Abstract
We present a reproducible pipeline for mapping Common Vulnerabilities and Exposures (CVEs) to MITRE ATT&CK (Enterprise) techniques from free-text vulnerability descriptions. Rather than rely on the CWECAPECATT&CK derivation chain — whose table-expansion artifacts we quantify — we train a multi-label classifier on a curated gold set of CVEs assembled from expert MITRE Center for Threat-Informed Defense (CTID) mappings; it roughly doubles the recall@5 of a zero-shot embedding-similarity baseline and improves every ranking metric. We then ask whether LLM-assisted labeling can extend the gold set, and reach the answer only after three successively more rigorous experiments, each of which overturned the last. A single-run comparison says expansion degrades the classifier; averaged over five random seeds the effect appears to reverse into a small, consistent ranking gain; but an independent replication and an expansion-size scaling sweep (– added CVEs, five seeds per size) show the apparent gain was an evaluation artifact: LLM labels at 0.39 agreement with the experts produce no reliable improvement at any size, and at 1,000 added CVEs they measurably degrade rare-technique coverage (macro-F1 ). The mechanism is evaluation noise, not the labels alone: selecting the best training checkpoint on a small test split turns every reported metric into a maximum over dozens of noisy evaluations — enough for identical fixed-seed runs to differ by in recall@5, and for a five-seed comparison to pass its own consistency criterion and still be wrong. Under a corrected protocol (validation-split checkpoint selection, released as the default) the gold-only results hold (recall@5 ) and a re-run of the decisive contrast confirms the null expansion verdict. A gold-size scaling curve completes the picture: every metric improves monotonically with more curated rows while LLM-labeled rows add nothing — the classifier is label-quality bound, not data bound. All datasets, models, code, and the complete trainer logs behind every table are released.
Pre-preprint notice. This manuscript accompanies a talk and paper submitted for consideration at hack.lu 2026 (October 2026).
1 Introduction
A Common Vulnerabilities and Exposures (CVE) record [22] describes what is broken in a piece of software. Defenders, however, must reason about how such a flaw would be used by an adversary: which techniques it enables, and what impact its exploitation would have. The MITRE ATT&CK knowledge base [20] is the community’s shared vocabulary for that behavioral layer, and connecting a CVE to the ATT&CK techniques it enables lets a defender pivot directly from a vulnerability feed to detection coverage, threat-informed prioritisation, and risk assessment. Today that connection is made largely by hand, and with hundreds of thousands of published CVEs it cannot be made manually at scale.
The mapping is also genuinely difficult to automate. A single CVE legitimately implies several techniques, so the task is multi-label; the distribution of techniques over CVEs is long-tailed; and the mapping is partly subjective, because a CVE characterises a flaw while a technique characterises attacker behavior around it, so even expert analysts disagree. A tempting shortcut is to derive techniques deterministically through the existing cross-framework links — CWE [23] to CAPEC [21] to ATT&CK — but, as we quantify in section 3.3, that chain is dominated by table-expansion artifacts and is unsuitable as a training target.
We take a supervised approach anchored in trustworthy labels. We assemble a small gold set of CVE-to-ATT&CK mappings from the expert curation of the MITRE Center for Threat-Informed Defense (CTID) [4, 6], train a multi-label classifier on it, and benchmark that classifier against a training-free semantic-similarity baseline in the style of prior work [1]. We then confront the gold set’s chief weakness — its size — by asking whether a capable large language model (LLM) can label additional CVEs well enough to extend it, under a strict validate-before-trust protocol that first measures the LLM’s agreement with the gold analysts.
- 1.
A published, provenance-tiered CVEATT&CK dataset that keeps expert gold labels strictly separate from weak automatically derived labels, so the two are never conflated in training.
- 2.
A supervised multi-label classifier that roughly doubles the recall@5 of a zero-shot similarity baseline and improves every ranking metric, evaluated under an honest, analyst-oriented protocol.
- 3.
A quantified analysis of the noise in the CWECAPECATT&CK derivation chain, explaining why its labels cannot be trained on.
- 4.
A multi-seed, multi-size LLM label-expansion experiment showing that labels at 0.39 agreement provide no reliable gain at any expansion size tested (– CVEs) and degrade rare-technique coverage at the largest size — together with a methodological post-mortem: a single-seed run and a five-seed comparison each produced a different, wrong verdict, because best-checkpoint selection on a small test split amplifies run-to-run noise beyond the effect size. We identify the mechanism and release a corrected training protocol.
All code (the VulnTrain toolkit), datasets, and models are released openly under the CIRCL organisation so that every result — including every stage of the three-verdict expansion experiment — can be reproduced. Figure 1 gives an overview of the full pipeline.
2 Background and Related Work
2.1 MITRE ATT&CK
ATT&CK [20] organises adversary behavior into tactics (the why of an action) and techniques (the how), with many techniques further refined into sub-techniques. It is a living knowledge base: techniques are periodically added, deprecated, or revoked and replaced across versions. Any system that consumes ATT&CK identifiers over time must therefore normalise them to a single reference version, which we do using the revoked-by relationships published in the ATT&CK STIX data [24]. We target the Enterprise domain, whose version 19.1 catalogue contains active techniques and sub-techniques.
2.2 The CTID “Mapping ATT&CK to CVE for Impact” methodology
Our labels follow the methodology defined by the MITRE Center for Threat-Informed Defense [4], which decomposes a CVE-to- ATT&CK mapping into three slots: the exploitation technique used to trigger the vulnerability, the primary impact that directly results, and any secondary impact the primary one enables. We draw gold labels from two CTID artifacts following this scheme: the 2021 attack_to_cve mapping and the Known-Exploited-Vulnerabilities mappings distributed through the CTID Mappings Explorer [6], the latter keyed to the CISA KEV catalogue [12]. Together they form the gold set of section 3.
2.3 Automated CVE-to-ATT&CK mapping
Prior automated approaches fall into two broad families. The first derives techniques through the deterministic cross-framework chain CWECAPECATT&CK. CVE2CAPEC [14] is a widely used open implementation with near-complete coverage, and BRON [16] links the same threat and weakness catalogues into a graph; both inherit the noise of the underlying mapping tables, which we measure directly in section 3.3. The second family learns the mapping from text. SMET [1] deliberately avoids supervised classification because of label scarcity, instead ranking techniques by semantic similarity between a CVE description and ATT&CK technique descriptions; this is precisely the zero-shot baseline we adopt in section 5. Closest to our supervised setting, CVE2ATT&CK [15] fine-tunes a BERT model on a few thousand CVEs over a restricted technique set. We differ in three ways: we insist on expert CTID labels rather than derived ones, we adopt a multi-label ranking evaluation aimed at analyst review rather than single-label accuracy, and we report an explicit study of whether LLM-generated labels can extend the gold set. A related CTID tool, TRAM [5], maps prose threat reports to ATT&CK, a different input distribution from terse CVE descriptions.
