Mapping CVEs to Mitre ATT&CK Techniques (arxiv.org)

A recent study has introduced a novel pipeline for mapping Common Vulnerabilities and Exposures (CVEs) to MITRE ATT&CK Enterprise techniques, enhancing how cybersecurity vulnerabilities are classified. By training a multi-label classifier on a curated dataset of 1,207 CVEs, the study achieved significant improvements in recall metrics, nearly doubling performance compared to traditional methods reliant on the CWE->CAPEC->ATT&CK derivation chain. This advancement is crucial for the AI/ML community as it signals a more effective way to address vulnerability assessment and management, which could lead to better protection mechanisms against cyber threats. However, the research also scrutinizes the application of LLM-assisted labeling for expanding the dataset, revealing mixed results. Although some initial experiments hinted at potential benefits, further analysis indicated that LLM-generated labels did not actually enhance the classifier's performance and, in some cases, reduced the coverage of rare techniques. This underscores a fundamental limitation: the quality of labels is more critical than sheer dataset size. The study emphasizes that expert-curated data remains the most reliable avenue for improving classifier performance, and all relevant resources, including datasets and training logs, have been made publicly accessible to support further research in this area.