Source-linked AI summary
FixV2W: Correcting Invalid CVE-CWE Mappings with Knowledge Graph Embeddings
Sevval Simsek, Varsha Athreya, David Starobinski
TL;DR
Many NVD CVE–CWE mappings are invalid, obscuring vulnerability root causes. FixV2W combines historical remapping patterns with knowledge graph embeddings, and reports correct Top-10 matches for 69% of exploited vulnerabilities previously carrying invalid CWEs.
Problem
As of December 2024, 55% of NVD CVEs were mapped to invalid CWEs, which can obscure root causes and hinder attack-pattern detection and mitigation.
Source: §1 · p. 2Method
FixV2W combines longitudinal remapping analysis with graph embeddings over CVE, CWE, and CPE relationships to predict allowed CWE mappings without semantic features.
Source: §1 · pp. 2–3Results
69% of exploited vulnerabilities previously mapped to invalid CWEs received correct CWE matches among FixV2W’s Top-10 predictions.
Source: §8 · p. 29Takeaways & Limitations
The results indicate that ontology-informed graph embeddings can offer a practical, deterministic alternative to semantic or LLM-based approaches for correcting invalid mappings.
Source: §8 · p. 29Validation treats updated NVD mappings as reference labels, so persistent errors can penalize correct but unlisted alternatives.
Source: §7.1 · p. 26, §7.5.1 · p. 29
Abstract
from arXiv · showhide
Accurate mapping between Common Vulnerabilities and Exposures (CVE) and Common Weakness Enumeration (CWE) entries is critical for effective vulnerability management and risk assessment. However, public databases, such as the National Vulnerability Database (NVD), suffer from inconsistent and incomplete CVE to CWE mappings, complicating automated analysis and remediation. We introduce FixV2W, a lightweight approach that leverages knowledge graph embeddings and longitudinal trends to improve mapping accuracy of the NVD. FixV2W systematically analyzes historical remapping patterns and leverages hierarchical relationships within NVD and CWE data to predict more precise CWE mappings for vulnerabilities linked to Prohibited or Discouraged categories. We run extensive experimental evaluation of FixV2W, based on test data set collected between August 2021 and December 2024. Considering the Top 10 ranked predictions, the results show that FixV2W predicts the correct CWE mappings for 69% of exploited vulnerabilities that had invalid CWEs before they were exploited. We also show that FixV2W significantly improves the performance of ML models relying on NVD data. For instance, for a model geared at uncovering unknown CVE-CWE mappings, FixV2W improves the Mean Reciprocal Rank (MRR) from 0.174 to 0.608. These results show that FixV2W is a promising approach to identify and thwart emerging threats.
1 Introduction
The NVD contains many invalid CVE–CWE mappings that obscure vulnerability root causes, while historical remaps show that replacements often follow CWE hierarchy. FixV2W combines those patterns with knowledge graph embeddings to predict allowed mappings and improve models that use NVD data.
1 Introduction
- As of December 2024, 55% of NVD CVEs had invalid CWE mappings, which can obscure root causes and hinder attack-pattern detection and mitigation.Invalid mappings include Prohibited, Discouraged, or placeholder CWEs; 95 of 99 exploited vulnerabilities originally mapped to Discouraged or Prohibited CWEs were remapped only after the exploit was revealed.Source: §1 · p. 2
- From 2016 to 2024, 84% of remaps stayed within the same CWE branch, often one to two hierarchy hops away; Prohibited category/view mappings often remapped to members.Prohibited mappings made up to 5% of NVD mappings, and Discouraged mappings up to 12%.Source: §1 · pp. 2–3
- FixV2W uses graph embeddings over interconnected CVE, CWE, and CPE entities to predict allowed CWE candidates without semantic information.Candidate sets use nearby branch CWEs for Discouraged mappings and members or descendants for Prohibited category/view mappings.Source: §1 · p. 3
- For 131 of 190 exploited CVEs mapped to Prohibited or Discouraged CWEs, FixV2W correctly predicts the root cause.The evaluation considers CVEs from the Known Exploited Vulnerabilities Catalog and Exploit DB since August 2021.Source: §1 · p. 3
- FixV2W significantly outperforms the original model in predicting unseen CVE-CWE triples, and Top-2 replacements improve graph-completion models.The paper presents these results as evidence that FixV2W can improve existing ML models based on NVD data.Source: §1 · pp. 3–4
2 Related Work
Prior work studies knowledge-graph repair, NVD data quality, and automated CVE–CWE mapping. FixV2W instead targets correction of existing invalid NVD mappings using ontology structure and remapping history.