2.4 LLMs as annotators
Using an LLM to produce training labels in place of human annotators is increasingly common, and structured-output decoding makes it practical to extract schema-conformant technique assignments directly. The open question — which our expansion experiment (section 6) addresses head-on for this task — is whether labels produced this cheaply are accurate enough to improve a supervised model, or whether their noise outweighs the extra coverage they provide.
3 Dataset Construction
The quality of the labels sets a hard ceiling on any supervised model, so the central design decision of this work is where the training targets come from. Two candidate sources exist: expert-curated mappings from the MITRE Center for Threat-Informed Defense (CTID), and automatically derived mappings from the CWE CAPEC ATT&CK cross-framework chain. We evaluated both and, on the evidence below, train exclusively on the former while retaining the latter as a clearly separated weak signal.
3.1 Gold set from CTID mappings
The gold set is assembled from two CTID sources that follow the “Mapping ATT&CK to CVE for Impact” methodology, in which each CVE is annotated with up to three slots: the exploitation technique an adversary would use to trigger the flaw, the primary impact that immediately follows, and any secondary impact that the primary one enables. The first source is the 2021 attack_to_cve mapping (840 CVEs); the second is the Mappings Explorer Known-Exploited-Vulnerabilities (KEV) set (420 CVEs). We fetch and join both, attach the corresponding CVE descriptions from the CIRCL vulnerability-scores service, and reconcile them onto a single schema.
We stress that these labels are human ground truth: both sources were mapped manually by MITRE analysts applying the CTID methodology, not produced by any automated tool. We do not annotate any CVE ourselves — our contribution at this stage is purely to fetch, normalise, merge, and split existing expert mappings. This is precisely why we trust the gold set as a training target and treat it as the reference against which every other label source (the automatically derived labels of section 3.3 and the LLM labels of section 6) is measured.
Because the two sources were authored against different ATT&CK releases, the same technique can appear under different identifiers across them (for example T1562, revoked and replaced in a later version, versus its successor). Left unnormalised, one behavioral concept would split into two distinct labels: the classifier would see its training examples divided across both, inflating and fragmenting the label vocabulary, and at evaluation a prediction of the new identifier against a gold label carrying the old one would be scored as wrong despite being correct. We therefore rewrite every identifier to a single reference version by following the revoked-by relationships in the ATT&CK STIX data. The per-slot labels are then unioned into a flat techniques field, which is the multi-label target the classifier consumes. The final gold set contains CVEs, partitioned into fixed train ( CVEs) and test ( CVEs) splits that are reused unchanged throughout the paper; it is published, with a DOI, as CIRCL/vulnerability-attack-techniques [9].
3.2 Provenance tiers
Every row records the origin of its labels in a label_sources field and keeps the weak derived labels, when present, in a separate techniques_derived column. This separation is a deliberate contract: the derived column is never used as a training target and never mixed into the gold techniques field. Keeping it available nonetheless lets downstream consumers filter cleanly back to gold-only data, and lets us study where the deterministic chain diverges from analyst judgment — which is exactly the analysis of the next subsection.
3.3 Quantifying CVE2CAPEC derivation noise
The derived labels come from CVE2CAPEC [14], a daily updated database that chains each CVE to techniques through the official CWE CAPEC ATT&CK cross-framework mappings. It is an impressive piece of automation with near-complete coverage, and it is the source most readily reached for when one needs CVE-to-ATT&CK labels at scale. We therefore examined directly whether its output is usable as a training target, measuring on its CVE-2024 database file of CVEs.
Coverage is indeed excellent: of CVEs receive at least one technique. The problem is not coverage but fan-out, visualised in fig. 2. The median labeled CVE is assigned techniques, the mean , and CVEs ( of all CVEs) receive twenty or more (fig. 2a). More tellingly, the marginal frequency of individual techniques bears no relation to how vulnerabilities are actually exploited (fig. 2b). The single most common technique across the database is T1574.007 (Path Interception by PATH Environment Variable), attached to of all labeled CVEs, followed by T1574.006 and T1562.003 at roughly the same level and a cluster of T1134 (Access Token Manipulation) sub-techniques near –. No plausible reading of the vulnerability landscape has path-interception implicated in a majority of all disclosed CVEs; these frequencies are artifacts of table expansion, in which a single generic CWE fans out into dozens of CAPECs and, transitively, dozens of techniques, regardless of the specific CVE. The highlighted bars in fig. 2b are exactly this handful of expansion artifacts, which between them are stamped onto roughly half the corpus.
A concrete example makes the failure mode tangible. CVE-2024-21732, a cross-site-scripting vulnerability (CWE-79), is mapped through CAPECs to techniques including T1027 (Obfuscated Files or Information) and T1574.006/.007 (Hijack Execution Flow) — none of which has any relationship to cross-site scripting or drive-by exploitation. The label set is determined by the weakness class the CVE happens to be filed under, not by the described behavior of the individual vulnerability.
The conclusion is that training on these labels would teach a model the structure of the mapping tables rather than adversary behavior, and would in particular inject a handful of spurious techniques onto the majority of examples. We therefore exclude the derived labels from training entirely. They remain useful in three narrower roles, all of which the retained techniques_derived column supports: as a candidate prior at inference time (restricting suggestions to techniques compatible with the CWE chain), as a baseline that any trained model must beat, and as a comparison column for studying chain-versus-analyst divergence. We note that other CVE-to-ATT&CK resources built on the same chain, such as BRON, inherit the same noise profile and are unsuitable as targets for the same reason.
4 Supervised Classifier
Assigning ATT&CK techniques to a CVE is intrinsically a multi-label problem: a single vulnerability legitimately implies several techniques across the exploitation and impact slots. We therefore fine-tune a transformer encoder with a sigmoid classification head and a binary cross-entropy objective (BCEWithLogitsLoss), in which each technique is an independent 0/1 decision, rather than the softmax cross-entropy of a single-label classifier. The model input is the concatenation of the CVE title and description; the target is the gold techniques field of section 3, and the derived labels are ignored entirely.
Why a compact classifier?
