Mapping CVEs to MITRE ATT&CK Techniques

LaTeX source, figures, and figure/table-generation scripts for the paper:

Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion Cédric Bonhomme and Alexandre Dulaunoy, Computer Incident Response Center Luxembourg (CIRCL)

Preprint: arXiv:2607.25572 [cs.CR]

Summary

We present a reproducible pipeline for mapping CVEs to MITRE ATT&CK (Enterprise) techniques from free-text vulnerability descriptions. Rather than rely on the CWE → CAPEC → ATT&CK derivation chain — whose table-expansion artifacts we quantify — we train a multi-label classifier on a curated gold set of 1,207 CVEs assembled from expert MITRE CTID mappings; it roughly doubles the recall@5 of a zero-shot embedding-similarity baseline. We then ask whether LLM-assisted labeling can extend the gold set, and reach the answer only after three successively more rigorous experiments, each of which overturned the last: LLM labels at ≈0.39 agreement with the experts produce no reliable improvement at any size (100–984 added CVEs) and at ~1,000 added CVEs measurably degrade rare-technique coverage. The mechanism is evaluation noise from best-checkpoint selection on a small test split — enough for identical fixed-seed runs to differ by 0.05 in recall@5, and for a five-seed comparison to pass its own consistency criterion and still be wrong. Under a corrected protocol (validation-split checkpoint selection, released as the default) the gold-only results hold and the null expansion verdict is confirmed. A gold-size scaling curve shows every metric improves monotonically with more curated rows: the classifier is label-quality bound, not data bound.

Artifacts

All datasets, models, and code are released:

The full methodology write-up lives in the VulnTrain documentation: docs/attack-techniques-dataset.md. The trainer logs behind every table are included in this repository under trainer-logs/.

Repository contents

Building the PDF

pdflatex main.tex
bibtex main
pdflatex main.tex
pdflatex main.tex

Citation

@misc{bonhomme2026mappingcvesmitreattck,
      title={Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion},
      author={Cédric Bonhomme and Alexandre Dulaunoy},
      year={2026},
      eprint={2607.25572},
      archivePrefix={arXiv},
      primaryClass={cs.CR},
      url={https://arxiv.org/abs/2607.25572},
}

Acknowledgements

This work was carried out in the context of the AIPITCH project (AI-Powered Innovative Toolkit for Cybersecurity Hubs), co-funded by the European Union. See the paper's Acknowledgements section for the full statement.

License

The paper text and figures are licensed under CC BY-SA 4.0 (see LICENSE). The Python scripts in this repository are licensed under the GPLv3, like VulnTrain itself.