arXiv CSopen access

FixV2W: Correcting Invalid CVE-CWE Mappings with Knowledge Graph Embeddings

2026 · arxiv_cs

arXiv CS · Papers · License: Open Access · 2026

cryptography cybersecurity privacy security

cryptography, security, privacy, cybersecurity

FixV2W: Correcting Invalid CVE-CWE Mappings with Knowledge Graph Embeddings ŞEVVAL ŞIMŞEK, Boston University, USA VARSHA ATHREYA, Boston University, USA DAVID STAROBINSKI, Boston University, USA Accurate mapping between Common Vulnerabilities and Exposures (CVE) and Common Weakness Enumeration (CWE) entries is critical

arXiv:2604.22176v1 [cs.CR] 24 Apr 2026

for effective vulnerability management and risk assessment. However, public databases, such as the National Vulnerability Database (NVD), suffer from inconsistent and incomplete CVE–CWE mappings, complicating automated analysis and remediation. We introduce FixV2W, a lightweight approach that leverages knowledge graph embeddings and longitudinal trends to improve mapping accuracy of the NVD. FixV2W systematically analyzes historical remapping patterns and leverages hierarchical relationships within NVD and CWE data to predict more precise CWE mappings for vulnerabilities linked to Prohibited or Discouraged categories. We run extensive experimental evaluation of FixV2W, based on test data set collected between August 2021 and December 2024. Considering the Top-10 ranked predictions, the results show that FixV2W predicts the correct CWE mappings for 69% of exploited vulnerabilities that had invalid CWEs before they were exploited. We also show that FixV2W significantly improves the performance of ML models relying on NVD data. For instance, for a model geared at uncovering unknown CVE-CWE mappings, FixV2W improves the Mean Reciprocal Rank (MRR) from 0.174 to 0.608. These results show that FixV2W is a promising approach to identify and thwart emerging threats. CCS Concepts: • Security and privacy → Vulnerability management; • Computing methodologies → Learning in probabilistic graphical models. Additional Key Words and Phrases: Vulnerability, Relations, Weakness, Knowledge Graphs, Embedding ACM Reference Format: Şevval Şimşek, Varsha Athreya, and David Starobinski. 2026. FixV2W: Correcting Invalid CVE-CWE Mappings with Knowledge Graph Embeddings. 1, 1 (April 2026), 32 pages. https://doi.org/10.1145/nnnnnnn.nnnnnnn

Introduction Threat databases, such as Snyk Vulnerability Database [48], Open Source Vulnerabilities (OSV) Database [20], and

others [31, 44], play a critical role in the software security ecosystem by providing structured, actionable information about known vulnerabilities, threats and mitigation strategies [28]. Collectively, these databases support vulnerability management, threat detection, risk prioritization, and the development of more secure software. While there exist many commercial and proprietary vulnerability databases, the National Vulnerability Database (NVD) remains the central source of vulnerability information that many tools and other databases [20, 31, 44, 48] rely on. The public availability and widespread usage of the NVD make it a foundational component of cybersecurity practices, offering Authors’ Contact Information: Şevval Şimşek, Boston University, Boston, USA, [email protected]; Varsha Athreya, Boston University, Boston, USA, [email protected]; David Starobinski, Boston University, Boston, USA, [email protected]. Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. Copyrights for components of this work owned by others than the author(s) must be honored. Abstracting with credit is permitted. To copy otherwise, or republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. Request permissions from [email protected]. © 2026 Copyright held by the owner/author(s). Publication rights licensed to ACM. Manuscript submitted to ACM Manuscript submitted to ACM

Şimşek et al.

standardized data formats, severity metrics, and consistent identifiers. This ensures interoperability among security tools, facilitates vulnerability management workflows, and promotes transparency across the cybersecurity ecosystem. The NVD [39] serves as a key resource by providing additional information (called enrichment metadata) for Common Vulnerabilities and Exposures (CVEs) [34], including mappings to Common Weakness Enumeration (CWE) [32], Common Platform Enumeration (CPE) [40] and CVSS (Common Vulnerability Scoring System) [19] scores. This structured metadata allows automated tools and security teams to assess and prioritize vulnerabilities effectively. In particular, CWE mappings provide critical insight into the root causes of vulnerabilities, allowing developers and analysts to better understand and prevent recurring classes of security issues [46]. Understanding and resolving a software flaw related to a weakness helps resolving a host of CVEs that emerges from this flaw. Early identification of weaknesses that may cause vulnerabilities allows software developers, hardware engineers, and security architects to resolve them early in the development process [10], even before they become actual vulnerabilities and exploits. Over time, the reliance on the NVD has revealed significant shortcomings. As vulnerability disclosures have surged both in volume and complexity, the NVD has struggled to keep up. The total CVE count rose from under 100,000 in 2015 to over 150,000 in 2020. and over 300,000 CVE in 2025. Since February 2024, only 58% of CVEs added to the NVD have CWE mappings. This pause propagated until mid-2025 and is ongoing, resulting in almost half of new CVEs each month missing enrichment metadata (CPE, CWE, CVSS). Although the NVD has announced its intention to restore its prior operational pace [15], the delay and uncertainty have left developers and security teams in the dark for extended periods. Despite the focus on recent disruptions caused by the enrichment pause back in February 2024, long-standing structural and operational issues with CVE metadata have persisted. Through a longitudinal analysis, revealed in this paper, we identify a largely overlooked problem within the NVD. Specifically, our evaluation of NVD entries as of December 2024 finds that 55% of all CVEs in the NVD are mapped to invalid CWEs. Invalid CWEs refer to entries that are Prohibited, Discouraged, or serve merely as placeholders (e.g., CWE-Other, CWE-noinfo), as shown in Figure 1. The Prohibited and Discouraged categories, introduced by MITRE in 2019, limit the use of overly generic or non-actionable CWE tags that lack diagnostic value. However, despite efforts to phase them out, our data shows that 5% of CVEs submitted since 2019 still use Discouraged CWEs, indicating ongoing problems with mapping quality. Invalid mappings reduce the value of vulnerability databases by obscuring the true root causes of vulnerabilities, limiting the ability of security teams to detect attack patterns and hindering the design of effective mitigation strategies. Thus, poor understanding of the root cause of a vulnerability may result in the CVE being exploited in the wild. Indeed, focusing on CVEs that were added to the Known Exploited Vulnerabilities (KEV) list [1] between August 2021 and December 2024, we find that 99 of them were originally mapped to Discouraged or Prohibited CWE. Furthermore, 95 out of these 99 exploited vulnerabilities were remapped to the correct CWE only after the exploit was revealed. The issue is particularly critical given the widespread reliance of open-source developers, security researchers, and automated tools on the NVD as the primary source of structured vulnerability data. Our Contributions. In this work, we address the problem of automatically correcting the large number of Prohibited and Discouraged CVE-CWE mappings in the NVD, through the combination of longitudinal analysis and knowledge graph reasoning. First, to inform our predictions, we systematically analyze the National Vulnerability Database (NVD), showing that Prohibited mappings make up to 5% of all mappings in the NVD, and Discouraged CWE mappings make up to 12%. Through a longitudinal analysis of CVE-CWE mapping updates between 2016 and 2024, we observe that 84% of remaps remain within the same CWE branch, often only one to two hops away within the CWE hierarchy, with a maximum of 4 Manuscript submitted to ACM

FixV2W: Correcting Invalid CVE-CWE Mappings with Knowledge Graph Embeddings

Valid CWE

Invalid CWE Fig. 1. The proportion of invalid mappings versus valid CVE-CWE mappings among 280,000+ CVEs (as of December 17, 2024). The diagram shows that valid mappings currently represent fewer than half of the entries in the National Vulnerability Database (NVD).

hops connected by ChildOf/ParentOf relationship. For CWEs that are Prohibited (i.e Categories or Views), we discover that the replacing CWEs are often a member of the original Category or View. Building on these insights, we construct a knowledge graph ontology that integrates CVEs, CWEs, and CPEs as interconnected entities linked by relationships (the ontology of a knowledge graph is a structured framework that defines the types of entities, their properties, and the relationships between them). Using graph embeddings trained on this structure, we introduce FixV2W, a novel method that predicts allowed CWE candidates for vulnerabilities currently mapped to Prohibited or Discouraged entries. FixV2W uses only graph connections and does not require semantic information, thus providing a lightweight, scalable, and fast prediction model. We test FixV2W on six different candidate sets: CWE-1003 for baseline, CWE Top-25 list as considered in other studies [2, 4], and four candidate entity sets informed by our longitudinal study. For Discouraged mappings, we constrain predictions to children or siblings in a CWE branch; for Prohibited category/view remaps, we extract valid member CWEs and their descendants and fill in with nearest neighbors from the ontology when the size of the candidate entity set is too small, to reach a sufficient number of candidates. Our model is validated under an open-world assumption (OWA) which is generally considered more realistic than the closed-world assumption (CWA) predominantly used in the evaluation of knowledge graphs [49]. Specifically, we validate FixV2W using real-world corrections applied on the NVD between August 2021 and December 2024, treating updated CWE remaps as ground truth. We evaluate our model’s Top-10 CWE predictions on three levels of coverage metrics; exact match (correct CWE mapping from the NVD), fine-grain match (a directly related CWE in the same branch i.e. a parent or a child) and coarse grain match (any descendant from the same branch root). We show how the fixed NVD dataset, obtained after applying FixV2W on the original NVD dataset, improves the accuracy of ML models relying on the NVD. In particular, replacing Prohibited/Discouraged mappings with the Top-2 predictions obtained from FixV2W significantly improves the performance of graph completion models. We further analyze CVEs belonging to the Known Exploited Vulnerabilities Catalog [1] and Exploit DB list [42] and show that since August 2021, 190 CVEs were mapped to Prohibited or Discouraged CWEs. Our model is able to correctly predict the root cause for 131 of them, which means that FixV2W could have correctly identified the underlying weaknesses and possibly prevented these CVEs from being exploited. Our contributions can therefore be summarized as follows: Manuscript submitted to ACM

Şimşek et al.