A central motivation for training a dedicated encoder is operational efficiency, not only predictive quality. Once fine-tuned, the classifier assigns all technique scores in a single forward pass; it does not need to run a large autoregressive model or generate and parse a textual answer for every incoming CVE. This makes low-latency batch enrichment possible while reducing repeated computation and its associated energy use. It also makes local deployment practical on constrained infrastructure: the released model can run on a CPU when latency requirements are modest, or on a small GPU for higher throughput, without sending embargoed or otherwise sensitive vulnerability text to an external service. The goal is therefore a model that national CSIRTs, small security teams, and open-data publishers can operate continuously, rather than a capability available only to organisations with large accelerators. We record training energy with CodeCarbon, but a controlled comparison of inference latency and energy across CPU, small-GPU, and generative-LLM deployments remains future work; the present claim is deployability, not a measured energy-saving ratio.
Two design choices address the long-tailed label distribution. First, because the gold set is small and heavily imbalanced across techniques, the loss uses per-label positive weights: a technique’s positive term is up-weighted in inverse proportion to its frequency (clipped to a maximum ratio so that the rarest labels cannot dominate the gradient). Second, the label space is regularised structurally. Sub-techniques are collapsed to their parent technique at training time — there is rarely enough evidence in a terse CVE description, or enough gold examples, to justify a sub-technique distinction — and the vocabulary is further restricted to techniques attested by at least a minimum number of training examples (five by default). On the gold set this yields a working vocabulary of parent techniques.
We fine-tune roberta-base [17] for epochs with the AdamW optimiser, a learning rate of on a linear schedule, and a fixed random seed of ; the checkpoint that maximises macro-F1 on an evaluation split is retained — which split that should be turns out to matter greatly, and is analysed and corrected in section 6. Training is orchestrated with the Hugging Face Trainer and instrumented with CodeCarbon [7] so that the energy cost of each run is recorded alongside its metrics (we analyse GPU efficiency on this training infrastructure separately [3]). The framework accepts several base encoders; we report roberta-base as the primary configuration — an encoder choice that follows our earlier VLAI model, a roberta-base fine-tune for automated vulnerability severity classification built with the same VulnTrain tooling [2].
5 Evaluation Protocol and Baselines
Metrics.
We evaluate the model as what it is intended to be — a tool that suggests candidate techniques for an analyst to confirm — so ranking quality matters more than a single hard threshold. We report recall@ for , the fraction of a CVE’s gold techniques that appear in the model’s top- ranked suggestions, together with the mean reciprocal rank (MRR). We additionally report micro- and macro-averaged F1 at a threshold. The distinction between the two averages is substantive here: micro-F1 is dominated by the common techniques, whereas macro-F1 weights every technique equally and therefore acts as our proxy for rare-technique performance — the dimension the label-expansion experiment of section 6 sets out to improve.
Zero-shot baseline.
As a reference point that requires no training we implement a semantic-similarity ranker in the style of SMET: each ATT&CK technique is represented by the embedding of its official name and description, each CVE by the embedding of its description (using a general-purpose sentence encoder, all-MiniLM-L6-v2 [19, 25]), and techniques are ranked by cosine similarity to the CVE. This is a meaningful baseline because prior work deliberately turned to similarity ranking precisely to avoid the label-scarcity that supervised classification faces; if the fine-tuned model cannot beat it, the supervised effort is not justified. Both systems are evaluated with the identical protocol — same test split, same label vocabulary, same metrics — so the comparison is direct.
Result.
table 1 shows the fine-tuned classifier improves on the zero-shot baseline across every ranking metric, roughly doubling recall@3 and recall@5 (recall@5 rises from to ) and lifting MRR from to .111Single-run numbers under the pre-correction evaluation protocol (see section 6); under the corrected protocol the five-seed gold-only numbers of record are recall@5 and macro-F1 . Even trained on only gold examples ( after the in-vocabulary filter), supervision on trustworthy labels clearly pays off. The remaining weakness is exactly where one would expect it — rare-technique performance, reflected in a macro-F1 of about on this run — which motivates the label-expansion study that follows.
| Method | recall@3 | recall@5 | recall@10 | MRR |
|---|---|---|---|---|
| Zero-shot similarity (SMET-style) | 0.257 | 0.322 | 0.491 | 0.397 |
| Supervised (RoBERTa, gold) | 0.482 | 0.686 | 0.842 | 0.620 |
6 LLM-Assisted Label Expansion
The gold set of section 3 is trustworthy but small, and expert curation does not scale to the millions of CVEs a production system must eventually cover. A natural question is whether a large language model (LLM) can stand in for the analyst and extend the gold set cheaply. This section describes a labeler built for that purpose, a benchmark that selects the best available model under a strict acceptance criterion, and a controlled experiment that measures whether the resulting labels actually improve the classifier. The answer, reached only after three rounds of increasingly rigorous experiments, is negative: at 0.39 agreement the added labels produce no reliable improvement at any expansion size we tested, and at the largest size they degrade rare-technique coverage. The path to that answer — a single run said harmful, five seeds said helpful, and only an independent replication plus a scaling sweep revealed no effect — is as much a result as the verdict itself.
6.1 Labeler design
The labeler prompts an LLM to map a CVE description onto the same three-slot schema the gold set uses — exploitation technique, primary impact, and secondary impact — together with a one-sentence justification that records why each technique was assigned. Two interchangeable backends are supported behind a single interface: a local model served by Ollama [18], which requires no API key and runs entirely on the user’s own GPU, and the Anthropic Claude API. All local-model labeling runs reported in this paper were served by Ollama on a single server equipped with two NVIDIA H100 NVL GPUs; at that capacity the 122B-parameter labeler processes a CVE in roughly 1.4 minutes, so labeling one thousand CVEs is a day-long batch job. Both backends are constrained to emit the answer as a structured object matching the label schema, so parsing is not a source of error; technique identifiers that fall outside the active ATT&CK catalogue are dropped, and malformed generations are retried.
Crucially, the labeler runs in one of two modes. In validate mode it labels a held-out slice of the gold set and reports the agreement between the model’s predictions and the analysts’ labels, measured at the parent-technique granularity the classifier is trained on. In expand mode it labels new CVEs that are not in the gold set, writing them to a separate provenance tier (label_sources [llm]) with the backend, model identifier, and justification recorded on every row. The validate-before-expand ordering is deliberate: expansion is only trustworthy if the labeler first demonstrates, on data whose true labels are known, that it agrees with the experts. This gate matters most for a local model, where the alternative is to pay for a frontier API without knowing whether the cheaper option is good enough.
We additionally exposed two levers intended to raise recall, which our early runs identified as the weak point. The first is an assertive prompt that instructs the model to commit to a best exploitation technique and a best primary impact for essentially every CVE, leaving a slot empty only when the description genuinely supports nothing, while still forbidding it from padding a slot with weakly related techniques. The second is an optional two-step procedure (--reason): because a JSON-schema grammar forces a model to emit its answer immediately, a thinking model cannot reason before committing, which tends to depress recall; the two-step mode therefore runs an unconstrained analysis pass first and then a constrained extraction of the technique identifiers from that analysis, at roughly double the per-CVE cost.