2 Related Work
- Earlier knowledge-graph repair approaches use user-guided updates, textual summaries, or rich edit histories, constraints the authors say make them unsuitable for this NVD setting.The user-guided approach is infeasible given the NVD's invalid-data volume and graph complexity; the edit-history approach relies on corrections that are scarce for NVD Prohibited CWEs.Source: §2 · p. 4
- FixV2W achieves a 50% exact match rate on the combined Prohibited and Discouraged correction test set, while the cited mapping studies evaluate different tasks or narrower settings.ThreatZoom evaluates unclassified CVEs with expert-annotated validation sets; CVE2CWE tests only 50 of the 130 CWE-1003 CWEs and lacks validation.Source: §2 · p. 5
- For CVE–CWE–CPE graph completion, FixV2W builds on Shi et al. [45] with graph-based candidate selection and NVD remapping history to improve precision.The paper also says FixV2W can achieve accuracy similar to a semantic-model approach without its complex semantics.Source: §2 · p. 5
- CWE-GPT reports 95.85% of CVEs with at least one CWE match and precision of 0.10, whereas FixV2W focuses on existing invalid mappings and provides deterministic, interpretable results.The paper characterizes CWE-GPT as prioritizing comprehensive candidate lists.Source: §2 · p. 5
- FixV2W targets correction of existing invalid NVD mappings, unlike work assigning CWEs to unclassified CVEs or classifying unmapped CVEs.The paper describes this as the first work specifically targeting invalid CWE mapping correction in the NVD.Source: §2 · pp. 5–6
3 Background and Longitudinal Analysis of the NVD
This section establishes the NVD and CWE context for invalid mappings, then uses historical remaps to motivate FixV2W’s candidate-selection strategy. The analysis finds that remaps are often nearby in the CWE hierarchy, but also documents exceptions and persistent mapping patterns.
3.1 The National Vulnerability Database and data quality
- The NVD supplies CVE records enriched with CWE, CPE, and CVSS metadata, while the CWE hierarchy ranges from broad Pillars to detailed Variants.The NVD relies on CNAs to submit and enrich vulnerability reports; the paper focuses on correcting Prohibited or Discouraged mappings when possible.Source: §3.1 · p. 6, §3.2 · pp. 7–8
3.3 Longitudinal analysis of the NVD
- Discouraged mappings grew beyond 55,000 by 2025, while Prohibited mappings remained near 16,000 since 2018.The figure tracks cumulative yearly counts; its caption describes a slight decrease in Prohibited mappings and an increase in Discouraged mappings.Source: §3.3 · p. 8, Figure 3 · p. 9
- CWE-noinfo received 4,000 remaps from July 2016 to December 2024, and the CWE-1003 view had not kept pace with more than 70 new CWEs added since its 2019 update.The paper notes that CWE-noinfo ranked second among the top three CWEs used for root-cause mappings.Source: §3.3 · p. 8
- Frequently misused CWEs such as CWE-119, CWE-200, and CWE-20 lack specificity, yet cannot be excluded because they still appear in new mappings.The figure contrasts CWEs added with more detail against general CWEs removed more often.Source: §3.3 · pp. 8–9, Figure 4 · p. 9
- Over 80% of valid remaps remain in the same CWE branch, and 60% move at most two hierarchy hops, though exceptions require expert analysis.The analysis measures distance in any direction, including moving up to a parent and down to another descendant.Source: §3.3 · p. 10, Figure 5 · p. 10
- Among remaps, 38% replace an old CWE with CWE-noinfo; most of the remaining 62% stay in the same CWE chain or category.Related remaps commonly move to a child or other descendant within the same branch.Source: §3.3 · p. 10
4 FixV2W: Automated Prediction and Correction of CVE-CWE mappings
FixV2W uses knowledge-graph embeddings and historical CWE remapping patterns to rank replacement candidates for invalid CVE-CWE mappings. Its candidate sets are selected to reflect likely hierarchical or category relationships while balancing relevance and coverage.
4 FixV2W: Automated Prediction and Correction of CVE-CWE mappings
- FixV2W predicts corrected CWE mappings for vulnerabilities linked to invalid entries by combining knowledge-graph embeddings with historical remapping patterns.The method focuses on Prohibited and Discouraged mappings and uses graph connections without requiring semantic information.Source: §4 · pp. 10–11
4.1 Knowledge Graph Embedding
- CVE, CWE, and CPE entities and their relationships form knowledge-graph triples that embeddings use to support link prediction.The embedding model represents entities and relations in continuous vector spaces while preserving graph structure and semantics.Source: §4.1 · p. 11
4.2 Formal Description
- For each CVE mapped to a Prohibited CWE, FixV2W scores candidate replacement triples and returns the allowed CWE candidates ordered by likelihood.The candidate set is chosen for each vulnerability, and candidates are ordered by their embedding-model scores.Source: §4.2 · p. 12
4.3 Candidate Selection Trials
- Candidate selection balances precision against recall: overly broad lists dilute predictions, while overly narrow lists can exclude correct mappings.The approach strategically reduces the candidate space using CWE hierarchy and correction history rather than relying only on broad baseline sets.Source: §4.2 · p. 12, §4.3 · p. 13