• We conduct the first large-scale longitudinal analysis of NVD CVE–CWE mappings, revealing that more than half are invalid but systematically linked to correct CWEs through hierarchical structures. • We identify structural patterns in CWE remaps, showing that Prohibited mappings typically resolve to member CWEs, while Discouraged mappings remain within nearby branch relationships. • We propose FixV2W, a lightweight and deterministic knowledge-graph embedding method that leverages CVE–CWE–CPE connectivity without requiring semantic features to correct invalid mappings. • We propose and correct different sets of candidate entities for correcting the invalid CVE-CWE mappings, validating our results with correct labels taken from updated mappings in the NVD. • We validate our approach using real-world CWE remaps under an open-world assumption( OWA), and showcasing our model’s performance on predicting correct mappings for CVEs with exploits. • We show that the knowledge graph embedding model retrained with the top CWE labels returned by FixV2W significantly outperforms the original model in predicting unseen CVE-CWE triples (currently unknown, but revealed in the future), demonstrating the effectiveness of FixV2W in improving existing ML models based on NVD data. The rest of this paper is organized as follows. Section 2 discusses related work. Section 3 explains core concepts and terminology, and present the findings of our longitudinal analysis. In Section 4, we introduce the FixV2W method, and detail its properties. We present our implementation and evaluation methodology in Section 5. In Section 6, we present our results and evaluation, followed by a discussion in Section 7. This section also discusses limitations and threats to validity. We conclude the paper in Section 8. The software implementation of FixV2W and other artifacts can be found in our GitHub repository [47]. 2

Related Work Knowledge graphs (KGs) are used in many domains, including medicine, history, and cybersecurity. A common issue

across these domains is when the knowledge graph has missing or incorrect data. To address this issue, several studies focused on error detection and repair in knowledge graphs. For instance, Akasiadis et al. [3] develop an open-source system for detecting and fixing formal inconsistencies in large real-world knowledge graphs. They integrate and extend state-of-the-art approaches for parallel KG inconsistency detection and fixing in a single framework. Similarly, Arioua et al. [7] suggest a platform employing user-guided repair techniques for knowledge bases that enable user-suggested updates to resolve errors. The basic idea is that the knowledge base asks questions about possible fixes, and the user selects the correct ones until a consistent knowledge base is achieved. Although such an approach is possible, the volume of invalid data in the NVD and complexity of our knowledge graph makes it infeasible due to the required effort. Arnaout et al. [8] suggest a method that repairs incorrect statements in KGs by replacing incorrect subject-predicateobject triples with likely correct ones, thus avoiding information loss. Although effective, the model relies on textual summaries that create a large overhead, unlike the lightweight knowledge graph used in FixV2W. In [43], the authors propose to repair Wikidata using its edit history. The paper proposes a deep learning model that exploits edits that removed inconsistent triples in the past, to infer similar corrections in the present. This approach relies on a rich and diverse edit history, which does not exist in our case since very little corrections have been applied in the NVD, especially for Prohibited CWEs. Analyzing the NVD has attracted considerable research attention. Some studies focus on CVSS accuracy [24, 50] or missing metadata [21, 26], while others examine the overall viability of open-source vulnerability data [17, 22] and the Manuscript submitted to ACM

FixV2W: Correcting Invalid CVE-CWE Mappings with Knowledge Graph Embeddings

completeness of related information. Overall, each of these studies points out issues in the NVD data such as incorrect CPE identifiers, missing or wrong CVSS vectors and scores and suggest that the NVD needs to undergo a structural change to prevent such inconsistencies. Highlighting the issues that affect ML model accuracy, Zhang et al. [51] present a model to predict zero-day vulnerabilities using the NVD and identify limitations such as missing version information, data errors, and delays in release times. We conclude from their findings that correcting errors in the NVD is a necessary step for building predictive models. Moreover, a 2023 study by Croft et al. [14] found that between 20% and 71% of vulnerability labels in real-world datasets are inaccurate. Anwar et al. [6] assess the quality of the NVD, addressing incorrect vendor information and vulnerability publication dates that affect CVSS scores. They develop an automation tool to correct these errors. While they examine missing or incorrect CVE entry information, we focus on relationships between CVE and CWE entries. Nguyen et al. [38] study vulnerabilities in Google Chrome, revealing that many originated from early versions and highlighting errors in vulnerability data. This supports our assertion that CVE-CPE mappings can be flawed, leading to incorrect enrichment metadata. Kühn et al. [26] apply machine learning and NLP to improve the NVD’s information quality, focusing on the atomic accuracy of CVE entries (e.g., security-relevant tags and the CVSS score). In contrast, we analyze the NVD with a focus on the root causes of the vulnerabilities (namely their weaknesses), and correcting mappings between CVEs and CWES. Collectively, researchers agree that these issues cause significant impacts on downstream models, either preventing effective model training or inflating benchmark performance. There are also several studies automate CVE to CWE mappings using various machine learning techniques, such as natural language processing (NLP), neural networks, knowledge graphs, and large language models (LLMs). ThreatZoom [2] uses a hierarchical neural network and reports strong coarse-grain classification results. However, their evaluation is on unclassified CVEs using expert-annotated validation sets. FixV2W, on the other hand, focuses on correcting invalid mappings across the full NVD and achieves a 50% exact match rate on the combined test set of Prohibited and Discouraged CWE mapping correction. CVE2CWE [4] relies on TF-IDF similarity, testing against only 50 CWEs from the 130 in CWE-1003, and lacks validation, leading to weaker accuracy compared to our graph-based method. Shi et al. [45] apply various KG models to the problem of CVE-CWE-CPE graph completion. We build on this insight, but further improve precision through graph-based candidate selection and by learning from the NVD’s remapping history. VulnScopper [5] applies the ULTRA foundation model, enhanced with OpenAI’s Ada LLM, for the same type of graph completion. Its performance depends on a multi-stage architecture with heavy reliance on LLM-generated semantics. In our paper, we show that after applying FixV2W on the NVD, it is possible to achieve similar accuracy without requiring complex semantic models. CWE-GPT [29], developed by MITRE’s CyberSecAI initiative, is a grounded LLM-based system designed to improve CWE mapping for CVEs. It combines retrieval-augmented generation with enriched CVE data and CWE ontology to reduce hallucinations and enhance accuracy. The tool supports both interactive use and bulk processing, with open-source components available. Evaluated on a large CVE dataset, CWE-GPT achieves high recall but lower precision with 95.85% of CVEs with at least one CWE match and precision score of 0.10 [13], reflecting its focus on generating comprehensive candidate CWE lists. In contrast, FixV2W focuses on fixing existing, invalid mappings. A key advantage of FixV2W is to offer deterministic and interpretable results, as it does not depend on LLMs. Finally, Mittal et al. [37] develop Cyber-All-Intel, a cybersecurity knowledge graph used to link threat actors, software, and vulnerabilities. Cyber-All-Intel demonstrates that structured threat intelligence can be automatically constructed and made queryable, facilitating more effective threat hunting and situational awareness. However, while it incorporates Manuscript submitted to ACM

Şimşek et al.

CVE and CWE data, the system focuses on entity extraction and graph construction—not on correcting or validating vulnerability mappings. To the best of our knowledge, our work is the first that specifically targets the correction of invalid CWE mappings in the NVD. While other efforts focus on assigning new CWEs or classifying unmapped CVEs, FixV2W is designed to fix existing erroneous mappings by leveraging both the structure of the CWE ontology and observed mapping evolution over time. An earlier and shorter version of this paper appeared in [52]. The main novel contributions of the journal version with respect to the conference version include: a more detailed presentation of the FixV2W method and thorough characterization of its properties; much more extensive evaluation of the performance of FixV2W including with different candidate entity sets, and with exploited CVEs; demonstration of how ML models relying on the NVD can be improved; extensive discussion of the findings, evaluation methods, and limitations of our work. 3

Background and Longitudinal Analysis of the NVD This section reviews key concepts related to the NVD, CVE, CWE, and associated terminology, followed by a

longitudinal analysis of NVD data that informs the design of FixV2W. 3.1

The National Vulnerability Database and data quality

The National Vulnerability Database (NVD) is the U.S. database of vulnerability management data and serves as the central source of vulnerability information for many other databases and tools. This database enables automation of vulnerability management, security measurement, and compliance. The NVD includes CWE identifiers representing software security flaws, product names in CPE format, and impact metrics such as CVSS scores in its CVE metadata. The NVD has been operating on the enrichment of publicly disclosed vulnerabilities with the help of Certified Numbering Authorities (CNAs). CNAs are verified submitters of vulnerabilities that report on behalf of themselves and others. The NVD relies on Certified Numbering Authorities (CNAs), organizations such as Apache, Red Hat, and Microsoft, which submit and enrich vulnerability reports with CWEs, CPEs, and CVSS scores. Given the volume of vulnerabilities submitted, the NVD team struggles to keep up with vulnerability enrichment, which negatively affects security analysis efforts. It was reported in [12] that many CVEs are already exploited by the time they make it into the database, with 14% of the exploits being zero-day vulnerabilities and 80% of public exploits being published before the CVEs are. These challenges underscore the urgent need for automated vulnerability analysis to speed up the process and increase the accuracy of vulnerability records. Current efforts to automate this process struggle from low quality of vulnerability data, therefore it is critical to fix incorrect mappings in these databases. 3.2

CVE, CWE and mapping metadata

The Common Vulnerabilities and Exposures (CVE) [34] is a system developed by MITRE to catalog publicly known vulnerabilities. Each newly reported vulnerability receives a unique CVE ID. Submissions are typically made by a Certified Numbering Authority (CNA), who is often the vendor responsible for the affected product or a researcher/individual submitting vulnerabilities through established reporting processes. The Common Weakness Enumeration (CWE) [32], also managed by MITRE, is a classification system for software and hardware weaknesses that can lead to vulnerabilities under certain conditions. Each CWE entry is assigned a CWE ID, which may refer to a specific weakness, a broader category, or a view.

Manuscript submitted to ACM

FixV2W: Correcting Invalid CVE-CWE Mappings with Knowledge Graph Embeddings

Table 1. CWE-189 “Numeric Errors” category, and its members that are allowed CWE. The CWE in bold are included in the CWE-1003 view, and are used for root cause mapping of CVEs by the NVD.