6.2 Model-selection benchmark
As a reference point for the labeler, we use the supervised classifier’s own agreement with the gold labels. The intuition is that a labeler agreeing with the experts less well than the trained classifier already does might be expected to add little — its labels are, on average, noisier than the classifier’s own predictions. On a matched full-split run the classifier reaches a micro-F1 of against gold, which we treat as this reference level. We emphasise reference rather than hard gate: whether labels below this level help or hurt in aggregate is an empirical question, which the expansion experiment below answers directly, so we use the figure to contextualise the labeler rather than to accept or reject it outright.
table 2 reports the benchmark. Three findings emerge. First, model capacity dominates prompt engineering. On a common 30-CVE probe the assertive prompt lifts the 35B-parameter model by only micro-F1, whereas moving from the 35B to the 122B model lifts it by — almost entirely by repairing recall (from to ). The smaller model does not disagree so much as under-commit: it is reasonably precise when it does answer but stays silent too often. Second, the two-step --reason procedure did not pay off on the mid-size thinking model: on the same 30 CVEs it scored below the single-call configuration ( versus ), and its unconstrained reasoning pass repeatedly exceeded the inference timeout, dropping whole CVEs to empty labels. It is not a substitute for capacity. Third, and methodologically important, small validation slices are optimistic: the 122B model scored on the 30-CVE probe but only on the full 121-CVE test split — a drop, again concentrated in recall. At the agreement estimate carries enough variance to mislead a go/no-go decision, so we treat the full-split figure as the number of record and re-ran the comparison rather than trusting the smaller sample.
The best configuration — qwen3.5:122b, single call, assertive prompt — thus reaches micro-F1 against gold on the full split. This sits just below the classifier’s , but it is the strongest local configuration available and its agreement is within the range commonly reported for inter-analyst agreement on technique-level ATT&CK CVE mappings. We therefore treat it as the best-case candidate for expansion and test it directly, rather than rejecting it on the benchmark alone.
| Model | Prompt / mode | P | R | micro-F1 |
|---|---|---|---|---|
| qwen3.6:35b | conservative, single | 0.429 | 0.248 | 0.314 |
| qwen3.6:35b | assertive, single | 0.442 | 0.271 | 0.336 |
| qwen3.6:35b | assertive, –reason | 0.395 | 0.214 | 0.278 |
| qwen3.5:122b | assertive, single (n=30) | 0.509 | 0.429 | 0.465 |
| qwen3.5:122b | assertive, single (n=121) | 0.431 | 0.360 | 0.392 |
6.3 Controlled expansion experiment
To measure whether the selected labeler helps, we ran a deliberately small, falsifiable pilot rather than committing to a large expansion up front. We sampled 300 CVEs absent from the gold set and labeled them with the winning configuration; 297 received at least one in-catalogue technique and were kept. These rows were then folded into training and the classifier was retrained on the resulting gold-plus-LLM union.
The experimental design isolates the effect of the LLM labels. The extra rows are concatenated into the training split only; the gold test split is left entirely untouched, so it remains a fixed yardstick against which the union model and the gold-only model are directly comparable. Both models were trained with identical code, random seed, and hyper-parameters — the 297 LLM-labeled rows are the sole difference between the two runs. We also re-measured the gold-only baseline under the current code rather than citing an earlier figure, precisely because the model-selection benchmark had shown how easily a stale or differently measured number can mislead.
The question is whether the LLM labels raise the model’s quality on the gold test split, and in particular whether they improve the analyst-facing ranking metrics (recall@) and the rare-technique proxy (macro-F1).
A single run gives the wrong answer.
Trained once, with the same fixed seed used for the gold-only baseline, the union model appears worse: as table 3 shows, every metric except micro-recall regresses, with recall@5 down and macro-F1 down . Taken at face value, this single comparison says expansion degrades the classifier, and it is exactly the result our initial pilot reported. It is also unreliable, though — as two further rounds of experiments show — not for the reason we first diagnosed. We keep it here deliberately, because it is an instructive cautionary example: in this small-data, high-variance regime a one-seed A/B comparison is not merely imprecise, it can invert the sign of the effect.
Five seeds appear to reverse it.
We repeated both conditions across five random seeds (–), which vary weight initialisation and data shuffling, and report the mean standard deviation together with the paired per-seed delta (table 4). The direction flips on the metrics that matter: averaged over seeds the union model improves recall@3 by , recall@5 by and micro-F1 by , each formally consistent across seeds (paired ), while macro-F1 stays flat. At the time we read the single-seed pilot as the anomaly — its gold-only recall@5 of sits roughly two standard deviations above the five-seed gold mean of — and adopted the “small but consistent ranking gain” as the finding. The next two experiments overturned that reading: it was the five gold-only runs of table 4 that had drawn low.
| Metric | Gold-only | Gold + LLM | |
|---|---|---|---|
| micro-F1 | 0.407 | 0.395 | |
| macro-F1 | 0.185 | 0.164 | |
| micro-recall | 0.625 | 0.626 | |
| recall@3 | 0.546 | 0.491 | |
| recall@5 | 0.683 | 0.633 |
| Metric | Gold-only | Gold + LLM | (paired) | |
|---|---|---|---|---|
| recall@3 | consistent | |||
| recall@5 | consistent | |||
| micro-F1 | consistent | |||
| macro-F1 | within noise | |||
| micro-recall | consistent |
Replication and scale make the gain disappear.
Two further experiments were designed to pin the effect down. First, a scaling sweep: we labeled an independent sample of new CVEs with the same configuration ( retained, published as [11]) and retrained with the first rows folded into training — nested subsets, so each size extends the previous one — five seeds per size, against a matched five-seed gold-only baseline from the same session (table 5, fig. 3). No size reproduces the gain: recall@3 is flat everywhere, recall@5 declines with size ( at , ), and the only metric that improves at the largest size, micro-F1 (, borderline at ), does so while macro-F1 falls markedly (, — the largest and most consistent effect in the sweep): the added labels densify the frequent techniques while drowning the rare ones. Second, a direct replication: we re-ran the original -row union of table 4 in the same session as the new baseline. Its recall@5 reproduced almost exactly ( against before) — but the matched gold-only baseline came out at , not . The “gain” of table 4 was never a property of the union model; it was a low-drawn gold baseline.
| recall@3 | recall@5 | micro-F1 | macro-F1 | |
|---|---|---|---|---|
The mechanism: evaluation noise from checkpoint selection.
