# DeepCVA: Automated Commit-level Vulnerability Assessment with Deep Multi-task Learning

arXiv: https://arxiv.org/abs/2108.08041 · HTML: https://mlsanity.com/paper/2108.08041/

## Key facts

- Cited by 11 papers in the map (data through 7 Oct 2026).
- Builds on 31 of its 89 references that are in the map.
- First posted on arXiv 18 Aug 2021.

## Builds on (most cited first, 30 of 31)

- [BERT: Pre-training of Deep Bidirectional Transformers for Language Understanding](https://mlsanity.com/paper/1810.04805/) (2018)
- [Adam: A Method for Stochastic Optimization](https://mlsanity.com/paper/1412.6980/) (2014)
- [Batch Normalization: Accelerating Deep Network Training by Reducing Internal Covariate Shift](https://mlsanity.com/paper/1502.03167/) (2015)
- [XGBoost: A Scalable Tree Boosting System](https://mlsanity.com/paper/1603.02754/) (2016)
- [Neural Machine Translation by Jointly Learning to Align and Translate](https://mlsanity.com/paper/1409.0473/) (2014)
- [Distributed Representations of Words and Phrases and their Compositionality](https://mlsanity.com/paper/1310.4546/) (2013)
- [Enriching Word Vectors with Subword Information](https://mlsanity.com/paper/1607.04606/) (2016)
- [Convolutional Neural Networks for Sentence Classification](https://mlsanity.com/paper/1408.5882/) (2014)
- [An overview of gradient descent optimization algorithms](https://mlsanity.com/paper/1609.04747/) (2016)
- [A Survey on Multi-Task Learning](https://mlsanity.com/paper/1707.08114/) (2017)
- [code2vec: Learning Distributed Representations of Code](https://mlsanity.com/paper/1803.09473/) (2018)
- [Model Evaluation, Model Selection, and Algorithm Selection in Machine Learning](https://mlsanity.com/paper/1811.12808/) (2018)
- [DeepBugs: A Learning Approach to Name-based Bug Detection](https://mlsanity.com/paper/1805.11683/) (2018)
- [Deep Learning for Source Code Modeling and Generation: Models, Applications and Challenges](https://mlsanity.com/paper/2002.05442/) (2020)
- [Baseline Needs More Love: On Simple Word-Embedding-Based Models and Associated Pooling Mechanisms](https://mlsanity.com/paper/1805.09843/) (2018)
- [CC2Vec: Distributed Representations of Code Changes](https://mlsanity.com/paper/2003.05620/) (2020)
- [The Impact of Class Rebalancing Techniques on the Performance and Interpretation of Defect Prediction Models](https://mlsanity.com/paper/1801.10269/) (2018)
- [A Manually-Curated Dataset of Fixes to Vulnerabilities of Open-Source Software](https://mlsanity.com/paper/1902.02595/) (2019)
- [Evaluating Representation Learning of Code Changes for Predicting Patch Correctness in Program Repair](https://mlsanity.com/paper/2008.02944/) (2020)
- [A Survey on Data-driven Software Vulnerability Assessment and Prioritization](https://mlsanity.com/paper/2107.08364/) (2021)
- [Automated Software Vulnerability Assessment with Concept Drift](https://mlsanity.com/paper/2103.11316/) (2021)
- [Predicting Defective Lines Using a Model-Agnostic Technique](https://mlsanity.com/paper/2009.03612/) (2020)
- [A Practical Approach to the Automatic Classification of Security-Relevant Commits](https://mlsanity.com/paper/1807.02458/) (2018)
- [A Large-scale Study of Security Vulnerability Support on Developer Q&A Websites](https://mlsanity.com/paper/2008.04176/) (2020)
- [PUMiner: Mining Security Posts from Developer Question and Answer Websites with PU Learning](https://mlsanity.com/paper/2003.03741/) (2020)
- [Auto-completing Bug Reports for Android Applications](https://mlsanity.com/paper/1705.04016/) (2017)
- [9.6 Million Links in Source Code Comments: Purpose, Evolution, and Decay](https://mlsanity.com/paper/1901.07440/) (2019)
- [Learning to Catch Security Patches](https://mlsanity.com/paper/2001.09148/) (2020)
- [PatchNet: Hierarchical Deep Learning-Based Stable Patch Identification for the Linux Kernel](https://mlsanity.com/paper/1911.03576/) (2019)
- [Predicting Exploitation of Disclosed Software Vulnerabilities Using Open-source Data](https://mlsanity.com/paper/1707.08015/) (2017)

## Built on by (most cited first, 11 of 11)

- [VulCurator: A Vulnerability-Fixing Commit Detector](https://mlsanity.com/paper/2209.03260/) (2022)
- [LLMSecConfig: An LLM-Based Approach for Fixing Software Container Misconfigurations](https://mlsanity.com/paper/2502.02009/) (2025)
- [Automated Security Assessment for the Internet of Things](https://mlsanity.com/paper/2109.04029/) (2021)
- [EvalSVA: Multi-Agent Evaluators for Next-Gen Software Vulnerability Assessment](https://mlsanity.com/paper/2501.14737/) (2024)
- [On the Use of Fine-grained Vulnerable Code Statements for Software Vulnerability Assessment Models](https://mlsanity.com/paper/2203.08417/) (2022)
- [Multi-Granularity Detector for Vulnerability Fixes](https://mlsanity.com/paper/2305.13884/) (2023)
- [A Survey of Source Code Representations for Machine Learning-Based Cybersecurity Tasks](https://mlsanity.com/paper/2403.10646/) (2024)
- [CCRep: Learning Code Change Representations via Pre-Trained Code Model and Query Back](https://mlsanity.com/paper/2302.03924/) (2023)
- [Detecting Security Patches via Behavioral Data in Code Repositories](https://mlsanity.com/paper/2302.02112/) (2023)
- [Today's Cat Is Tomorrow's Dog: Accounting for Time-Based Changes in the Labels of ML Vulnerability Detection Approaches](https://mlsanity.com/paper/2506.11939/) (2025)
- [Resource-Efficient Automatic Software Vulnerability Assessment via Knowledge Distillation and Particle Swarm Optimization](https://mlsanity.com/paper/2508.02840/) (2025)

## Abstract (arXiv)

It is increasingly suggested to identify Software Vulnerabilities (SVs) in code commits to give early warnings about potential security risks. However, there is a lack of effort to assess vulnerability-contributing commits right after they are detected to provide timely information about the exploitability, impact and severity of SVs. Such information is important to plan and prioritize the mitigation for the identified SVs. We propose a novel Deep multi-task learning model, DeepCVA, to automate seven Commit-level Vulnerability Assessment tasks simultaneously based on Common Vulnerability Scoring System (CVSS) metrics. We conduct large-scale experiments on 1,229 vulnerability-contributing commits containing 542 different SVs in 246 real-world software projects to evaluate the effectiveness and efficiency of our model. We show that DeepCVA is the best-performing model with 38% to 59.8% higher Matthews Correlation Coefficient than many supervised and unsupervised baseline models. DeepCVA also requires 6.3 times less training and validation time than seven cumulative assessment models, leading to significantly less model maintenance cost as well. Overall, DeepCVA presents the first effective and efficient solution to automatically assess SVs early in software systems.