Allowed CWE CWE-128 CWE-190 CWE-191 CWE-193 CWE-369 CWE-681 CWE-839 CWE-1135 CWE-1139 CWE-1389

CWE-189 “Numeric Errors” Category Members Wrap-around Error Integer Overflow or Wraparound Integer Underflow (Wrap or Wraparound) Off-by-one Error Divide By Zero Incorrect Conversion between Numeric Types Numeric Range Comparison Without Minimum Check Incorrect Bit-wise Shift of Integer Insufficient Precision or Accuracy of a Real Number Incorrect Parsing of Numbers with Different Radices

Category and View. Categories are groups of related weaknesses that share a common trait. A category is not a weakness, but rather a structural item that helps users find weaknesses that share the stated common characteristic. Currently, the CWE database lists 374 categories, though some are empty or obsolete. Views are a subset of CWE entries that provide a way of examining CWE content. Views organize weaknesses based on different criteria, such as inclusion in an annual CWE Top-25 list curated by MITRE, which lists the most common and dangerous CWE in the past year(s) [36]. Currently, 51 views exist, each serving different purposes. In our work, we focus on the CWE-1003 view: Weaknesses for Simplified Mapping of Published Vulnerabilities since it is being used by the NVD for root cause mapping of vulnerabilities. This view was first curated in 2016 and ever since, NVD exclusively maps CVEs to CWEs belonging to this view. An example category, CWE-189: Numeric Errors, is shown in Table 1 along with the members of this category. Prohibited and Discouraged Tags. Prior to 2019, any type of CWE could be used to describe the root cause of a vulnerability. Since then, MITRE has introduced the Prohibited and Discouraged tags: • Prohibited CWEs (such as categories and views, and deprecated entries) are no longer allowed for root cause mapping because they do not represent valid weaknesses; instead, they serve as collections of related CWEs. Table 1 gives an example of a category and its associated members. • Discouraged CWEs are weakness entries that are often too broad to clearly explain the root cause of a vulnerability. CNAs are urged to use more specific CWE entries whenever possible to more accurately reflect how a vulnerability was introduced. These two classes of invalid CWE mappings affect the mapping data and create confusion in the ontology, therefore we aim in this work to correct those CVE that are mapped to Prohibited or Discouraged CWE, whenever possible. We use the results from our longitudinal analysis to inform the predictions, rather than blindly querying for the entire CWE database, or the CWE-1003 view. We present comparisons of the prediction performance with each of these candidate entity sets and rationale for using them in Section 4.3. The CWE-1003 view. NVD uses the CWE-1003 view for providing root cause information to CVEs. The CWE-1003 view has stayed the same while the number of CWE expanded, therefore this list has obvious shortcomings. The CWE-1003 view, finalized in 2019, contains 130 CWEs but hasn’t kept pace with the expanding CWE database (940+ entries), leading to frequent use of placeholder CWEs like CWE-Other and CWE-noinfo in over 25% of CVEs as of 2025.

Manuscript submitted to ACM

Şimşek et al.

CWE-707: Improper Neutralization

Class Allowed

Base Allowed

CWE-228: Improper Handling of Syntactically Invalid Structure

CWE-229: Improper Handling of Values

Pillar Discouraged

CWE-138: Improper Neutralization of Special Elements

...

Class Discouraged

CWE-140: Improper Neutralization of Delimiters

Base Allowed

Fig. 2. A slice of the CWE Hierarchy, showing parent-child relationships. CWE-707 and CWE-138 are both labeled Discouraged by MITRE for CVE root cause mapping, due to lack of detail. Weaknesses are at deeper levels of the hierarchy are more detailed.

The CWE structure is hierarchical, where entries may be related with Parent/Child relationships, which shows weaknesses at different levels of abstraction. Typically, a CWE hierarchy starts with a Pillar, followed by a less general Class or Base weakness, and ends with the most detailed Variant weakness [35]. All Pillar type CWEs and some of the Class type CWEs are Discouraged for CVE mapping. Some hierarchies do not include variants, but almost all include Class and Base. Figure 2 illustrates an example of this hierarchy. 3.3

Longitudinal analysis of the NVD

Longitudinal analysis is a tool that aids in understanding how patterns evolve over time, revealing trends that persist or changes that are introduced [16]. We conduct a longitudinal analysis to understand how the mapping behavior of CVE root causes changed over time and what trends we can learn from the NVD. In the following, we present our results and key takeaways obtained by the longitudinal analysis including providing insight on how to curate the candidate sets for informed prediction of correct CVE-CWE mappings. Discouraged and Prohibited CWE Mappings. We record the total number of Discouraged and Prohibited mappings over time, recovering the state of the NVD at each year using the NVD CVE Change History API. Figure 3 reveals the cumulative count of Discouraged and Prohibited mappings at the end of each year since 2004. Our analysis reveals a steady number of Prohibited mappings (about 16,000 since 2018) and a growing number of Discouraged mappings (exceeding 55,000 in 2025). The use of CWE-Other and CWE-noinfo. A total of 4000 updates between July 2016 and December 2024 were remaps into CWE-noinfo. In fact, Figure 4(a) shows that among the Top-three CWEs used to provide root cause mappings to CVEs, CWE-noinfo ranks second. This clearly shows that the CWE-1003 view falls short in covering all types of CWEs, and officials must update the list to cover more representative CWEs. Ever since the CWE-1003 was last updated in 2019, more than 70 new CWEs have been added to the CWE database. Commonly misused CWEs. Figure 4(b) shows that certain CWEs are more often misused, in particular CWE-119, CWE-200, CWE-20 and so on. All of these CWEs are now labeled as Discouraged for vulnerability mapping since they lack specificity, as do not say much about the root cause of a CVE. Although some CWEs are misused often, they cannot Manuscript submitted to ACM

Number of CVE-CWE mappings

FixV2W: Correcting Invalid CVE-CWE Mappings with Knowledge Graph Embeddings

Discouraged Prohibited

50, 000 40, 000 30, 000 20, 000 10, 000

24 20

18 20

16 20

12 20

10 20

08 20

Year

(a) Most occurring newly mapped CWEs between 2016-2024. From left to right, the Top-3 CWE are CWE-79: Improper Neutralization of Input During Web Page Generation (’Crosssite Scripting’), CWE-787: Out-of-bounds Write and CWE 119: Improper Restriction of Operations within the Bounds of a Memory Buffer.

200

CWE-287

CWE-400

CWE-noinfo

CWE-269

CWE-284

CWE-77

CWE-Other

CWE-20

0 CWE-200

CWE-416

CWE-352

CWE-125

CWE-200

CWE-20

CWE-89

CWE-119

CWE-787

CWE-79

400

CWE-119

2,000

Num. of mappings to CVE

4,000

CWE-noinfo

Num. of mappings to CVE

Fig. 3. Cumulative counts of Prohibited and Discouraged mappings over time. Although Prohibited Mappings slightly decrease over time, Discouraged CWE-CVE mappings are increasing.

(b) Most removed CWEs between 2016-2024, from left to right, Top-3 are CWE 119: Improper Restriction of Operations within the Bounds of a Memory Buffer, CWE-200: Exposure of Sensitive Information to an Unauthorized Actor, and CWE 20: Improper Input Validation.

Fig. 4. Longitudinal analysis between 2016-2024 reveals the most remapped CWE, showing (left) certain CWE were added that include more detail and (right) certain more general CWE were removed from mappings more often.

be excluded from the candidate sets because they appear often in the newly mapped CVEs, as shown in Figure 4(a). Furthermore, NVD allows use of these CWE in root cause mapping, when a more detailed alternative is not available, thus they cannot be avoided completely. We present and evaluate our approach for fixing invalid CWEs in Section 4.

Manuscript submitted to ACM

Şimşek et al.

10 2 Hops 1 Hop 46.4%

14%

16.1% 20.8%

3 Hops

2.7%

No Path 4 Hops

Fig. 5. Distance between old CWEs and new CWEs in CVE-CWE mapping updates, between 2016-2024. Most remaps end up in CWEs that are just a few hops away, informing the design of FixV2W.

Updated CWE mappings that are related. Among the CVE remaps to valid CWEs, 60% result in a new CWE that is at most two hops away from the original, and over 80% remain within the same branch of the CWE hierarchy. Figure 5 shows the distance between old CWE and new CWE pairs remapped between 2016 and 2024. Most corrections are minor (one or two hops in the hierarchy), meaning a direct child is the most likely candidate for the correction of a Discouraged CWE. Distance is measured in any direction, and includes going up to the starting CWE’s parent and then going down to another descendant. It is important to take into consideration such cases when searching for good candidates for CWE correction task in FixV2W. Exceptions exist and complicate full automation, and in those cases expert analysis plays a crucial role. This suggests that the correct CWE is often reachable from the original incorrect mapping by traversing related weakness chains, typically moving from a broader (parent) CWE to a more specific descendant CWE within the same branch. Table 2 shows the most observed remap pairs. Strikingly, 38% of remaps are just removals of old CWEs and replacing them with CWE-noinfo. Yet for the remaining 62% of remaps, most stay within the same CWE chain or are a member of the old CWE category (if the said CWE category has any members at all.) Summary. Our longitudinal analysis of the NVD indicates that while CNAs have occasionally corrected CWE mappings over time, such updates remain relatively rare. We identified several trends in these remaps, which inform our approach to select candidate entities for each type of invalid CWE mapping. For example, when a CVE is originally mapped to CWE-189: Numeric Errors, it is often more effective to search within the members of that category rather than across the entire CWE-1003 view. However, this trend is not universal. In some cases, the initial mapping is substantially unrelated to the true root cause, complicating correction. Some invalid mappings are significantly misaligned with the actual root cause. For instance, CVE-2021-0572 was initially assigned CWE-287: Improper Authentication, whereas the correct weakness, later updated in the NVD, is CWE-732: Incorrect Permission Assignment for Critical Resource. Guided by these observations, we developed the FixV2W algorithm, presented in the next section, to search for corrected CWE mappings within the same branch or among members of the same category and view. 4

FixV2W: Automated Prediction and Correction of CVE-CWE mappings In this section, we present FixV2W, a lightweight and structured approach to correct CVE–CWE mappings. FixV2W is

a prediction model that uses a knowledge graph (KG) embedding approach to infer correct mappings for vulnerabilities Manuscript submitted to ACM

FixV2W: Correcting Invalid CVE-CWE Mappings with Knowledge Graph Embeddings

Table 2. The most observed Old CWE to New CWE pairs for the same CVE Record, that were updated between 2016 and 2024. Pairs are either in the same chain for valid CWE, or the new CWE is a member of the old CWE category, if the category has any members.