What made two internally consistent five-seed experiments disagree by on an identical configuration? The training protocol selected, from per-epoch checkpoints, the one with the best macro-F1 on the -example test split (the trainer’s in-vocabulary filter keeps of the gold test CVEs), and reported that checkpoint’s metrics. Late-training evaluations of so small a split wobble substantially from epoch to epoch (recall@5 spans – within a typical run), so the reported number is a maximum over dozens of noisy evaluations — and ordinary GPU nondeterminism (the order of floating-point reductions is not fixed by a fixed seed) is enough to change which epoch wins. The direct evidence: three runs of the identical gold-only configuration — same seed, data, code, and hardware — reported recall@5 of , , and , a spread of from evaluation noise alone. This defeats not only single-run comparisons but also the paired criterion of table 4, whose error model assumed per-run noise well below that level. We have since corrected the protocol in the released code: checkpoint selection now uses a validation split carved from the gold training data (the test split is evaluated exactly once, for the final report), and an optional fully deterministic mode makes fixed-seed runs bit-reproducible (single-GPU only, at a substantial training-speed cost, since it serializes CUDA kernel launches). The absolute numbers in this paper predate the fix and therefore carry a mild select-on-test optimism; every comparison, however, ran under the same protocol on both sides. Re-running the gold-only configuration under the corrected protocol (five seeds) re-establishes the numbers of record: recall@5 , recall@3 , micro-F1 , macro-F1 — directionally about one point below the pre-correction values and within noise of them, an upper bound on the optimism that also absorbs the of training data ceded to the validation split. Notably, the run-to-run standard deviation of micro-F1 drops from to : selecting checkpoints on a dedicated split removes not only the bias but much of the variance.
The verdict under the corrected instrument.
As a final check, we re-ran the decisive contrast under the corrected protocol: the same five seeds, gold-only against the 297-row union and against all 984 LLM-labeled rows (table 6). The conclusion is unchanged, and now rests on the cleaner instrument rather than on post-hoc noise analysis. Neither expansion configuration improves on gold-only ranking — recall@5 drops from to (297 rows) and (984 rows) — and at 297 rows every metric sits at or below the gold-only mean, leaving no trace of the “consistent gain” table 4 once reported. The rare-technique degradation at scale is confirmed at 2.9 SEM (macro-F1 ), and the borderline micro-F1 uptick persists unresolved (, 1.3 SEM).
| Training data | recall@3 | recall@5 | micro-F1 | macro-F1 |
|---|---|---|---|---|
| gold only | ||||
| gold 297 LLM rows | ||||
| gold 984 LLM rows |
Gold labels scale; LLM labels do not.
The natural control for the null result is to grow the training set with labels we do trust. We trained on nested subsets of the gold train split (, five seeds each) under the corrected protocol, with the label vocabulary — and therefore the filtered test set — frozen to the full-gold one so that only training size varies.222The naive version of this experiment, with the vocabulary rebuilt from each subset, inverts the macro-F1 trend (it reports at rows): smaller training sets produce smaller label vocabularies, hence an easier averaging set and, through the in-vocabulary test filter, an easier test set. One more instance of protocol sensitivity in this regime; the released trainer freezes the vocabulary under --train-fraction. Every metric rises monotonically with gold size — recall@5 from to and macro-F1 from to between and rows. Figure 4 overlays this curve with the expansion arm of table 6 on a single axis of training rows, and the contrast is stark: the final gold rows add recall@5, while LLM-labeled rows added to the same full gold set subtract . The classifier is not data-saturated — gains are diminishing but still positive at rows — it is label-quality bound: rows carrying analyst-grade labels keep paying, rows at agreement do not, at any tested size.
The mechanism, on one CVE.
Aggregate deltas of a few points can feel abstract, so we close the experimental account with a single concrete prediction, reproducible with the released single-CVE inference command (LABEL:lst:inference). CVE-2021-44077 is an unauthenticated remote code execution in Zoho ManageEngine ServiceDesk Plus, exploited in the wild; the CTID analysts mapped it to twelve techniques, six of which survive sub-technique collapse into the released vocabulary. It sits in the held-out test split, so neither checkpoint saw it during training. Both released checkpoints (seed , corrected protocol; gold-only [10] and gold984 [8]) agree on the head of the ranking — exploit the public-facing application (T1190), then a server software component, i.e. a web shell (T1505). But the LLM-expanded checkpoint buys its extra confidence in the obvious call (T1190: , rank ) by deflating nearly everything else the analysts credited to this CVE: T1505 drops below the prediction threshold (), OS credential dumping (T1003) falls from rank to , account discovery (T1087) from to , and the tail technique T1136 (create account — five training examples) from rank to . This is table 6 in miniature — example-weighted confidence up, rare-technique ranking down — though a single CVE under a single seed pair is an illustration, not evidence; the tables carry the evidence.
In production.
The released gold-only checkpoint is not only a research artifact: it is deployed on the public Vulnerability-Lookup instance operated by CIRCL333https://vulnerability.circl.lu, served locally by ML-Gateway444https://github.com/vulnerability-lookup/ML-Gateway. Every vulnerability page carries an ATT&CK tab with the model’s ranked suggestions, explicitly flagged as unverified AI-generated guidance. Figure 5 shows that tab for the CVE of LABEL:lst:inference — the same five techniques and scores, as an analyst sees them in production.
6.4 Interpretation
Two conclusions follow, one about the task and one about method.
On the task: LLM labels at 0.39 agreement do not extend this gold set. Across expansion sizes from to CVEs no ranking metric reliably improves, and the clearest effect in the entire experiment is negative: at the largest size the rare-technique proxy macro-F1 drops by . The pattern is what one would expect of labels whose errors concentrate on exactly the techniques the gold set under-represents: frequent techniques gain density (micro-F1 edges up at ) while the long tail — the very thing expansion was meant to fix — is diluted by noise. The result also retroactively vindicates the model-selection reference level introduced above: a labeler that agrees with the experts slightly less well than the trained classifier does ( versus ) added nothing the classifier did not already know. The gold scaling curve sharpens the diagnosis: the classifier is not data-saturated — every metric still rises between and gold rows — so the ceiling is the labels, not the data volume, and enlarging the curated set is the one intervention with measured payoff. Paths that could still work — and that the released machinery supports — are higher-agreement labeling (a stronger model, human-reviewed silver labels, or restricting to the labeler’s high-confidence slots) and targeting rare techniques explicitly rather than sampling CVEs at random.