4.3.1 Baseline candidate entities.
- The CWE-1003 and Top-25 views provide baseline candidate sets, but highly central CWEs can dominate rankings and reduce prediction accuracy.The CWE-1003 view broadens coverage, whereas the Top-25 view excludes relevant but less frequent weaknesses.Source: §4.3.1 · pp. 13–14
4.3.2 CWE Branch Hierarchy.
- For Discouraged mappings, descendant candidates focus predictions, while expanding to the parent’s descendants can recover broader related options.Family candidates work best in the model because they increase diversity while preserving relevance; direct descendants may be too few for some test cases.Source: §4.3.2 · p. 14
4.3.3 CWE Members for Views and Categories.
- For Prohibited mappings, category or view members and their descendants provide conceptually related candidates, while nearest neighbors offer an alternative when membership sets are sparse.Member sets can be overly broad or very small, and nearest-neighbor performance may be limited for invalid CWEs with few graph connections.Source: §4.3.3 · pp. 14–15
5 Implementation and Evaluation Methodology
The evaluation trains FixV2W on an August 2021 NVD snapshot and validates its predictions against subsequent mapping updates through December 2024. It combines graph-embedding training with ranking and coverage measures for exact and related CWE predictions.
5.1 Implementation Details
- The validation set compares predictions with CWE remaps made after August 4, 2021 through December 17, 2024, using the NVD state from August 4, 2021 for training.The CWE database version used in both datasets is from 2021 and includes its hierarchy, views, and members.Source: §5.1 · p. 15
- The 2021-to-2024 NVD snapshots contain 334 Prohibited and 1,467 Discouraged CWE mapping updates.Most Discouraged corrections were made during curation of the 2022, 2023, and 2024 CWE Top-25 lists.Source: §5.1 · p. 15
5.1.1 Embedding Model Training Process.
- The embedding model uses TransE, which places a valid triple’s tail entity near its head entity translated by the relation embedding.Training uses valid triples and artificially corrupted negative triples to distinguish valid from invalid relations.Source: §5.1.1 · pp. 15–16
5.2 Implementation Details and Runtimes
- GPU use does not always shorten FixV2W execution: tensor transfers can outweigh acceleration in PyTorch, while AmpliGraph runs faster on GPU.Candidate extraction, candidate-set construction, and result saving remain CPU operations in both implementations.Source: §5.2 · p. 16
- Evaluation tests vulnerabilities whose training mappings are Prohibited and whose validation mappings are allowed, then returns accuracy, mean rank, and MRR for exact and related matches.The evaluation procedure scans sorted candidate lists and checks for exact, fine-grain, and coarse-grain matches.Source: §5.2 · p. 17
5.3.1 Rank-based metrics.
- Mean rank summarizes the correct entity’s average position, MRR averages reciprocal ranks, and Hits@N measures correct entities appearing in the Top-N results.The reported Hits@N cutoffs are 1, 3, 5, 10, and 20.Source: §5.3.1 · p. 17
5.3.2 Coverage Metrics.
- Top-10 coverage distinguishes exact matches, direct parent-or-child fine-grain matches, and coarse-grain matches within the correct CWE branch.The paper notes that fine-grain predictions sometimes appear more precise than the corrected NVD ground-truth label.Source: §5.3.2 · p. 17
6 Experimental Results
FixV2W improves graph-completion results after invalid mappings are replaced and predicts corrected root causes for many exploited vulnerabilities before their remaps. Candidate-set choice shapes the balance between coverage and ranking precision.
6.1.1 Evaluation of FixV2W for Correcting Discouraged CWEs.
- For Discouraged mappings, the family candidate set raises Top-1 coverage from 12.84% to 25.74% while reaching almost the CWE-1003 baseline’s overall coverage.The direct-descendant set places 48.26% of predictions in Top-5 but can leave too few candidates for fine- or coarse-grain matches.Source: §6.1.1 · pp. 18–19
