CVE-to-ATT&CK Mapping via Evidence-Constrained Ranking

Motivation

• A CVE identifies a software flaw, but mapping it to ATT&CK connects that flaw to evidence-constrained hypotheses about adversary behavior.Analysts can combine these mappings with asset context and threat intelligence to reason about a vulnerability’s possible role in an attack.Source: §1 · p. 1

Challenges

• Incomplete, imbalanced source coverage and multiple plausible candidates make it difficult to preserve relevant techniques and distinguish supported mappings from semantic lookalikes.Across the six datasets, only 131 parent-level techniques appear, and the ten most frequent account for 50% of observed labels; only 26.35% of KEV CVE records have an available CWE–CAPEC connection.Source: §1 · p. 2

TRACE

• TRACE aggregates structural and semantic evidence into a bounded candidate pool, then reranks retained techniques using accumulated evidence and CVE–technique textual interactions.The design assigns candidate construction to coverage and reranking to precision.Source: §1 · p. 2

Evaluation

• 60% smaller ATT&CK search space retained at least one ground-truth technique for 95.11%–100% of CVEs across six public datasets.Step 2 improved ordering, with NDCG@10 gains of 0.0607 to 0.2806 across the six datasets; TRACE also achieved the strongest performance across all five ranking metrics on KEV and CVE2Attack.Source: §1 · p. 2

Knowledge-integrated mapping

• Knowledge-graph methods depend on curated paths, which can leave relevant techniques unrecovered when a CVE-to-technique relation is missing.BRON returns available graph paths, while VDM-IoT uses paths as prompt context without constraining the LLM output [16].Source: §2 · p. 3

TRACE

• TRACE draws candidates from multiple complementary evidence sources and jointly considers candidate evidence, preservation probabilities, and CVE–technique textual relations.This approach does not rely on a single curated graph path to retrieve candidates.Source: §2 · p. 3

Supervised and retrieval-based mapping

• Supervised classifiers depend on label coverage and frequency, while semantic retrieval can confuse terminology similarity with support from vulnerability evidence.CVE2ATTCK models direct associations, whereas SMET ranks techniques by embedding similarity.Source: §2 · p. 3

LLM-based and generation-based mapping

• LLM-based mapping offers flexible interpretation, but open-ended generation can produce redundant or weakly evidence-supported techniques.TRIAGE uses rule-guided prompting and in-context examples [18].Source: §2 · p. 3

System overview

• TRACE first builds a bounded, high-coverage candidate pool, then reranks retained techniques to separate candidate coverage from ranking precision.The architecture addresses the trade-off between permissive retrieval that admits weak candidates and aggressive prediction that may discard relevant ones.Source: §3.1 · p. 3

Step 1: Candidate construction

• Step 1 retrieves candidates from 201 parent-level techniques using structural evidence and semantic retrieval of behavioral phrases from CVE descriptions.The structural branch draws on lexical evidence, CVE–CWE–CAPEC–ATT&CK relations, and CVSS-derived exploitation cues.Source: §3.1 · pp. 3–4

Step 2: Candidate reranking

• Step 2 reranks the retained candidates by combining Step 1 evidence, candidate-preservation probability, and CVE–technique semantic interaction.A frequency-based correction reduces systematic preference for frequently observed techniques.Source: §3.1 · p. 4

3.2 Evidence-Guided Candidate Construction

• Candidate construction combines structural and semantic retrieval over the ATT&CK technique space using available CVE descriptions, CWE labels, CVSS attributes, and CAPEC relations.The structural branch uses lexical matches, CWE–CAPEC–ATT&CK links, and CVSS-derived cues; semantic retrieval complements these sources when behavior is expressed indirectly.Source: §3.2 · p. 4, §3.2.2 · p. 4

3.2.1 Candidate Construction in Structural Branch.

• Structural retrieval uses direct lexical matching, CVE–CWE–CAPEC–ATT&CK bridging, and CVSS-informed cues to recover candidate techniques.Parent-level lexical matching can recover a parent technique when the strongest match is to one of its sub-techniques.Source: §3.2.1 · p. 4

3.2.2 Candidate Construction in Semantic Branch.

• Semantic retrieval ranks techniques by the maximum similarity between SRL-extracted behavioral phrases and technique descriptions, complementing structural evidence when terminology differs.Candidates are represented with features covering structural support, semantic support, provenance, and CVSS exploitation context; a learned preservation model estimates whether candidates should pass to Step 2.Source: §3.2.2 · pp. 4–5

3.2.4 Final Candidate-Pool Generation.

• Final pool generation maps candidates to 201 parent-level identifiers, retains the highest-probability representative per parent, and selects candidates by cumulative normalized probability up to a cap.The target cumulative mass is 0.90 and the maximum pool size is 80; these settings are selected on held-out validation data to balance ground-truth coverage against pool size.Source: §3.2.4 · p. 5

