Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion

Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion

CVEs are Common Vulnerabilities and Exposures records, and LLM means large language model. This 2026 research by Cédric Bonhomme and Alexandre Dulaunoy is available through arXiv at Cornell University. They built a reproducible pipeline that reads vulnerability descriptions, maps them to multiple Enterprise ATT&CK techniques, and tests whether generated labels can usefully enlarge a small expert-labeled training set. Mapping these concepts could help defenders move from vulnerability feeds to detection coverage, prioritisation, and risk assessment. By the end, you should understand what improved and why apparently positive label-expansion results disappeared under stricter evaluation.

CVE, which stands for Common Vulnerabilities and Exposures, describes what is broken in software; ATT&CK captures how an adversary behaves around that flaw. ATT&CK tactics express why an action is taken, while techniques express how, and a vulnerability can map to several techniques across exploitation and impact. That makes this a multi-label problem, not a one-answer lookup. The mapping is also partly subjective, and ATT&CK changes as techniques are added, deprecated, or replaced. Supervised classification faces label scarcity, and systems that consume ATT&CK identifiers over time need to normalize them to a single reference version.

The research asks whether a supervised classifier trained on expert mappings beats a training-free semantic-similarity baseline, and whether a large language model can label extra CVEs accurately enough to improve that classifier. This is useful because manual mapping does not scale, but extra labels help only if their errors do not outweigh their added coverage. The goal is to separate model performance from label quality and evaluation noise.

Bonhomme and Dulaunoy assembled 1,207 expert-mapped CVEs. The labels came from MITRE’s Center for Threat-Informed Defense, known as CTID, and MITRE analysts had assigned them manually. First came label preparation. Because the mappings used different ATT&CK releases, the researchers replaced retired identifiers with their explicit successors. They combined exploitation, primary-impact, and secondary-impact labels into a single training target, while keeping labels derived through an indirect chain out of training. Next came model comparison. They compared a trained multi-label text classifier with a training-free semantic-similarity baseline, checked the large language model’s mappings against expert labels, and tested retraining after adding its generated mappings. Finally, a corrected evaluation used dedicated validation data to select the saved model version, leaving the test results for the final comparison.

The expert-trained classifier roughly doubled recall within the first 5 suggestions compared with the no-training similarity baseline, and every evaluated ranking metric improved. The label-expansion result was different: generated labels agreed with experts at about 0.39, but adding them produced no reliable gain at any tested expansion size. At the largest tested expansion, coverage of rare techniques measurably worsened. Adding more curated expert rows, by contrast, improved every metric as the gold set grew.

An initial run with one chosen set of random starting settings made expansion look harmful; averaging several runs with different starting settings made it look beneficial. Repeating the experiment with an independent sample and testing several expansion sizes erased that apparent gain, and a final rerun under the corrected evaluation confirmed no improvement. The researchers traced the reversals to choosing the saved model version that scored best on a small test split. That made each reported score the highest of many noisy evaluations, and repeated runs using the same starting settings could still differ by 0.05 in recall within the first 5 suggestions. Using separate validation data to choose the saved model version made the conclusion stable.

Dataset bias is one concern. The expert set is small and over-represents vulnerabilities exploited in the wild, producing a skew toward remote exploitation of servers. Mapping uncertainty is another. CVE prose describes a flaw while ATT&CK labels describe attacker behavior, so even experts can disagree. Rewriting identifiers handles explicit replacements, but not later splits, merges, or changes in guidance. Finally, evaluation limits remain. Adding generated rows expands the label vocabulary, so the comparison asks whether expansion produces a better model in practice, not whether it wins with an identical label space. The text encoder also began with general English and may underweight security-specific wording.

For vulnerability and detection teams, the evidence supports using this model as a ranking assistant, not an authority. It can run locally on a CPU when modest latency is acceptable or on a small GPU for greater throughput, without sending sensitive vulnerability text to an external service. A public deployment marks its suggestions as unverified AI-generated guidance. Human review should come before a mapping enters an authoritative record or influences detection coverage and prioritisation. Teams extending the dataset should keep each reviewed label traceable by preserving its rationale and provenance, along with the ATT&CK version and original identifier. They should give extra attention to rare techniques and under-represented vulnerability classes.

Adding large-language-model labels did not help at the tested agreement level. In this setting, label quality limited improvement more than the number of training rows. Bonhomme and Dulaunoy also provide a reproducible mapping pipeline and release a corrected training protocol. Incident responders, vulnerability analysts, detection engineers, and open-data maintainers should favor reviewed mappings with preserved evidence and provenance over unreviewed large-language-model expansion at the tested agreement level. They should not conclude that all automated labeling is ineffective or assume these results carry unchanged to newer, less exploitation-biased CVEs; higher-quality labels and broader evaluation remain open directions.