6.1.2 Evaluation of FixV2W for Correcting Prohibited CWEs.
- Member candidates produce 137/338 exact matches versus 67/338 for Top-25, while total exact, fine-grain, or coarse-grain predictions rise from 135 to 215.The FNN candidate list performs comparably to the Member approach.Source: §6.1.2 · pp. 19–20, Figure 8 · p. 20
6.2 Coverage vs. Accuracy
- For Discouraged mappings, smaller Descendants and Family candidate sets concentrate predictions at top ranks; for Prohibited mappings, Member candidates outperform adding nearest neighbors.The authors report no apparent benefit from supplementing Member candidates with nearest neighbors, which shifts some correct predictions from rank 2 to rank 3.Source: §6.2 · pp. 20–21, Figure 9 · p. 21, Figure 10 · p. 22
6.3 Uncovering Unknown Associations between CVE and CWE Entries
- Under OWA, replacing invalid mappings with Top-2 predictions raises MRR from 0.173 to 0.608 and Hits@10 from 0.389 to 0.793; under CWA, Top-3 raises MRR from 0.419 to 0.731.The OWA comparison is against the model of [45] on the original NVD; the CWA comparison also reports a significant overall improvement after updating mappings.Source: §6.3 · p. 23, Table 9 · p. 23, Table 10 · p. 23
6.4 Preventing Exploits
- FixV2W correctly predicts the root causes of 131 of 190 exploited CVEs with prior Prohibited or Discouraged mappings before those mappings were updated.The 190 vulnerabilities were exploited between August 2021 and December 2024; FixV2W was trained on 2021 data.Source: §6.4 · p. 24, Figure 11 · p. 24
7 Discussion
The discussion examines where FixV2W’s graph structure and NVD reference labels constrain correction performance. It also compares per-CWE candidate sets and reports cases where predictions suggest more precise mappings than the NVD.
7.1 Understanding Incorrect Predictions
- About 35–40% of Prohibited and Discouraged remaps lack a correct answer in FixV2W’s Top-10 predictions.The discussion investigates why these cases are missed.Source: §7.1 · p. 25
- Among Prohibited cases, 61 CVEs were previously mapped to CWE-16 or CWE-264, whose sparse ontology associations make replacements difficult to find.Excluding those cases raises coverage from 63% to 75% and exact match from 40% to 50%; the reported Section 6 results retain them.Source: §7.1 · p. 26
- Seven remaps from CWE-189 fall outside its Numeric Errors category and members, leaving their new mappings too distant for FixV2W to predict.More generally, incorrect predictions often involve new mappings unrelated to the old CWE.Source: §7.1 · p. 26
7.2 Using Different Types of Candidate Sets For Each CWE
- Tailoring candidate sets by prior remapping patterns yields mixed results: some CWEs benefit, while others, including CWE-200, perform worse.The study compares Top-25, Descendants, Member, and Neighbor candidates; figures report correct-remapping counts for Prohibited and Discouraged sets.Source: §7.2 · p. 27, Figure 13 · p. 27, Figure 14 · p. 28
7.3 FixV2W vs NVD: Which is more accurate?
- Manual review found 11 of 123 Prohibited-set predictions scored as incorrect were valid CWEs absent from NVD metadata.Examples include FixV2W predicting CWE-20 first for CVE-2016-5042, where the NVD mapping appears less precise.Source: §7.3 · pp. 27–28
7.4 Shortcoming of semantic models
- The authors argue ontology connectivity can complement semantic models, which require large labeled datasets and may produce inconsistent LLM classifications.They describe FixV2W as avoiding keyword overfitting and providing interpretable, reproducible predictions aligned with ontology structure.Source: §7.4 · pp. 28–29
7.5.1 Data Accuracy.
- Validation against updated NVD mappings assumes those labels are most accurate, so errors in the reference labels bound reported model accuracy.The model can be penalized for predicting a more specific alternative that the NVD does not list.Source: §7.5.1 · p. 29
7.5.2 Results Evaluation.
- The evaluation also assumes NVD or CNA mappings are complete, although vulnerabilities may have multiple root causes and NVD often lists only one CWE.This can leave training and evaluation data under-specified.Source: §7.5.2 · p. 29
8 Conclusion
FixV2W uses knowledge-graph structure and longitudinal remapping patterns to correct invalid NVD CVE–CWE mappings. It returns correct Top-10 matches for 69% of exploited vulnerabilities with invalid CWEs before exploitation, while the authors note limits of purely structural correction.
8 Conclusion
- 69% of exploited vulnerabilities with invalid CWEs before exploitation receive a correct FixV2W match among its Top-10 results.The longitudinal study found more than half of NVD CVEs assigned invalid CWE categories, with 84% of subsequent remaps occurring within one to two hierarchy hops.Source: §8 · p. 29
- Family candidates perform best for Discouraged corrections, while category or view members perform best for Prohibited corrections.The model performs best when the original CWE has meaningful ontology connections; a few outliers lack those connections.Source: §8 · p. 29
- Higher-quality root-cause data may support better future predictions and ML performance across the cybersecurity ecosystem.The authors identify this as a broader implication for vulnerability management.Source: §8 · p. 29
- Purely structural approaches have limits when original invalid mappings are substantially misaligned with the true weakness, and NVD remaps are not always the most accurate reference.The authors propose integrating FixV2W with semantic models, particularly LLMs, as future work.Source: §8 · p. 30