3.3 Step 2: Candidate Reranking

• Step 2 reranks candidates because Step 1 preserves plausible techniques but does not resolve their relative relevance to the complete vulnerability evidence.Candidates supported by different structural or semantic evidence can receive similarly high preservation probabilities.Source: §3.3 · p. 6

3.3.1 Candidate Reranker.

• A learned SecRoBERTa-based scoring head combines Step 1 evidence with CVE–technique textual interactions to score each retained candidate.The text features capture semantic relevance and fine-grained interactions between the CVE and candidate technique.Source: §3.3.1 · p. 6, §3.3 · p. 6
• A frequency-based correction penalizes techniques that are systematically over-ranked because they are frequent in training data.The correction uses a training-set frequency statistic and a parameter controlling penalty strength.Source: §3.3.1 · p. 6

3.3.2 Score Head Training.

• The scoring head is trained to rank retained ground-truth techniques above other candidates, using positive–negative pairs and a margin-based ranking loss.Unlike Step 1, which predicts whether a candidate should be retained, Step 2 optimizes the candidates’ relative ordering.Source: §3.3.2 · p. 6

3.4 TRACE for Unseen CVEs: An Example

• CWE-78 links to five CAPEC patterns, but none has a corresponding ATT&CK relationship; semantic retrieval supplies additional candidates from the CVE description and CVSS.The example CVE describes unauthenticated command execution through SMTP requests.Source: §3.4 · p. 6
• T1059.003 and T1190 each receive support from three evidence sources, with different combinations of lexical, semantic, CWE, and CVSS evidence.T1059.003 has direct lexical, semantic retrieval, and CWE lexical support; T1190 has direct lexical, CWE lexical, and CVSS semantic support.Source: §3.4 · p. 6
• Step 1 retains 78 parent techniques, ranking T1059 and T1190 first and second; T1059.003 receives a preservation probability of 0.7661.The example assigns T1190 a preservation probability of 0.4786.Source: §3.4 · p. 7
• After reranking, T1059 remains first and T1190 second, while manual analysis identifies T1059 as the best match for the vulnerability’s command-interpreter behavior.Step 2 combines structured evidence features with projected CVE–technique semantic interactions.Source: §3.4 · p. 7

4.1 Datasets

• Steps 1 and 2 train on KEV, ATCM, and ENISA, while CVE2Attack, SMET, and CGVM are reserved for external evaluation.The experimental protocol deduplicates and splits data at the CVE level, removing CVEs seen in Step 2 training or validation from external evaluation.Source: §4.1 · p. 7, §4.2 · p. 8

4.2 Dataset Overlap Analysis

• ENISA and CGVM share 4,192 CVEs, while KEV shares only 9 with ENISA and 40 with CGVM.Of the KEV overlaps, none with ENISA and only 3 with CGVM share at least one parent-level technique label.Source: §4.2 · pp. 7–8
• ATCM and CVE2Attack share at least one parent-technique label for 99.61% of overlapping CVEs, and identical label sets for 79.38%.For ENISA and CGVM, the corresponding proportions are 88.84% and 1.41%.Source: §4.2 · p. 8, Figure 5 · p. 8
• Cross-dataset performance reflects both model generalization and differences in annotation scope and labeling criteria.The same CVE can receive different ATT&CK labels across datasets, making a candidate positive in one dataset and negative in another.Source: §4.2 · p. 8

4.3 Evaluation Design

• The evaluation asks whether candidate pools preserve relevant techniques, reranking improves ordering, restriction helps controllability, and TRACE compares favorably with baselines.Ranking measures include NDCG@10, MRR, and Hit@10.Source: §4.3 · p. 8

4.3.1 RQ1: Candidate Pool Quality.

• With τ=0.90, Step 1 reduces the 201-technique search space by approximately 60% while retaining at least one ground-truth technique for 95.11%–100% of CVEs.Full coverage is lower than partial coverage on ENISA and CGVM, where dense multi-label annotations average 8.03 and 5.48 ground-truth techniques per CVE, respectively.Source: §4.3.1 · p. 8, Table 3 · p. 8

4.3.2 RQ2: Reranking Performance across Datasets.

• Step 2 improves all five ranking metrics on five of six datasets using the same candidate pools, but NDCG@10 and Hit@10 decline on SMET.NDCG@10 rises from 0.3236 to 0.6042 on KEV and from 0.2912 to 0.5449 on ATCM; SMET's results are attributed to sensitivity to annotation semantics.Source: §4.3.2 · pp. 8–9, Table 4 · p. 9

4.3.3 RQ3: Effectiveness of Candidate-Pool Restriction.

• Restricting LLM mapping to Step 1 candidates improves all ranking metrics for both evaluated LLMs on KEV.For GPT-4o-mini, NDCG@10 rises from 0.3553 to 0.5172, MRR from 0.5236 to 0.6767, and Hit@10 from 0.6959 to 0.9155.Source: §4.3.3 · p. 9