On method: the same underlying system produced three different verdicts — harmful (one seed), helpful (five seeds), no effect (replication and scaling) — and the binding constraint turned out to be neither label quality nor seed variance but the evaluation protocol itself. Reporting variance across seeds, the standard prescription, was necessary but not sufficient: the paired five-seed test passed its own consistency criterion and was still wrong, because checkpoint selection on a small test split injects per-run noise comparable to the effect size. Claims about label expansion in this regime — ours or others’ — need a selection split that is not the test split, deterministic or repeated runs, and replication on an independent sample before a small effect is believed. We retain the labeler, both backends, the union-training path, and the corrected protocol in the released code so the full comparison is reproducible.
6.5 How the experiments were run
Every experimental result in this paper was produced the same way: a shell loop over random seeds for each configuration, one self-contained trainer log per run, and an aggregation script that extracts the single final test-split evaluation from each log and reports mean std per configuration. The complete trainer logs are released alongside the code so that every table can be regenerated from them. As an illustration, LABEL:lst:contrast shows the corrected-protocol expansion contrast: the gold-only arm reuses the five runs of record, and the expansion arm folds the LLM-labeled rows into the training split via --extra-dataset-id. The corrected protocol needs no extra flags — a gold-only validation split for checkpoint selection (--val-split 0.1) is the released default.
7 Discussion and Limitations
The right yardstick for absolute performance.
The absolute F1 scores in this paper are low in machine-learning terms, and it would be a mistake to read them against the near-ceiling accuracies typical of well-posed classification. Mapping a CVE to ATT&CK is genuinely hard and partly subjective: a CVE description characterises a flaw, while an ATT&CK technique describes attacker behavior built around that flaw, and even expert analysts disagree on the mapping. The agreement our best labeler reaches with the gold analysts (0.39 micro-F1) is, tellingly, in the same range as the classifier’s own agreement, which suggests both are pressing against an inherent task ceiling rather than a modelling deficiency. The practical consequence is that any model built on this data should be presented as suggesting candidate techniques for analyst review, not as an authoritative mapping — which is also why our headline metrics are the top- ranking measures rather than a single hard-threshold score.
Gold-set size and selection bias.
The gold set is small (1,200 CVEs) and not a representative sample of the CVE corpus. Both CTID sources over-represent vulnerabilities exploited in the wild — the KEV set by construction — so the technique distribution skews toward remote exploitation of servers. Models trained here will inherit that skew, and reported numbers may not transfer unchanged to the long tail of never-exploited CVEs. The size also bounds the label vocabulary: techniques with too few examples are cut, so the classifier simply cannot emit large parts of the ATT&CK matrix.
Ground truth is scarce and difficult to validate.
Finding a usable ground-truth dataset is itself a central difficulty of this task. Public CVE-to-ATT&CK collections are uncommon, often small, and sometimes generated through the same CWECAPECATT&CK tables that a model would subsequently be evaluated against. Such circular evaluation can reward a model for reproducing table-expansion artifacts rather than for selecting the techniques an analyst would apply to the individual CVE. Even expert mappings are not automatically exhaustive: a terse CVE description may support several plausible exploitation and impact paths, and the absence of a technique from a record does not establish that it is a true negative. Ensuring that labels use the proper technique therefore requires both identifier validation against a specific ATT&CK release and semantic review of whether each technique is justified by the vulnerability. We use the CTID mappings as the best available operational gold standard, but not as a claim that every valid technique for every CVE has been enumerated.
Version and schema drift.
The 2021 CTID mappings were authored against an older ATT&CK release, while ATT&CK is a changing ontology rather than a fixed label list. Over time, techniques can be added, deprecated, revoked and replaced; names and descriptions can change; and a former parent-level concept can acquire sub-techniques that express distinctions unavailable to the original annotator. Tactic associations and STIX relationships may change as well, and consumers must also keep the Enterprise, Mobile, and ICS domains separate. Our revoked-by normalisation resolves explicit identifier replacements into the version used by this study, but it cannot infer a modern sub-technique from an older coarse label, reconstruct a mapping after a semantic split or merge, or decide whether revised technique guidance would change the analyst’s choice. Reproducible datasets should consequently record their ATT&CK release, preserve the original identifiers, and treat migration as a reviewed data transformation rather than a blind string substitution. Restricting this study to the Enterprise domain also discards a small number of Mobile/ICS-tagged CVEs.
Scope of the expansion result.
Our expansion verdict — no reliable gain at 0.39 agreement, with a rare-technique cost at scale — is established for one local model family, one prompt configuration, expansion sizes up to CVEs, and five seeds per configuration. What it rules out is the hope that scale alone rescues labels at this agreement level: adding more of them, up to roughly the size of the gold set itself, does not help and hurts the tail. It does not rule out expansion as such: a frontier API model, a human-in-the-loop silver-labeling process, or a labeler restricted to its high-confidence slots might clear an agreement bar that our best local configuration does not, and the released machinery supports exactly that re-run. A further threat to validity is that folding LLM rows into training also enlarges the label vocabulary, so the union and gold-only models are not graded on an identical label space; this is inherent to the treatment (expanding coverage is part of what expansion does) rather than a confound we could remove, but it means the comparison answers the practical question “does adding these labels produce a better model?” rather than a fully label-space-controlled one. The absolute numbers of sections 4 and 5 and of tables 3, 4 and 5 were measured under the pre-correction protocol (checkpoint selection on the test split) and carry a mild select-on-test optimism; comparisons are unaffected in design, and the gold-only numbers of record have since been re-established under the corrected protocol (validation-split checkpoint selection, five seeds; section 6), landing about one point lower and within noise of the pre-correction values; the decisive expansion contrast was likewise re-run under the corrected protocol and confirms the null verdict (table 6). Finally, the experiment measures classifier quality on the gold test split; it does not directly measure label quality on the new CVEs, which by definition have no gold to check against.
Base-model choice.
We fine-tune roberta-base throughout and did not search over base encoders. It is a strong, standard default for text classification, but it is pretrained on general English and may underweight the security-specific vocabulary of CVE text. The expansion result itself is an internal comparison in which the gold-only and gold-plus-LLM models share the same encoder, so the direction of the effect — no reliable gain from expansion at this agreement level, and a rare-technique cost at scale — is a within-encoder difference we would not expect the base model to reverse. We tested that expectation directly with a robustness check on ModernBERT-base [26]: ten runs under the identical corrected protocol (five seeds, gold-only and gold984; table 7) rather than a re-run of the full experimental grid. Both expectations held. The more recent encoder does not raise the ceiling: gold-only micro- and macro-F1 are statistically indistinguishable from roberta-base ( vs. ; vs. ), while both ranking metrics are clearly lower (recall@5 vs. , 5 SEM), so roberta-base remains the released default. And the expansion verdict replicates: adding the LLM-labeled rows again degrades macro-F1 (, 3.1 SEM) and again yields no reliable recall@5 gain (, 1.4 SEM — with the mean still below gold-only roberta-base). The one quantitative difference is that the borderline micro-F1 uptick of table 6 is larger and resolves on ModernBERT (, 2.7 SEM), consistent with the mechanism described above: LLM rows concentrated on head techniques can buy example-weighted F1 precisely while eroding the tail. A systematic search over encoders — domain-adapted models such as SecureBERT, larger variants such as roberta-large — is left to future work; on this evidence the bottleneck is label quality, not encoder recency.