CWE ID Pair CWE-Any - CWE-noinfo CWE-119 - CWE-787 CWE-77 - CWE-78 CWE-119 - CWE-125 CWE-264 - CWE-732 CWE-255 - CWE-522 CWE-264 - CWE-269 CWE-416 - CWE-787 CWE-190 - CWE-787 CWE-284 - CWE-732 CWE-399 - CWE-772

Occurrences 38% 6% 3% 2% 1% 1% 1% 1% 1% 1% 1%

Same Branch Yes Yes Yes Yes Yes Yes -

Is Member No∗ Yes No∗ Yes

∗ CWE-264: Permissions, Privileges, and Access Controls is a category with no members.

previously linked to invalid CWE entries. We leverage existing historical mapping data along with informed predictions based on CWE hierarchy and known relationships. In our longitudinal analysis of the National Vulnerability Database (NVD), we indeed observed a consistent pattern: invalid mappings, specifically those labeled as Prohibited or Discouraged, are often replaced with more specific descendant CWEs (i.e., Members or Children), or with related weaknesses within the same branch of the CWE hierarchy. We incorporate this observation into our method by intentionally selecting candidate CWE sets that reflect these likely replacements. 4.1

Knowledge Graph Embedding

We begin by outlining the terminology and foundational concepts related to knowledge graph construction and embedding. A Knowledge Graph (KG) is a structured representation of real-world entities and their relationships, where entities are represented as nodes and relationships as edges in a graph. This structure allows for the semantic representation of domain knowledge and supports inference, querying, and reasoning tasks. In our work, entities include CVEs (vulnerabilities), CWEs (weaknesses), and CPEs (systems, software, and packages). Relationships include MatchingCPE, MatchingCWE, and relationships between CWEs like HasMember and ParentOf. Figure 6 illustrates a slice of the knowledge graph. The fundamental unit in a KG is a triple of the form (subject, predicate, object), such as (CVE-2020-17533, MatchingCWE, CWE-252). These triples are used as both the training input for our embedding model and the basis for downstream predictions. Each triple represents a fact in the KG. The embedding model of a knowledge graph transform entities and relations into continuous vector spaces while preserving the graph’s structure and semantics. This enables predictive tasks such as link prediction. In our case, the embedding model is used to predict a more accurate CWE for a given CVE when the existing mapping is invalid or suboptimal. 4.2

Formal Description

For the purpose of our analysis, the list of vulnerabilities in the CVE database training dataset is denoted as 𝑉 = {𝑣 1, 𝑣 2 . . . , 𝑣𝑛 }. The CWE list is denoted as 𝑊 = {𝑤 1, 𝑤 2, . . . , 𝑤𝑘 } and represents the set of all existing CWEs. The NVD’s CWE slice (i.e., the CWE-1003 view) is defined as 𝑊 𝑁𝑉 𝐷 . Clearly, 𝑊 𝑁𝑉 𝐷 ⊂ 𝑊 . We define weaknesses in the invalid CWE list as 𝑊 𝑃 (note that 𝑊 𝑃 can be defined for Discouraged, Prohibited and other reference CWEs separately). The Manuscript submitted to ACM

Knowledge Graph Embedding CVE-202017533

Category

cpe:2.3:a:apach e:accumulo:*:*:*

Matching CWE

cpe:2.3:a:apache..

be r

Matching CPE

CWE-252

CWE-690 Parent Of

CVE-201915900

CVE-202017533

2.5 2

Matching CWE

CWE-690

CWE-389 1.5

Matching CWE cpe:2.3:a:doas_pr oject:doas:

3.5 3

CWE-389

Me m

Matching CPE

Şimşek et al.

CVE-201915900

cpe:2.3:a: doas..

CWE-754

0.5

CWE-754 0 0

0.5

1.5

2.5

Fig. 6. Knowledge Graph ontology example (left) and translation of this ontology to a 2D embedded vector space (right). Nodes that are close in the vector space are more strongly related than those that are far. Color code: CVE nodes (blue), CWE nodes (green), CPE nodes (purple), CWE category and view nodes (orange).

members of this list are 𝑤 ∈ 𝑊 𝑃 . We denote by 𝑉 𝑃 = {𝑣 ∈ 𝑉 } the set of CVEs 𝑣 that are mapped to a Prohibited CWE. For each 𝑣 ∈ 𝑉 𝑃 , we determine a set of CWEs, denoted 𝑊 𝐴 (𝑣), to which 𝑣 is allowed to be remapped. The Predict(𝑐) function in Algorithm 1 is a knowledge graph operation that queries the embedding model with a candidate triple 𝑐 = (𝑣, MatchingCWE, 𝑤), where 𝑤 ∈ 𝑊 𝐴 (𝑣), and returns the score computed for this triple. Then the candidates are ordered based on the scores. It is important to select the candidate list of CWEs 𝑊 𝐴 (𝑣) carefully. Indeed a “popular” CWE, one that many CVEs are mapped to, may end up at the Top-rank, due to its centrality. In the next subsection, we discuss the tradeoffs involved in the selection of candidates and discuss different the pros and cons of different approaches. Through this approach, we demonstrate that strategically reducing the candidate CWE space, guided by the structure of the CWE hierarchy and observed history of corrections leads to significantly better accuracy in correcting invalid CVE–CWE mappings compared to baseline candidate sets (e.g., CWE-1003 and CWE Top-25). The FixV2W algorithm returns the reordered list of CWE candidates 𝑊 𝐴 (𝑣) in descending order of likelihood (based on the scores), with the Top-rank indicating the most probable match. The pseudo-code of this process is explained in Algorithm 1, which outlines the process for ranking the set of replacement candidates for each invalid CVE-CWE mapping. Complexity Analysis of FixV2W. To determine the set of Prohibited (or Discouraged) mappings in line 1, we iterate through mappings in the NVD and determine 𝑉 𝑃 = {𝑣 ∈ 𝑉 }, this is linear complexity and can be expressed as 𝑂 (|𝑉 |). The main loop in lines 3-10 runs for each 𝑣 ∈ 𝑉 𝑃 . The inner loop runs for each 𝑤 ∈ 𝑊 𝐴 (𝑣), where |𝑊 𝐴 (𝑣)| = 𝑂 (|𝑊 |) for each 𝑣 ∈ 𝑉 𝑃 . To determine the candidate set 𝑊 𝐴 = 𝑤 ∈ 𝑉 , we traverse the CWE hierarchy subgraph, which takes 𝑂 (|𝑊 |) in the worst case. Forming a triple 𝑐 = (𝑣, 𝑤) takes constant time for given 𝑣 and 𝑤. We cannot easily express the complexity of the Predict(c) function, since it depends on parameters that are specific to the KG and its embedding model. We will therefore assume that each query takes 𝑂 (𝑇 ) time, where 𝑇 is a function of the KG parameters. In practice, using PyTorch, the runtime of a query is on the order of one millisecond, as shown in Section 5. Therefore, the total complexity for steps 3-10 is 𝑂 (|𝑉 | · |𝑊 | · 𝑇 ). The reordering of the elements of 𝑊 𝐴 (𝑣) in line 11 takes 𝑂 (|𝑊 | · log(|𝑊 |) with high probability,

Manuscript submitted to ACM

FixV2W: Correcting Invalid CVE-CWE Mappings with Knowledge Graph Embeddings

Algorithm 1 FixV2W 1: Determine 𝑉 𝑃 = {𝑣 ∈ 𝑉 } such that CVE 𝑣 is mapped to a Prohibited CWE. 2: procedure FixV2W(𝑉 𝑃 )

for all 𝑣 ∈ 𝑉 𝑃 do: 4: Determine set of allowed CWEs 𝑊 𝐴 (𝑣) for CVE 𝑣 5: for all 𝑤 ∈ 𝑊 𝐴 (𝑣) do: 6: Form candidate triple 𝑐 = (𝑣, MatchingCWE, 𝑤) 7: Calculate score 𝑠 = Predict(𝑐) 8: end for 9: Reorder elements in 𝑊 𝐴 (𝑣) in descending order of the score 𝑠 found for each 𝑤 ∈ 𝑊 𝐴 (𝑣) 10: end for 11: return 𝑊 𝐴 (𝑣) for each 𝑣 ∈ 𝑉 𝑃 12: end procedure 3:

using an efficient algorithm like Quicksort. The total complexity is therefore 𝑂 (|𝑉 |) + 𝑂 (|𝑉 𝑃 | · |𝑊 | · 𝑇 ) + 𝑂 (|𝑊 | · log(|𝑊 |) = 𝑂 (|𝑉 | + |𝑉 𝑃 | · |𝑊 | · 𝑇 + |𝑊 | · log(|𝑊 |)). This complexity is practical, considering the number of CVEs, CWEs, and Prohibited/Discouraged CVE-CWE in the NVD, and the short time needed to run a query. 4.3

Candidate Selection Trials

Effective candidate selection is crucial to achieve a balance between prediction precision and recall. Providing too many candidates dilutes the model focus leading to irrelevant Top-suggestions, while too few candidates risk excluding correct mappings. We next introduce several approaches, which we evaluate in Section 6. A summary of the advantages and limitations of these approaches is provided in Tables 3, 5 and 4. Table 3. FixV2W Baseline Candidate Types with Advantages and Limitations

Candidate Set Type

Advantages

CWE-1003 Baseline

Ensures all possible CWE are evaluated for, Too many candidates introduce some issues increases coverage. such as unrelated but popular CWE ranking high due to node centrality. Captures high-impact, frequently remapped Adds candidates that are not conceptually CWEs that are most often used in root cause relevant, excludes many CWE that are relemapping of CVEs. vant. Also highly affected by node centrality.

CWE Top-25 Overlay

Limitations

4.3.1 Baseline candidate entities. These two candidate entity sets, CWE-1003 view and CWE Top-25 view, are the most general approach and serve the purpose of providing a baseline for the improvements that FixV2W introduces. CWE-1003 view, encompassing all possible CWE for mapping of vulnerabilities in the NVD, increases coverage, while certainly decreasing the concentration of the predictions. We see that there are several CWE with many connections, that appear in the returned result regardless of their relevance, due to their node centrality being very high. Node centrality in a knowledge graph refers to the most ’important’ or influential nodes within the KG, which are determined by having many connections, being on many shortest paths and having connections to other influential entities [18]. Similarly, Top-25 view Manuscript submitted to ACM

Şimşek et al.

14 Table 4. FixV2W Discouraged Set Candidate Types with Advantages and Limitations

Candidate Set Type

Advantages

Limitations

Descendants of old CWE

Drives prediction toward more specific and valid weaknesses, preserves hierarchical relevance. Explores closely related weaknesses under the same parent, increasing chance of capturing the correct mapping within a tight hierarchical scope.

If the original mapping is incorrect, this can constrain the search to the wrong subtree.

Family (Siblings)

May exclude correct CWEs if they lie in a different branch due to NVD misclassifications, too many candidates may confuse the model.

curated each year from the most occurring weakness of the past few years, includes the most influential nodes with high node centrality, while excluding relevant yet less occurring weaknesses from the candidate set. Some examples of central CWE nodes are CWE-79: Cross-site Scripting and CWE-20: Improper Input Validation, which almost always appear at Top-ranks for each CVE that we query for, when using the baseline candidate entity sets. This centrality, while sometimes useful, in our case has a negative effect in the accuracy of the predictions. 4.3.2 CWE Branch Hierarchy. Following the branch hierarchies and our findings from longitudinal studies, for Discouraged mappings, we use their children in the CWE-1003 view to select candidates. This allows us to query for more detailed mappings instead of the generic CWE, aiming to improve precision in CVE-CWE mappings, preserving the relevance of the original mapping. One setback of this method is that there are less than sufficient number of candidates (i.e. the old CWE mapping only has a few children in the CWE-1003 view) for a portion of our test set. While it may provide a more focused prediction in some cases, this reduces the possibility of finding other related CWE to inform manual analysis when a match cannot be found among direct descendants. As shown in Figure 5, the remaps happen within 1-4 steps of old CWE and this also includes the same parent’s children. For example, in order to query for a better mapping to replace CWE-269: Improper Privilege Management, which has no children in CWE-1003 view, we can query for its parent’s (CWE-284) children, which are still closely related to CWE-269. Family candidates work best in our model, because they increase diversity while preserving relevance. Table 4 summarizes the main advantages and limitations of these approaches. Table 5. FixV2W Prohibited Set Candidate Types with Advantages and Limitations

Candidate Set Type

Advantages

Limitations

MemberOf / HasMember Relationship

Replaces invalid category mappings with valid members; preserves conceptual relevance. Includes structurally and ontologically related CWEs from KG links (RelatedTo), enabling recovery from some branch errors.