4.3.4 RQ4: Comparison with Baselines.

• TRACE achieves the best performance across all five metrics on KEV and CVE2ATT&CK, while the SMET baseline performs best on SMET.On KEV, TRACE's NDCG@10 is 0.6042 versus 0.5627 for TRIAGE; on CVE2ATT&CK, TRACE's NDCG@10 is 0.4268 and Hit@10 is 0.7457. On SMET, the SMET baseline's NDCG@10 is 0.5777 versus 0.4399 for TRACE.Source: §4.3.4 · p. 9

4.4 Ablation Study

• The ablations remove Step 1 retrieval branches, Step 2 interaction and candidate features, and individual evidence sources, while also testing long-tail generalization.The study includes robustness checks with frozen model checkpoints.Source: §4.4 · p. 9

4.4.1 Ablation Study of Step 1.

• Removing the structural retrieval branch causes the largest coverage loss; on CVE2Attack, Label Coverage falls from 0.8988 to 0.5045 and Partial Coverage from 0.9511 to 0.5989.The structural branch supplies most candidate recall, while the semantic branch adds complementary, dataset-dependent evidence and recovers some candidates absent from structural paths.Source: §4.4.1 · p. 9, Table 6 · p. 10

4.4.2 Ablation Study of Step 2.

• Removing SecRoBERTa textual interactions reduces NDCG@10, Hit@5, and Hit@10 across all six datasets, though MRR and Hit@1 can improve on ENISA.On KEV, NDCG@10 falls from 0.6042 to 0.3433; on ENISA, Hit@10 falls from 0.8872 to 0.6652 even as MRR rises from 0.3395 to 0.3434.Source: §4.4.2 · p. 10, Table 7 · p. 10
• Removing Step 1 evidence lowers Hit@5 and Hit@10 across all six datasets, but on ENISA its removal improves NDCG@10 from 0.3097 to 0.3526 and Hit@1 from 0.1234 to 0.2712.On SMET, removing Step 1 evidence lowers NDCG@10 from 0.4399 to 0.3377 and Hit@10 from 0.7741 to 0.6444.Source: §4.4.2 · p. 10, Table 7 · p. 10
• Across all six datasets, textual interactions and Step 1 evidence consistently improve Hit@5 and Hit@10, while textual interactions contribute more consistently to NDCG@10.The effects on MRR and Hit@1 are mixed, particularly on ENISA.Source: §4.4.2 · p. 10

4.4.3 Performance on Missing Evidence.

• With both CWE and CVSS unavailable, macro-average Partial Coverage falls by 3.17 percentage points and Hit@10 falls from 0.8571 to 0.7570.The decline in Full Coverage is larger, at 14.76 points; removing CVSS reduces macro-average Hit@10 from 0.8571 to 0.7922.Source: §4.4.3 · p. 10, Table 8 · p. 11

4.4.4 Performance on Long-Tail Techniques.

• Step 1 retains many Tail and Unseen techniques across three external datasets, but ranking performance degrades markedly for rare techniques.Tail Partial Cov. is 0.9238, 0.9813, and 0.8643 on CVE2Attack, SMET, and CGVM; Unseen Partial Cov. is 0.7000, 1.0000, and 0.8185, respectively. Head, Medium, Tail, and Unseen groups are defined by training counts of >50, 20–50, 1–19, and zero.Source: §4.4.4 · p. 11, Table 9 · p. 12

• At τ=0.50 to 0.60, Label Coverage rises from 0.8367 to 0.8453 and Full Coverage from 0.7015 to 0.7164, while Partial Coverage stays 0.9776.Coverage saturates beyond τ=0.60; the authors adopt τ=0.90, with candidate-pool size bounded by Kmax=80.Source: §4.5 · p. 12
• On ATCM, Hit@10 rises from 0.8933 at λfreq=0.00 to 0.9067 at 0.10, then falls to 0.8667 at 0.20; KEV Hit@10 stays 0.9661.The authors adopt λfreq=0.10 as moderate frequency regularization.Source: Table 11 · p. 12, §4.5.2 · p. 12
• Ranking varies moderately without consistent gains as γ increases; KEV Hit@10 is 0.9661 for margins ≥1.00, while ATCM peaks at 0.9067 for γ=1.00.The authors adopt γ=1.00 as a unit-margin constraint in the supervised pairwise loss; it is not used during inference.Source: Table 12 · p. 12, §4.5.2 · p. 12

• TRACE reduces the 201-technique search space by approximately 60% while retaining at least one ground-truth technique for 95.11%–100% of CVEs across six public datasets.The authors describe the framework as a reusable design for integrating heterogeneous, incomplete, and inconsistent data sources to infer implicit relationships.Source: §5 · p. 12