| Encoder | Training data | recall@3 | recall@5 | micro-F1 | macro-F1 |
|---|---|---|---|---|---|
| roberta-base | gold only | ||||
| roberta-base | gold 984 LLM rows | ||||
| ModernBERT-base | gold only | ||||
| ModernBERT-base | gold 984 LLM rows |
8 Conclusion
We set out to map CVEs to MITRE ATT&CK techniques from vulnerability descriptions, and to do so honestly — measuring against a real baseline and subjecting our own conclusions to the scrutiny that small-data experiments demand. Two results stand out. First, a supervised multi-label classifier trained on a small, curated gold set of CTID mappings roughly doubles the recall@5 of a zero-shot similarity baseline and improves every ranking metric, confirming that trustworthy labels, even in modest quantity, beat a training-free semantic ranker for this task. Second, extending that gold set with a capable local LLM agreeing with the experts at 0.39 does not produce a better classifier: across expansion sizes from to CVEs and five seeds per size, ranking quality never reliably improves, and at the largest size rare-technique coverage measurably degrades — on both encoders we tested. Cheap LLM labels at this agreement level are not, on this evidence, a substitute for expert curation — and in particular they are not the fix for the long tail that motivated expansion in the first place.
The methodological result is at least as important as the empirical one. The identical comparison produced three verdicts as rigor increased: one seed said expansion is harmful, five seeds said it helps, and replication with an independent sample plus a size sweep said it does nothing — a verdict a final re-run under the corrected protocol confirms. The culprit was not seed variance alone but evaluation noise: selecting the best of checkpoints on a -example test split makes every reported metric a maximum over noisy evaluations, and identical fixed-seed runs differed by up to in recall@5. Multi-seed reporting — the standard prescription — was necessary but not sufficient; controlling the evaluation protocol (a dedicated selection split, repeated or deterministic runs) is what finally makes the answer stable.
Further work and an open-data path.
The immediate technical next steps are higher-agreement labeling (a stronger model, human-reviewed silver labels, or high-confidence slots only) aimed squarely at rare techniques; CWE-stratified rather than random sampling of CVEs to label; evaluation on newer and less exploitation-biased CVEs; and larger domain-adapted encoders. The clearest measured opportunity, however, is to enlarge the curated gold set: its scaling curve is still improving at the current size, whereas adding unreviewed LLM labels is not. We therefore hope this release can seed a broader open-data effort in which incident responders, vulnerability analysts, researchers, and vendors contribute reviewed CVE-to-ATT&CK mappings rather than building further private, mutually incompatible collections. Such a project should retain the evidence and rationale for each mapping, distinguish exploitation from primary and secondary impact, record annotator agreement and provenance, pin the ATT&CK release while preserving original identifiers, and publish reviewed corrections and versioned splits. Contributions targeted at rare techniques and under-represented vulnerability classes would be especially valuable. A growing, auditable community dataset would enable both fairer benchmarks and periodic retraining, and is the most credible route we see to improving this model beyond the ceiling demonstrated here. All code, datasets, models, and trainer logs — including every stage of the three-verdict expansion experiment — are released to provide a reproducible starting point for that effort.
From source changes to vulnerability records.
A complementary direction is to apply the classifier before a polished vulnerability description exists. Security-fix commit messages can state the affected component and failure mode, while an associated patch or diff — when it is available and safe to process — can expose the concrete behavior that the short prose of a CVE record omits. A multi-input variant could encode the commit message, changed code, and available advisory text together, then generate ranked ATT&CK techniques with evidence linked back to the relevant message or patch lines. Integrated with existing record-generation tooling, this could support an end-to-end pipeline that creates draft vulnerability information and technique mappings automatically for GCVE [13] and CVE publication workflows, rather than adding ATT&CK enrichment only after publication. Achieving full automation would require a new, openly reviewable training set linking fixes, patches, vulnerability records, and versioned ATT&CK labels, as well as evaluation for information leakage, repository and programming- language bias, unavailable or incomplete patches, and identifier drift. Given the consequences of publishing an incorrect authoritative record, the first deployment should retain human approval and machine-readable provenance; full automation should be enabled only after its precision is established on prospective, previously unseen fixes.
Reproducibility and Artifacts
- •
Paper and trainer logs: github.com/vulnerability-lookup/cve-attack-mapping-paper.
- •
Code: VulnTrain (github.com/vulnerability-lookup/VulnTrain).
- •
Dataset: CIRCL/vulnerability-attack-techniques [9], DOI 10.57967/hf/9621.
- •
- •
Model: CIRCL/vulnerability-attack-technique-classification-roberta-base [10] (gold-only, corrected protocol, seed ), DOI 10.57967/hf/9623. The negative-result comparison checkpoint of LABEL:lst:inference is published alongside it as ...-roberta-base-llm-expanded [8], DOI 10.57967/hf/9624 — for reproducibility, not for use.
Acknowledgements
This work was carried out in the context of the AIPITCH project (AI-Powered Innovative Toolkit for Cybersecurity Hubs), which aims to create advanced artificial-intelligence-based tools supporting key operational services in cyber defence, including technologies for early threat detection, automatic malware classification, and the improvement of analytical processes through the integration of Large Language Models. The project is led by the NASK National Research Institute (Poland); the international consortium includes CIRCL (Computer Incident Response Center Luxembourg, Luxembourg), The Shadowserver Foundation (Netherlands), NCBJ (National Centre for Nuclear Research, Poland), and ABI Lab (Centre of Research and Innovation for Banks, Italy).
Funding
This work was co-funded by CIRCL and by the European Union through the AIPITCH project. The European Union contribution was provided by the European Cybersecurity Industrial, Technology and Research Competence Centre under grant agreement No 101190545 (call DIGITAL-ECCC-2024-DEPLOY-CYBER-06). Views and opinions expressed are however those of the author(s) only and do not necessarily reflect those of the European Union or the European Cybersecurity Industrial, Technology and Research Competence Centre. Neither the European Union nor the granting authority can be held responsible for them.
References
- [1] B. Abdeen, E. Al-Shaer, A. Singhal, L. Khan, and K. W. Hamlen (2023) SMET: semantic mapping of CVE to ATT&CK and its application to cybersecurity. In Data and Applications Security and Privacy XXXVII (DBSec 2023), Lecture Notes in Computer Science, pp. 243–260. External Links: Document Cited by: §1, §2.3.