Overly broad categories may introduce many low-relevance members, some categories are discontinued hence have no/few members. Since not many CVE are linked to these invalid CWE, ontology translation is not as informative as of those CWE that are valid and correctly mapped.

Find-Nearest-Neighbors (FNN)

4.3.3 CWE Members for Views and Categories. For the Prohibited mappings, we use category and view members which carry conceptual relevance, while not as strong as hierarchical relevance. Besides the members, we also use descendants of these members, since the immediate members of the categories may be still overly broad Discouraged CWE, and using Manuscript submitted to ACM

FixV2W: Correcting Invalid CVE-CWE Mappings with Knowledge Graph Embeddings

these as candidates is not an optimal strategy. Since members of a category do not necessarily come from the same branch of a hierarchical tree in the CWE database, the candidate sets may get overly large. On the contrary, some categories have none or very few members (cross section with CWE-1003 view) therefore we also tested another approach to populate the candidate lists. The Find Nearest Neighbors method of KG allows us to include ontologically related CWEs from KG links, allowing for an alternative to the default CWE-1003 view. The performance of this method is correlated to the centrality of the node, hence we may not achieve optimal performance with invalid CWE with very little connections to others. Table 5 summarizes the main advantages and limitations of these approaches. 5

Implementation and Evaluation Methodology In this section, we detail the implementation and validation of FixV2W including data sets, knowledge graph construction

and embedded model training. We then explain our methodology and metrics for evaluating the performance of FixV2W. 5.1

Implementation Details

Our implementation starts with the retrieval and processing of raw data from two different sources (NVD and MITRE). For CVE information and metadata, we obtain structured data provided by the NVD CVE API [41] that allows us to reach the latest CVE data along with the history of changes. Each record in this data includes fields such as CVE ID, description, affected platforms listed as CPE mappings, and root cause mappings in the form of CWE IDs. The history of changes include timestamps and complete modification information for each change, which allows users to filter by date and change type, and to access data added or removed during these modifications The training dataset corresponds to the NVD state on August 4, 2021, two years after the CWE-1003 view’s finalization, allowing for subsequent corrections. The validation dataset uses NVD data as of December 17, 2024, enabling evaluation of prediction accuracy on updated mappings. The training dataset is used to train the knowledge graph, by converting mappings in the NVD (as provided in the CVE metadata) and CWE (as provided in the hierarchical views defining CWE relationships) to triple format. The validation dataset serves the purpose of validating the embedding model’s Top-ranked predictions, by predicting correct labels using our knowledge graph, and comparing our predictions with true labels updated after August 4, 2021 until December 17, 2024. Both datasets also include the CWE database (2021 version), including the CWE hierarchy of classes and views and their members. Between the 2021 and 2024 instances of the NVD, used for the training and validation datasets, we observe 334 Prohibited CWE mapping updates and 1467 Discouraged CWE mapping updates. Most of the Discouraged CWE mapping corrections were made as an effort to curate the CWE Top-25 lists of 2022, 2023 and 2024. As part of the Top-25 list curation process, the CWE team works together with CNAs on correctly mapping CVEs that are mapped to Class type CWEs, and update with a Base or Variant CWE whenever possible [33] (see Figure 2 for CWE hierarchy detail levels). These CWEs are often Discouraged because they lack sufficient detail and have better suited, more accurate descendants (e.g., children). 5.1.1 Embedding Model Training Process. For our embedding model, we adopt TransE [11], a widely used translational distance model, which has been shown to perform well [45] on sparse and hierarchical graphs similar to our vulnerability ontology. TransE operates under the principle that, for a valid triple (ℎ, 𝑟, 𝑡) (head, relation, tail), the embedding of the tail entity 𝑡 should be close to the embedding of the head entity ℎ translated by the embedding of the relation 𝑟 .

Manuscript submitted to ACM

Şimşek et al.

16 Table 6. GPU and CPU Specifications

GPU CPU

BU Shared Computing Cluster (SCC) 5120 CUDA cores, Tesla P100-PCIE-16GB 24 cores, Intel(R) Xeon(R) Gold 6132 CPU @ 2.60GHz

New England Research Cloud (NERC) 3584 CUDA cores, Tesla V100-PCIE-32GB 80 cores, Intel(R) Xeon(R) Gold 6148 CPU @ 2.40GHz

Table 7. Comparison of training time on CPU and GPU for AmpliGraph and PyTorch implementations

Device CPU GPU

Epochs 300 300

AmpliGraph 1.4.0 Total Time Time/Epoch 40:37 0:08.13 6:49 0:01.4

Epochs 75 75

PyTorch 2.6 Total Time Time/Epoch 2:21:05 01:53.6 3:28 0:02.8

Table 8. Execution time comparison of FixV2W with AmpliGraph and PyTorch implementations on CPU (left) and GPU (right). There are a total of 338 Prohibited CVE and 1467 Discouraged CVE in the test set.

Prohibited Total Prohibited Average Discouraged Total Discouraged Average

CPU AmpliGraph 1.4.0 (s) PyTorch 2.6 (s) 385.59 0.148 1.144 4.39 × 10−4 1367.263 0.674 0.932 4.39 × 10−4

GPU AmpliGraph 1.4.0 (s) PyTorch 2.6 (s) 289.717 0.2084 0.857 6.20 × 10−4 1079.000 1.133 0.736 7.72 × 10−4

To train the model, we use both positive triples (valid facts from the KG) and negative triples (artificially generated by corrupting one element of the triple). These negative examples are necessary to teach the model to discriminate valid relations from invalid ones. For example, a negative triple could be (CVE-2020-17533, MatchingCWE, CWE-235) since CWE-235 is unrelated to the CVE. To avoid overfitting and ensure numerical stability, our implementation uses the Adam optimizer [25], Multiclass Negative Log Likelihood (NLL) loss function [23], and an LP regularizer [27] 5.2

Implementation Details and Runtimes

Model training, candidate set selection, and querying were all implemented in both PyTorch 2.6/Python 3.11 and AmpliGraph 1.4.0/Python 3.7.10. Table 6 provides details on the computing facilities that were used to run our experiments. Table 7 shows a training time in the order of a few minutes for models run on GPUs. In the absence of GPUs, the training time of Ampligraph is shorter. The time taken to determine the candidate set (Family method for Discouraged set and Member method for Prohibited set) and to query the Top-10 predictions for both methods is shown in Table 8. Notably, even when making predictions using the GPU, some operations (extracting Prohibited/Discouraged CWE and the CVEs mapped to them, determining the candidate set, and saving the results) still take place on the CPU for both implementations. As a result, there is an additional overhead for moving tensors from the GPU to CPU. For the PyTorch implementation, this could explain why the GPU execution time is actually slower than the CPU execution time - the time it takes to move tensors is greater than the speedup when using the GPU compared to the CPU. However, for AmpliGraph, the execution time improves because the time it takes to move tensors is shorter than the speedup when using the GPU compared to the CPU.

Manuscript submitted to ACM

FixV2W: Correcting Invalid CVE-CWE Mappings with Knowledge Graph Embeddings

Algorithm 2 Evaluate-FixV2W 1: Determine the test set 𝑉 𝑇 = {𝑣 ∈ 𝑉 }, such that 𝑣 is mapped to a Prohibited CWE 𝑤 1 in the training dataset and to an

allowed CWE 𝑤 2 in the validation dataset. 2: Run procedure FixV2W(𝑉 𝑇 ) 3: for all 𝑣 ∈ 𝑉 𝑇 do:

Scan the sorted candidate list of weaknesses 𝑤 ∈ 𝑊 𝐴 (𝑣), starting from the first element if ∃𝑤 such that 𝑤 = 𝑤 2 then 6: Exact match found 7: Return rank of 𝑤 8: end if 9: if ∃𝑤 such that 𝑤 is a direct neighbor of 𝑤 2 then 10: Fine grain match found 11: Return rank of 𝑤 12: end if 13: if ∃𝑤 such that 𝑤 is in the same branch as 𝑤 2 then 14: Coarse grain match found 15: Return rank of 𝑤 16: end if 17: end for 18: return Accuracy, MR and MRR of exact matches, fine grain matches, and coarse grain matches 4:

5.3

Evaluation Methodology

We evaluate our trained embedding model, by using rank-based metrics, which assess how well the model can predict the correct entity in a triple when given partial information, and by using coverage metrics to evaluate whether one of the Top-10 predictions provides an exact match, a fine grain match or a coarse grain match. The evaluation algorithm is provided by Algorithm 2. 5.3.1 Rank-based metrics. We apply ranking metrics commonly used in conjunction with knowledge graphs. The Mean Rank (MR) computes the average rank position of the correct entity across all test queries. A lower MR indicates better performance. The Mean Reciprocal Rank (MRR) computes the average of the reciprocal ranks (1/rank) for the correct entity. MRR emphasizes the importance of placing the correct entity as high as possible in the ranking. An MRR of 1.0 means perfect ranking (all correct answers are ranked first). Last, the Hits@N metric measures the proportion of times the correct entity appears in the Top-𝑁 predicted results. In our evaluations, we use 𝑁 = 1, 3, 5, 10 and 20. 5.3.2 Coverage Metrics. We evaluate how much of the test instances (triples) are correctly predicted by our model among the Top-10 ranked predictions. We recall that the FixV2W method, described in Algorithm 1, returns a set of candidates 𝑊 𝐴 (𝑣) ranked in sorted order from the most likely the least. In our evaluation, if FixV2W can predict the exact true triple within the Top-10 positions, we call this an exact match. If the model can predict a neighbor of the correct label, we call this a fine-grain match. As discussed in Section 7.3, we empirically found several cases where the fine-grain match provided by FixV2W seems more precise that the the (corrected) NVD label used as the ground-truth. Last, a prediction is referred to as a coarse-grain match, if the predicted CWE belongs to the same branch as the correct CWE (e.g., descendant of the same parent CWE) . To illustrate these concepts, consider the example shown in Figure 2 (see Section 3). Suppose the true label is CWE-140 and the model returns {CWE-228, CWE-138, CWE-707, CWE-140} as its Top-rankings. The result implies an exact match at rank 4, a fine-grain match at rank 2, and coarse-grain matches at ranks 1 and 3. Manuscript submitted to ACM

Şimşek et al.

