basis of Example 1, the replay size rs based on model confidence of the application is changed, the method of the application and the method using different rs are compared, and two performance indicators (namely F1 source and MCC) from the field of software vulnerability evaluation research are used to automatically evaluate the quality of the model:

[0100] Table 5 Comparison table of results of the method of the application and the remaining methods

[0101]

[0102]

[0103] Experiments show that the software vulnerability evaluation method based on continuous learning proposed in the application has the highest F1 score and MCC compared to the method using other rs as parameters, and thus can make more reliable and accurate software vulnerability severity prediction. For F1 score, the method of the application is at most 3% higher than the method using other rs as parameters; for MCC, the method of the application is at most 5% higher than the method using other rs as parameters. These results show the competitiveness of the method proposed in the application.

[0104] The above only describes the preferred embodiments of the application and is not intended to limit the application. Any modification, equivalent replacement, improvement, etc. made within the spirit and principles of the application shall be included in the protection scope of the application.

Claims

1. A method for software vulnerability assessment based on continuous learning, characterized in that, Comprising the following steps: (1) Mining CVE vulnerability database and actual software development project through Git-based software project hosting platform, collecting vulnerability-related data including CVE ID, vulnerability code, vulnerability description, vulnerability severity, preprocessing these data, constructing dataset D, first obtaining CVE ID, vulnerability code, vulnerability severity, vulnerability description in CVE, then extracting all code changes related to the vulnerability in open source projects based on Git website, and extracting the source code before modification, preprocessing the source code including removing comments, blank lines, and line comments, and finally forming vulnerability dataset D; (2) Dividing the dataset, first dividing the vulnerability dataset D according to the task in the simulated continuous learning scenario, then dividing the dataset of each task into training set, validation set and test set according to the ratio of 8:1:1, and the division process needs to use stratified sampling method to ensure that the vulnerability severity distribution in different sets remains consistent; (3) For the current task, using the model confidence-based playback method to playback the dataset of the old task, before each model training, we select the data in the old task according to the model confidence to playback and combine the playback data with the current task data, and then divide them into training set, validation set and test set according to the ratio of 8:1:1, and the division process needs to use stratified sampling method to ensure that the vulnerability severity distribution in the two sets remains consistent; (4) For the dataset processed in step (3), extract the source code and vulnerability description, first construct the prompt template, distinguish the source code and vulnerability description through hard prompt, for severity classification, use [SOFT] label to create soft prompt, and use [MASK] label to predict or fill in the missing information, then construct the mapping method, which maps the natural language output of the model to the specific category; Finally, input the constructed double-modal information into the pre-trained language model CodeT5, and use prompt fine-tuning to train the model and mixed prompt template; (5) During the training of the model, for the new task, the parameter weight of the model is limited to the position close to the optimal parameter of the previous task, to ensure that the learning process of the new task does not significantly change the parameters critical to the old task, thereby alleviating catastrophic forgetting; (6) Early stopping strategy is adopted in the model training process, the F1 index value change of the model on the validation set is calculated, if the validation set index decreases for 10 consecutive times, the training is stopped to prevent overfitting problem, and the optimal software vulnerability severity prediction model M and the corresponding mixed prompt template P are returned; (7) For the software vulnerability to be evaluated, extract the source code and vulnerability description of the vulnerability, fuse with the trained mixed prompt template P, and finally input into the software vulnerability severity prediction model M constructed above to complete the severity prediction of the target software vulnerability.

2. The method of claim 1, wherein, In step (3), the following steps are specifically included: (2-1) Consider all data sets of each task before the current task and combine them as D train and train the model f; (2-2) Calculate the training set D train The confidence of each sample x i The confidence of each sample x i The confidence of each sample x comes from the prediction probability of the model, and the maximum probability is taken as the confidence. The confidence formula is designed as follows: where K is the number of classes, is the logit of class j, is x i the logit of the predicted class, is the exponential sum of all class logits, used for normalization; (2-3) Sort the samples in D train in ascending order of confidence scores to get sorted samples Then, select the N samples with the lowest confidence from the training set for replay, denoted as D replay Finally, combine the training set of the current task with the selected low-confidence samples as follows: 3.The method of claim 1, wherein, In step (4), the following steps are specifically included: (3-1) Constructing the prompt template: distinguish the source code and the vulnerability description using hard prompts, add "The codesnippet:" and "The vulnerability description:" respectively, for severity classification, use [SOFT] tags to create soft prompts, initialize them as "Classify the severity:" during training, and predict or fill in missing information with [MASK] tags; (3-2) Constructing the mapping method: map the natural language output of the model to specific categories, if the output is "low" or "slight", map it to LOW; if it is "medium" or "moderate", map it to MEDIUM; if it is "high" or "severe", map it to HIGH; if it is "critical" or "significant", map it to CRITICAL; (3-3) Input the dual-modal information into the pre-trained model CodeT5, and perform prompt fine-tuning and mixed prompt template training.

4. The method of claim 1, wherein, The step (5) specifically comprises the following steps: (4-1) Use the traditional stochastic gradient descent (SGD) method to train the neural network model, train the initial task model, and randomly shuffle the data during training and process it in small batches. After completing the training of the initial task, save the trained model parameters; (4-2) Calculate the Fisher information matrix to quantify the importance of each parameter to the initial task. Use the training data A to calculate the Fisher information matrix item for each parameter. The Fisher information matrix item I(θ) is calculated by the loss function for each parameter θ. The gradient is obtained by taking the expected value of the squares of these gradients, and the formula is: Approximate the average of the squared gradients of the training data by calculating: wherein is a log-likelihood loss function; (4-3) After calculating the Fisher information matrix and the importance weight of each parameter, save them. When training a new task, use a loss function with a regularization term to ensure that the model parameters do not deviate too much from the parameters of the initial task. EWC prevents catastrophic forgetting by adding a penalty term to the loss function. This regularization term is weighted according to the Fisher information matrix. The formula of the loss function is defined as follows: where L B (θ) is the loss function of the current task, λ is a hyperparameter for balancing the importance of the new task and the old task, F i is the Fisher information matrix of the i-th parameter, θ i is the i-th parameter of the current task, is the i-th parameter trained in the initial task. This formula adds a penalty term during the training of the new task to prevent the model parameters from deviating from the optimal parameters learned in the last task.

5. The method of claim 1, wherein, The step (6) specifically comprises the following steps: (5-1) Calculate the F1 index change of the model on the validation set; (5-2) When the F1 value does not exceed the current best performance for 10 consecutive rounds, stop training and return the best vulnerability severity prediction model and mixed prompt template.

6. The method of claim 1, wherein, The step (7) specifically comprises the following steps: (6-1) Extract the source code and vulnerability description of the vulnerability to be evaluated, and fuse them with the trained mixed prompt template P; (6-2) Input the fused data into the trained prediction model M to generate natural language output; (6-3) Map the natural language output of the model to the specific severity level and return the final prediction result.

Images