- [2] C. Bonhomme and A. Dulaunoy (2025) VLAI: a RoBERTa-based model for automated vulnerability severity classification. arXiv preprint arXiv:2507.03607. Cited by: §4.
- [3] C. Bonhomme (2025) GPU efficiency in VLAI model training. Note: Technical report, https://www.vulnerability-lookup.org/files/news/2025/12/GPU_Efficiency_VLAI_Model_Training_2025.pdfDOI: 10.13140/RG.2.2.24233.04963 External Links: Document Cited by: §4.
- [4] Center for Threat-Informed Defense (2021) Mapping ATT&CK to CVE for impact. Note: https://github.com/center-for-threat-informed-defense/attack_to_cveMITRE Engenuity Center for Threat-Informed Defense Cited by: §1, §2.2.
- [5] Center for Threat-Informed Defense (2023) TRAM: threat report ATT&CK mapper. Note: https://github.com/center-for-threat-informed-defense/tram Cited by: §2.3.
- [6] Center for Threat-Informed Defense (2024) ATT&CK mappings explorer. Note: https://center-for-threat-informed-defense.github.io/mappings-explorer/Includes CVE (KEV) to ATT&CK mappings Cited by: §1, §2.2.
- [7] CodeCarbon contributors (2024) CodeCarbon: estimate and track carbon emissions from machine learning computing. Note: https://github.com/mlco2/codecarbon Cited by: §4.
- [8] Computer Incident Response Center Luxembourg and C. Bonhomme (2026) vulnerability-attack-technique-classification-roberta-base-llm-expanded (Revision 9db8c37). Note: Hugging Face, https://huggingface.co/CIRCL/vulnerability-attack-technique-classification-roberta-base-llm-expandedDOI: 10.57967/hf/9624 External Links: Document Cited by: §6.3, 5th item.
- [9] Computer Incident Response Center Luxembourg and C. Bonhomme (2026) vulnerability-attack-techniques (Revision c2b5da0). Note: Hugging Face, https://huggingface.co/datasets/CIRCL/vulnerability-attack-techniquesDOI: 10.57967/hf/9621 External Links: Document Cited by: §3.1, 3rd item.
- [10] Computer Incident Response Center Luxembourg (2026) vulnerability-attack-technique-classification-roberta-base (Revision 3b98a1d). Note: Hugging Face, https://huggingface.co/CIRCL/vulnerability-attack-technique-classification-roberta-baseDOI: 10.57967/hf/9623 External Links: Document Cited by: §6.3, 5th item.
- [11] Computer Incident Response Center Luxembourg (2026) vulnerability-attack-techniques-llm-scaling (Revision 0bf633c). Note: Hugging Face, https://huggingface.co/datasets/CIRCL/vulnerability-attack-techniques-llm-scalingDOI: 10.57967/hf/9622 External Links: Document Cited by: §6.3, 4th item.
- [12] Cybersecurity and Infrastructure Security Agency (CISA) (2026) Known exploited vulnerabilities catalog. Note: https://www.cisa.gov/known-exploited-vulnerabilities-catalog Cited by: §2.2.
- [13] A. Dulaunoy (2026) GCVE: a decentralized model for vulnerability identification, publication, and operational enrichment. arXiv preprint arXiv:2606.00856. External Links: Link Cited by: §8.
- [14] Galeax (2024) CVE2CAPEC: mapping CVE to CWE, CAPEC and MITRE ATT&CK. Note: https://github.com/Galeax/CVE2CAPEC Cited by: §2.3, §3.3.
- [15] O. Grigorescu, A. Nica, M. Dascalu, and R. Rughiniş (2022) CVE2ATT&CK: BERT-based mapping of CVEs to MITRE ATT&CK techniques. Algorithms 15 (9), pp. 314. External Links: Document Cited by: §2.3.
- [16] E. Hemberg, J. Kelly, M. Shlapentokh-Rothman, B. Reinstadler, K. Xu, N. Rutar, and U. O’Reilly (2020) Linking threat tactics, techniques, and patterns with defensive weaknesses, vulnerabilities and affected platform configurations for cyber hunting. arXiv preprint arXiv:2010.00533. Cited by: §2.3.
- [17] Y. Liu, M. Ott, N. Goyal, J. Du, M. Joshi, D. Chen, O. Levy, M. Lewis, L. Zettlemoyer, and V. Stoyanov (2019) RoBERTa: a robustly optimized BERT pretraining approach. arXiv preprint arXiv:1907.11692. Cited by: §4.
- [18] Ollama (2026) Ollama: get up and running with large language models locally. Note: https://ollama.com Cited by: §6.1.
- [19] N. Reimers and I. Gurevych (2019) Sentence-BERT: sentence embeddings using siamese BERT-networks. In Proceedings of the 2019 Conference on Empirical Methods in Natural Language Processing (EMNLP), Cited by: §5.
- [20] B. E. Strom, A. Applebaum, D. P. Miller, K. C. Nickels, A. G. Pennington, and C. B. Thomas (2020) MITRE ATT&CK: design and philosophy. Technical report Technical Report MP180360R1, The MITRE Corporation. Note: https://attack.mitre.org Cited by: §1, §2.1.
- [21] The MITRE Corporation (2026) CAPEC: common attack pattern enumeration and classification. Note: https://capec.mitre.org Cited by: §1.
- [22] The MITRE Corporation (2026) CVE: common vulnerabilities and exposures. Note: https://www.cve.org Cited by: §1.
- [23] The MITRE Corporation (2026) CWE: common weakness enumeration. Note: https://cwe.mitre.org Cited by: §1.
- [24] The MITRE Corporation (2026) MITRE ATT&CK stix data (attack-stix-data). Note: https://github.com/mitre-attack/attack-stix-dataEnterprise ATT&CK; accessed 2026 Cited by: §2.1.
- [25] W. Wang, F. Wei, L. Dong, H. Bao, N. Yang, and M. Zhou (2020) MiniLM: deep self-attention distillation for task-agnostic compression of pre-trained transformers. In Advances in Neural Information Processing Systems (NeurIPS), Cited by: §5.
- [26] B. Warner, A. Chaffin, B. Clavié, O. Weller, O. Hallström, S. Taghadouini, A. Gallagher, R. Biswas, F. Ladhak, T. Aarsen, N. Cooper, G. Adams, J. Howard, and I. Poli (2024) Smarter, better, faster, longer: a modern bidirectional encoder for fast, memory efficient, and long context finetuning and inference. arXiv preprint arXiv:2412.13663. Cited by: §7.