12.84% 14.32%

11.35%

Ranks 2-5 Ranks 6-10

Rank 1

33.85%

Rank 1

34.73%

Ranks 6-10

14.19%

Ranks 10+

Ranks 10+ 40.61%

38.12%

(a) CWE-1003

28.45%

20.81%

(b) Top-25 CWE List

Rank 1

24.8%

25.74%

Ranks 6-10

Ranks 6-10 48.18%

Ranks 10+

Rank 1 Ranks 2-5

Ranks 2-5 2.57%

Ranks 2-5

10.95% 38.51%

Ranks 10+

(d) Family CWE

Fig. 7. Distribution of ranks for CVE-CWE prediction of Discouraged mappings using different candidate sets.

Experimental Results In this section, we present our experimental results and key findings. First, we evaluate the performance of FixV2W on

correcting Discouraged and Prohibited mappings. Next, we show how our fixes to the NVD help improve ML models relying on this database, specifically models for uncovering unknown relationships between CVE and CWE entries. Last, we demonstrate how our model could mitigate exploitation of CVEs initially mapped to erroneous CWEs. 6.1

Performance Evaluation of FixV2W

In the 2021 NVD version used for the the training dataset, we found 13,784 Prohibited CVE to CWE mappings. Among those, 336 (i.e, 2.5%) were remapped to allowed mappings in the validation dataset of December 2024. Likewise, we found 33,928 Discouraged CVE-CWE mappings in the training dataset. Among those, 1457 (i.e., 4.3%) were remapped to allowed mappings in the validation dataset. We work with labeled test sets that include these updated CWE mappings as the true labels, and evaluate the performance of FixV2W using the evaluation methodology described in Section 5.3. 6.1.1 Evaluation of FixV2W for Correcting Discouraged CWEs. Figure 7 summarizes the performance of FixV2W for different CWE candidate lists. As a baseline, we use the CWE-1003 view as the entity candidate list, for each CVE in the test set regardless of their related CWEs. First, we see that 61.88% of correct matches were among the Top-10 positions. Manuscript submitted to ACM

FixV2W: Correcting Invalid CVE-CWE Mappings with Knowledge Graph Embeddings

The Top-1 match percentage, however, is quite low at 12.84% and inadequate for performing the automated correction task on these predictions alone. The second candidate set is the CWE Top-25 view. This view includes the most commonly mapped CWE in 2021 (recall that the 2021 dataset is used for training). Since most CVEs were remapped to these CWE, this approach achieves good coverage performance overall. The main issue is that it focuses too much on highly central CWEs and ignore less popular, but still relevant CWEs. In fact, the Top-1 match percentage is even lower than for the CWE-1003, at 11.35%, because is it highly affected by node centrality. Thus, popular CWEs, such as CWE-20 and CWE-119, appear at the Top-rank no matter which CVE we query for. Since Discouraged CWEs are often higher up in the hierarchy, based on our longitudinal analysis, a reasonable method is to replace them with one of their descendants. For this candidate set, we select CWEs by applying the ChildOf relationship in the CWE hierarchy. Only those included in the CWE-1003 view are taken into consideration, to conform with the NVD requirements. We finds that the overall Top-N match percentages are the best for this candidate set and 48.26% of the predictions appear in the Top-5 positions, and only 2.75% appear between ranks 6 and 10. Although the model’s rank based metrics perform best with this candidate set, the coverage metrics are poorer. While increasing focus, this method sometimes limits the number of candidates to as little as one or two. When the descendant CWEs are not exact matches, there are no candidates left that could even be fine-grain or coarse-grain matches. This especially happens if the original mapping was the wrong child of a correct class CWE. Alternatively, when there are fewer than 10 descendants to replace a Discouraged CWE, we consider an extended candidate entity set, which we refer to as family. In this case, when possible, we take one step up in the hierarchy (i.e., applying the ParentOf relationship on the old CWE), and populate the candidate entity list with the descendants of that node (limiting ourselves as usual to CWEs belonging to the CWE-1003 view). This ensures that we have a more comprehensive list of candidates for the FixV2W algorithm. Figure 7(c) shows that this approach reaches almost the same overall coverage as CWE-1003 baseline, with an increased Top-rank coverage, climbing from 12.84% to 25.74%. Thus, we can argue that the extended family candidate set performs best, even though its Top-N match percentages seem slightly lower than for the descendant list. Overall, the number of CVE-CWE mappings predicted among Top-1, Top-5 and Top-10 positions do increase. 6.1.2 Evaluation of FixV2W for Correcting Prohibited CWEs. Figure 8 summarizes the performance of FixV2W for correcting Prohibited mappings. As for Discouraged mappings, we consider different CWE candidate lists. Beyond the CWE-1003 and Top-25 baselines, we consider a list of the members of the category or view corresponding to the prior Prohibited CWE. For each Prohibited CWE, which is a category or view, our method involves extracting the MemberOf relationship from the CWE database. The member candidate entity sets provides us with the most related CWEs for each Prohibited CWE. This choice is again driven by the findings of our longitudinal study. Similar to Discouraged mappings, we also consider an extended set that includes a larger number of candidates, which we refer to as find nearest neighbors (FNN) list to include other CWEs that are in close proximity in the KG embedding vector space. FNN is a knowledge graph method to extract neighbors, that are most likely associated with a node, even if there is no direct relationship between the two nodes. This method uses the vector space to calculate distances from a node to a list on candidates, and returns the Top-K nearest nodes. Our experimental results indicate that the Member CWE candidate list significantly outperforms the CWE-1003 and Top-25 baselines, both in terms of coverage and precision. Figure 8(c) shows the increase in coverage and the proportion of correct labels predicted in Top-1, Top-5 and Top-10 ranks. We achieve an exact match coverage that is twice as much Manuscript submitted to ACM

Şimşek et al.

10.32% 17.40%

17.109% Rank 1

9.44%

13.86%

Ranks 2-5

7.08%

(b) Top-25 CWE List 2021

Rank 1 15.93%

Ranks 10+

61.95%

Ranks 10+

(a) CWE-1003

33.63%

Rank 1

32.74% 15.63%

Ranks 2-5 Ranks 10+

36.58%

Ranks 2-5 Ranks 6-10

Ranks 6-10 13.86%

Ranks 2-5 Ranks 6-10

Ranks 6-10 62.83%

Rank 1

Ranks 10+

15.63% 35.99%

(d) Nearest Neighbor Optimization

Fig. 8. Distribution of ranks for CVE-CWE prediction of Prohibited mappings using different candidate sets.

(137 out of 338) that of the Top-25 list (67 out of 338), and the total correct prediction count, with either exact match, fine grain match or coarse grain match, goes up from 135 to 215. The Nearest Neighbor Optimization (FNN) candidate list performs comparably to the Member CWE approach. 6.2

Coverage vs. Accuracy

Figures 9 and 10 display the rank distribution for each of the candidate sets. Focusing on Figure 9, when using the CWE-1003 view, we have a large candidate set and therefore fewer results outside the Top-10. However, the distribution of ranks is scattered since FixV2W returns correct predictions pretty much uniformly across all ranks. However, with smaller candidate sets (i.e., Descendants and Family), FixV2W is able to predict many more CWEs at the Top-ranks, thanks to focused predictions. Furthermore, most of the predictions are exact matches or fine grain matches, which demonstrates the model’s ability to accurately predict CWEs, requiring little to no manual corrections afterwards. Focusing only on the exact matches (blue bars) in Figure 10, we see that Top-25 CWE candidate set performs better than the CWE-1003 baseline, with fewer Top-rank matches. On the bottom, Member CWE and Member + Nearest Neighbors candidate entity set rank distributions are shown. We see that although the total number of predicted true labels are more or less the same, using only member CWE performs better with more correct CWE predicted at rank 2, rather than supplementing with Nearest Neighbors which results in more correct predictions on rank 3. Overall, since using nearest Manuscript submitted to ACM

FixV2W: Correcting Invalid CVE-CWE Mappings with Knowledge Graph Embeddings Discouraged - CWE-1003

Discouraged - 2021 Top-25 CWE List

400

190 177

Frequency

400

200

154

200

168 172 155

116

111 67

47 38 48 36 43

46 57 41 37 29

0 1

9 10

Rank

Discouraged - Descendants

Discouraged - Family

9 10

421 400 Frequency

Frequency

400

200 106

381

200 136

101

75 63

68 33

16 9

0 1

2 8

93 59

31 28 20 24

9 10

Rank

9 10

Rank Exact Match

Fine Grain

Coarse Grain

Fig. 9. Discouraged set predictions rank distributions for each candidate set.

neighbors to fill up the candidate lists provides no apparent benefit, the best approach for correcting Prohibited CWE mappings is by using member CWE. We discuss the reason of this trend in more detail in section 7.1. 6.3

Uncovering Unknown Associations between CVE and CWE Entries

Correcting Prohibited and Discouraged CVE-CWE mappings is important both for increasing accuracy of the NVD, and for improving ML models relying on the NVD. Specifically, we show next how the updated NVD dataset, obtained after applying FixV2W on the original database, helps improving the performance of knowledge graph completion. The task of knowledge graph completion involves inferring missing triples within this graph (in our case, missing associations in the NVD). Manuscript submitted to ACM

Şimşek et al.

Prohibited - 2021 Top-25 CWE List

Prohibited - CWE-1003 60

Frequency

40 32

12 5

9 10

11 6

12 7

9 10

Rank

Prohibited - Members

Prohibited - Nearest Neighbors 62 60

40 22 20

20 13

40 24 20

11 10 10 10

10 12 9

0 2

9 0

24 19

Frequency

24 20

0 1

15 7

9 10

Rank

9 10

Rank Exact Match

Fine Grain

Coarse Grain

Fig. 10. Prohibited set predictions rank distributions for each candidate set.

The work in [45] uses a graph completion approach to predict unknown associations between CVE and CWE entries, leveraging the NVD database. Here, we apply the same method, but use the CVE-CWE mappings returned by FixV2W to replace the Prohibited and Discouraged CWEs in the NVD. For Discouraged CWEs, we use the family candidate entity set. For the Prohibited CWEs, we used members (and their descendants). We evaluate the performance of the model when replacing Discouraged/Prohibited mappings by either the Top-1 match returned by FixV2W or the Top-2 or Top-3 matches. We compare the performance of the model of [45] with our updated model on predicting hidden CVE-CWE mappings (currently unknown, but revealed in the future), using the original August 2021 NVD dataset in the former case and the updated August 2021 NVD dataset (after applying FixV2W ) in the latter case.

Manuscript submitted to ACM

FixV2W: Correcting Invalid CVE-CWE Mappings with Knowledge Graph Embeddings

Table 9. Open-world evaluation of graph completion, comparing the performance of our model, based on the updated NVD after applying FixV2W, and that of [45], based on the original NVD. The model was trained on NVD as of August 2021 and tested on new triples added to the NVD between August 2021 and November 2021.

CVE-CWE MRR MR Hits@20 Hits@10 Hits@3 Hits@1

Original [45] 0.143 38 0.500 0.358 0.118 0.059

Fixed (Top-1) 0.261 24.719 0.717 0.504 0.249 0.160

Fixed (Top-2) 0.608 14.711 0.876 0.793 0.640 0.521

Fixed (Top-3) 0.573 15.053 0.848 0.744 0.616 0.479

Table 10. Closed-world evaluation of graph completion, comparing the performance of our model, based on the updated NVD after applying FixV2W, and that of [45], based on the original NVD.

CVE-CWE MRR MR Hits@20 Hits@10 Hits@3 Hits@1

Original [45] 0.445 13 0.840 0.731 0.504 0.309

Fixed (Top-1) 0.452 12.164 0.855 0.758 0.529 0.303

Fixed (Top-2) 0.662 6.455 0.931 0.878 0.757 0.532

Fixed (Top-3) 0.731 5.177 0.943 0.903 0.809 0.627

Table 9 shows the performance of the models under an open-world assumption (OWA) which is generally considered more realistic. We observe that the updated model achieves much better performance. Interestingly, the best performance is achieved by replacing each discouraged/prohibited mapping by the Top-2 matches returned by FixV2W, improving the MRR score from 0.173 to 0.608 and the Hits@10 score from 0.389 to 0.793, compared to the model of [45] . This is because FixV2W often predicts the correct match at the second rank, as shown previously. Moreover, due to the multi-label classification nature of CVEs, most of the vulnerabilities are caused by several, often chained, weaknesses. Table 10 shows the performance of the models under a closed-world assumption This splits the KG into training and validation sets both formed from the August 2021 NVD dataset. In this case, the Top-3 model performs the best, showing a significant jump in the Mean Reciprocal Rank (MRR) score from 0.419 to 0.731, which indicates more concentrated correct predictions at top ranks. Overall, we observe that the performance of the graph completion model improves significantly after updating the Prohibited and Discouraged CVE-CWE mappings, using FixV2W. 6.4

Preventing Exploits

Although accurate CWE mapping is not a direct prevention mechanism, it allows for earlier identification of the root causes of a vulnerability, which in turn facilitate patching. In this section, we focus on evaluating FixV2W for for exploited CVEs. We extract exploit data from the Known Exploited Vulnerabilities (KEVs) Catalog [1] and the Exploit DB databases [42]. The KEV list is maintained by Cybersecurity and Infrastructure Security Agency (CISA) and comprise vulnerabilities that are actively exploited in the wild, while the Exploit DB comprises a larger set of vulnerabilities with known exploits. Our combined dataset contains 21,468 exploits of which 9.7% come from the KEV list and 90.3% come from the Exploit DB list (we only consider exploits which have been independently verified). Figure 1 reveals that as of December 2024, 55.4% of CVE are mapped to an invalid CWE or do not have a mapping. When looking at exploited CVEs Manuscript submitted to ACM

Şimşek et al.

Number of CVEs

134 130

100

88 56 56 43

0 Discouraged

Prohibited

Exploited CVEs that were remapped during August 2021 - December 2024 Exploited CVEs that were remapped after being exploited Exploited CVEs that were remapped after being exploited that we correctly predict with the FixV2W algorithm Fig. 11. KEV analysis August 2021 - December 2024 Table 11. Examples of Prohibited CVE-CWE mappings that were remapped after the exploit.

CVE CVE-2011-1823 CVE-2013-0625

Exploit Date 2022-09-08 2022-03-07

Remap Date 2024-06-28 2024-07-16

Old CWE CWE-189 CWE-255

New CWE CWE-190 CWE-287

CVE-2013-3993

2022-05-25

2024-06-28

CWE-264

CWE-22

CVE-2015-1770

2022-03-28

2024-07-09

CWE-19

CWE-824

CVE-2013-3897

2022-03-03

2024-07-16

CWE-399

CWE-416

Description Android OS Privilege Escalation Adobe ColdFusion Authentication Bypass IBM InfoSphere BigInsights Invalid Input Microsoft Office Uninitialized Memory Use Microsoft Internet Explorer UseAfter-Free

specifically, this percentage increases to 62.55% of CVEs that are mapped to invalid CWEs or do not have a mapping at all. To further motivate the importance of correct root cause mappings in the NVD, we analyzed the volume of exploits that happen after CWE remaps that we are able to correctly predict in Figure 11. It is seen that there are a total of 190 CVEs in the KEV list or Exploit DB that were exploited between August 2021 and December 2024 and were originally mapped to a Discouraged or Prohibited CWE. Out of these, 134 CVEs were mapped to a Discouraged CWE and 56 CVEs were mapped to a Prohibited CWE. FixV2W correctly predicts the root cause of a total of 131 CVE in the KEV list or in Exploit DB, which were not updated until after they were exploited. Keep in mind that FixV2W is trained on 2021 data and therefore would be able to correctly predict the root cause of these vulnerabilities. Tables 11 and 12 show a total of 10 example known exploited vulnerabilities, that were exploited before the root cause was updated. The affected products include widely-used products such as Microsoft, Android, and Linux. Knowing the root cause and properly addressing could have possibly prevented these exploits from happening.

Manuscript submitted to ACM

FixV2W: Correcting Invalid CVE-CWE Mappings with Knowledge Graph Embeddings

Table 12. Examples of Discouraged CVE-CWE mappings that were remapped after the exploit.

CVE CVE-2007-5659

Exploit Date 2022-06-08

Remap Date 2024-06-28

Old CWE CWE-119

New CWE CWE-120

CVE-2020-8644

2021-03-11

2022-07-12

CWE-74

CWE-94

CVE-2018-13382

2022-01-10

2024-07-24

CWE-285

CWE-863

CVE-2012-0754

2022-06-08

2023-01-30

CWE-119

CWE-787

CVE-2014-0160

2022-05-04

2023-02-10

CWE-119

CWE-125

Description Adobe Acrobat and Reader Buffer Overflow PlaySMS Server-Side Template Injection Fortinet FortiOS and FortiProxy Improper Authorization Adobe Flash Player Memory Corruption OpenSSL Information Disclosure Discouraged - Exploits

Prohibited - Exploits 50

15 13 40 Frequency

Frequency

11 10 6 5 3

14 15

7 1

0 1

0 9 10

0 1

Rank

0 6

0 7

1 8

0 0 9 10

Rank Exact Match

Fine Grain

Coarse Grain

Fig. 12. Breakdown of exact, fine, and coarse grain matches of exploited CVEs whose subsequent remaps are predicted correctly by FixV2W.

We look further into the distribution of CVE-CWE mappings that we are able to predict correctly. Figure 12 shows the distribution of CWE mappings that we are able to predict correctly as an exact, fine, or coarse match before the vulnerability was exploited. Notably, for the Discouraged set, all the exploits whose vulnerabilities’ CWE remaps we predict correctly are exact matches, with all but one CVE ranking among the Top-5, indicating that FixV2W would have identified these remappings effectively before the CVE was exploited. 7

Discussion

7.1

Understanding Incorrect Predictions

For both the Prohibited and Discouraged CWE test sets, we find that in about 35-40% of the cases, FixV2W fail to return a correct answer ranked within the Top-10 entries. We next investigate possible reasons that affect the model’s Manuscript submitted to ACM

Şimşek et al.

performance. We first consider the Prohibited CWE test set. It turns out that 61 entries correspond to CVEs that were previously mapped to CWE-16 or CWE-264, both of which do not have any members. Since they do not have any relationship in the Knowledge Graph ontology, it is difficult to find associations including with the FNN method. Indeed, the FNN method performs best with an ontology where meaningful relationships are established between the nodes, and CWE-16 and CWE-264 have few additional associations. Therefore FixV2W fails to find good replacements for CVEs that were previously mapped to these two CWE. In such cases, employing semantic models may be unavoidable. Unlike what is stated in our longitudinal analysis, where the rest of the CWE categories and members often remap to members, these two CWE are exceptional cases. Therefore, these CWE can be excluded from our test set or we can conclude that the method only works effectively if the initial CWE has meaningful mappings across the CWE hierarchy. Excluding these CWE from our test set, overall coverage of the test set goes up from 63% to 75% and exact match rate goes up from 40% to 50%. We reported the numbers without excluding these two in Section 6 to not overfit our model and shrink our test set. For other incorrect predictions, we found that the new mapping is generally unrelated to the old CWE mapping, which means that the old mapping was highly inaccurate. For example, there are seven remaps from the old CWE-189: Numeric Errors category that the model cannot predict. The new mappings in the NVD are as follows: • CVE-2003-2564 - CWE-776: Improper Restriction of Recursive Entity References in DTDs (’XML Entity Expansion’) • CVE-2007-3798 - CWE-252: Unchecked Return Value • CVE-2008-0062 - CWE-665: Improper Initialization (Discouraged) • CVE-2008-2108 - CWE-331: Insufficient Entropy • CVE-2008-3612 - CWE-330: Use of Insufficiently Random Values • CVE-2009-1890 - CWE-400: Uncontrolled Resource Consumption (Discouraged) • CVE-2010-0128 - CWE-787: Out-of-bounds Write None of these seven remaps are related to the “Numeric Errors” category, or any members of the category. In such cases, since the new CWEs are too far away in the ontology, the model does not recognize these as possible replacements to CWE-189. Next, consider Discouraged mappings. We find that for about 40% of the remaps, the new CWE mapping in a completely different branch than the old one. This cannot be avoided with our model. Moreover, if the new CWE is not a widely used weakness, even candidates belonging to the CWE-1003 view and the Top-25 CWE view do not perform well. Yet, upon manually analyzing the new CVE-CWE mappings of these vulnerabilities, we found that some of the CVEs involved in these mappings are missing CWE mappings which our model actually predicts. For example, CVE-2007-3798 is caused by CWE-252: Unchecked Return Value, which leads to CWE-190: Integer Overflow or Wraparound, but the latter is not listed in the NVD. Our model predicts CWE-190 at rank 2. Similarly, CVE-2010-0128, caused by a signed integer error, should also be mapped to CWE-681: Incorrect Conversion between Numeric Types, which is not listed in the NVD, while our model predicts it at rank 8. Hence, a reason our model does not always perform well is that our validation methodology assume that remaps from the NVD are correct and complete (in the absence of any better alternative), which is not always the case. 7.2

Using Different Types of Candidate Sets For Each CWE

Instead of using the same type of candidate sets for all CWEs (e.g., Top-25, Descendants, etc.), we experimented with tailoring the candidate set for each CWE. We used remaps from before August 2021 to make predictions on remaps after Manuscript submitted to ACM

FixV2W: Correcting Invalid CVE-CWE Mappings with Knowledge Graph Embeddings

Prohibited - Different Type of Candidate Sets

100

10 1 CWE-399

1 CWE-310

CWE-320

CWE-275

CWE-16

CWE-399

CWE-320

Correct

CWE-189

1 CWE-310

CWE-275

CWE-264

10 CWE-264

CWE-255

CWE-254

CWE-189

CWE-16

CWE-255

CWE-254

76 65

CWE-19

76 65

Number of prediction

100

CWE-19

Number of predictions

Prohibited - Same Type of Candidate Sets

Incorrect

Fig. 13. Prohibited - Comparison between using the same and different type of candidate sets for each CWE. Counts shown correspond to the number of correct remappings.

August 2021. We used the set that the majority of CVEs before August 2021 were remapped to to determine the type of candidate set we query after 2021. The different types of candidate sets we tested were Top-25, Descendants, Member, and Neighbor for each CWE. For the Prohibited set, we compared the performance of this tailored algorithm to the Member algorithm in Figure 13. For the Discouraged set, we compared the performance of this tailored algorithm to the Family algorithm in Figure 14. Surprisingly, some CWEs such as CWE-20 perform best when queried with baseline candidate sets (i.e. CWE Top-25), but for other CWE such as CWE-200, using this algorithm actually has an inverse effect on model performance. 7.3

FixV2W vs NVD: Which is more accurate?

Upon the completion of our predictions and evaluation, we manually analyzed some of our predictions to determine how accurate they are. As discussed in Subsection 7.1, we found out that FixV2W returns CWEs that are missing from the NVD data, especially when CVEs are complex and require multiple CWE mappings. Indeed, often the NVD provides only one mapping, while in practice others CWEs also contribute to a vulnerability. Apart from this, we discovered instances where FixV2W appears to provide a more precise mapping than the NVD, as shown next. For instance, CVE-2016-5042 is caused by a crafted input (malformed DWARF section) that leads to an infinite loop and a crash. The NVD maps this CVE to CWE-835: Loop with Unreachable Exit Condition. Yet the primary root cause is CWE-20, Improper Input Validation, which leads to the malformed section being accepted as valid input. FixV2W predicts CWE-20 at the first rank. Similarly, CVE-2014-1943 is caused by a crafted indirect offset value in the magic of a file, and that allows an attacker to cause denial of service (infinite recursion, CPU consumption, and crash). The NVD maps this CVE to CWE-755: Improper Handling of Exceptional Conditions. Upon careful analysis, it appears that this vulnerability is caused by input Manuscript submitted to ACM

Şimşek et al.

28 Discouraged - Same Type of Candidate Sets

Discouraged - Different Type of Candidate Sets

600

600 507

122

CWE-74

CWE-668

CWE-400

CWE-311

CWE-287

23 40 11 19 5 30 CWE-269

CWE-20

CWE-119

CWE-74

CWE-668

CWE-400

Correct

97 48

12 13 12 30 CWE-311

44 CWE-287

CWE-284

23 CWE-269

CWE-20

CWE-119

92 76

200

CWE-200

200

400

CWE-284

Number of prediction

400

CWE-200

Number of predictions

499

Incorrect

Fig. 14. Discouraged - Comparison between using the same and different type of candidate sets for each CWE. Some CWE not shown in Discouraged set, where no change is observed. Counts shown correspond to the number of correct remappings.

parsing logic allowing recursive evaluation without termination conditions. This directly maps to CWE-400 (Uncontrolled Resource Consumption), CWE-770 (Allocation of Resources Without Limits) or CWE-772 (Missing Release of Resource After Effective Lifetime); all of which are predicted by FixV2W in ranks 8,9 and 4, respectively. The primary issue, the program not checking the input to ensure no recursive entities are used (CWE-20) is also predicted by our model at the first rank. In total, we detected with the help of ChatGPT-4o (verified manually afterwards), that 11 of the 123 “incorrect” predictions in the Prohibited CWE set are in fact correct CWEs that are not listed by the NVD. These correctly predicted CWE are missed in the evaluation pipeline of FixV2W, since the NVD fails to provide them or a related CWE in the vulnerability metadata. 7.4

Shortcoming of semantic models

Accurate correction of invalid mappings is far from a straightforward task, even for semantics-based models that are trained on large amount of data. These models, while powerful, require large, well-labeled training datasets that include textual descriptions for both CVEs and CWEs. LLMs struggle with consistency and lack deterministic responses [9], rendering them unreliable as a standalone approach to CVE classification [30]. For example, consider CVE-2021-21589 that lacks a CWE mapping. Because the CVE description mentions “adversary can use this to escalate privileges”, ChatGPT-4o suggests CWE-269: Improper Privilege Management. Yet, the actual issue is the program not exiting on failed initialization i.e. CWE-455: Non-exit on Failed Initialization which is the child of CWE-665: Improper Initialization. Such issues are hard to avoid using semantic processing methods, such as LLM or NLP. We argue that using the natural connectivity of CVEs, CWEs and CPEs through an ontology representation of the NVD data can help inform the predictions of semantic models and reduce computational overhead. In this work, we made the first effort to correct CVE-CWE mappings to Manuscript submitted to ACM

FixV2W: Correcting Invalid CVE-CWE Mappings with Knowledge Graph Embeddings

improve database quality, and increase model accuracy of those what train on NVD data. Unlike large language models, FixV2W avoids keyword overfitting and provides interpretable, reproducible predictions that align with ontology structure. 7.5

Limitations and Threats to Validity

7.5.1 Data Accuracy. For both our predictions and validations, we rely on the National Vulnerability Database (NVD). Our analysis begins with the understanding that the NVD contains known inaccuracies in CWE mappings. In our current study, the updated version of the NVD serves as the validation set under the assumption that its updated mappings represent the most accurate classification available. However, errors and inconsistencies persist even in recent updates, as discussed earlier. This directly affects the reported performance of our model, as validation accuracy is bounded by the correctness of these reference labels. For instance, when a CVE is mapped by the NVD to a generic (Discouraged) CWE despite the availability of more specific alternatives, our model may be penalized for offering the correct, but unlisted, alternative. Similarly, the model is penalized for offering correct, but unlisted root cause weaknesses, as discussed in Subsection 7.1. 7.5.2 Results Evaluation. Our results include both fine-grained and coarse-grained CWE predictions, each of which contributes to reducing the manual burden of remapping vulnerabilities. Nonetheless, our evaluation strategy currently assumes that the most recent CWE mapping provided by the NVD or its associated CNA is not only correct but also complete. As explained earlier, this is not always the case. Indeed, certain vulnerabilities require multiple CWE mappings to fully capture the root causes and contributing factors. The NVD, however, often lists only a single CWE per CVE, even when the vulnerability spans multiple weakness types. This simplification leads to under-specified mappings and impacts both model training and evaluation, as the complexity of some vulnerabilities are not reflected in the data. 8

Conclusion This paper presents FixV2W, a knowledge graph–based framework designed to correct invalid CVE–CWE mappings

in the NVD. Through a longitudinal study of mapping updates between 2016 and 2024, we uncovered that more than half of all CVEs are currently assigned to invalid CWE categories, with 84% of subsequent remaps occurring within just one to two hops in the CWE hierarchy. Leveraging these insights, we design FixV2W, a methodology that systematically identifies more accurate weaknesses. Remarkably, FixV2W provides correct matches (among the Top-10 results) for 69% of exploited vulnerabilities that had invalid CWEs before they were exploited. Moreover, FixV2W demonstrates multi-label classification ability, shown with the improvements to the original model after retraining with top 2 and top 3 matches. Strikingly, replacing invalid mappings with multiple mappings predicted by FixV2W improved the model’s ability to predict unseen CVE-CWE mappings significantly, and provides more meaningful root cause mappings than a single label classification. We compare different candidate sets to achieve best results, and our tests show that for Discouraged CWE correction, using CWEs closely related in the hierarchy (family) performs best, while for Prohibited CWE correction, using CWEs that are members of the same category or view of the original CWE yields best results. Even further, excluding a few outliers that do not fit into the longitudinal analysis claims (no members, few associations) proves that the model performs best if the old CWE mapping has strong, meaningful connections in the ontology. Our results demonstrate that ontology-informed graph embeddings provide a practical and deterministic alternative to purely semantic or LLM-based approaches, avoiding hallucinations and nondeterministic responses while remaining computationally lightweight. Beyond improving CWE mapping accuracy, our findings highlight broader implications for vulnerability management: higher-quality root cause data enables better future predictions and overall improved ML model performance throughout Manuscript submitted to ACM

Şimşek et al.

the cybersecurity ecosystem. While our model misses correct CWEs in the predictions, some original invalid mappings are substantially misaligned with the true weakness, limiting purely structural approaches, such as ours. As explained in Section 7.5, NVD does not always provide the most accurate CWE remap for a CVE, and sometimes FixV2W outperforms the “ground truth”. A promising direction for future work is to integrate FixV2W with semantic models, particularly large language models (LLMs), to further improve and validate our model’s performance in correcting CWE mappings of CVE. Such an approach could combine FixV2W ’s deterministic, ontology-grounded predictions with the contextual reasoning strengths of LLMs, providing both precision and adaptability as new weaknesses emerge. We believe this integration will pave the way toward the next generation of automated, trustworthy, and scalable vulnerability intelligence systems. Acknowledgments This work was supported in part by the Boston University Red Hat Collaboratory (awards numbers 2024-01-RH03 and 2025-01-RH05). The authors thank David Sastre Medina, Jonah Gluck and Howell Xia for fruitful discussions. References [1] Cybersecurity & Infrastructure Security Agency. 2025. Known Exploited Vulnerabilities Catalog. https://www.cisa.gov/known-exploitedvulnerabilities-catalog. Accessed on September 23, 2025. [2] Ehsan Aghaei, Waseem Shadid, and Ehab Al-Shaer. 2020. ThreatZoom: Hierarchical Neural Network for CVEs to CWEs Classification. In Security and Privacy in Communication Networks, Noseong Park, Kun Sun, Sara Foresti, Kevin Butler, and Nitesh Saxena (Eds.). Springer International Publishing, Cham, 23–41. [3] Charilaos Akasiadis, Anastasios Nentidis, Angelos Charalambidis, and Alexander Artikis. 2024. Detecting and Fixing Inconsistency of Large Knowledge Graphs. In Proceedings of the 13th Hellenic Conference on Artificial Intelligence (SETN ’24). Association for Computing Machinery, New York, NY, USA, Article 14, 8 pages. doi:10.1145/3688671.3688766 [4] Massimiliano Albanese, Olutola Adebiyi, and Frank Onovae. 2024. CVE2CWE: Automated Mapping of Software Vulnerabilities to Weaknesses Based on CVE Descriptions. In Proceedings of the 21st International Conference on Security and Cryptography (SECRYPT 2024), pages 500-507 (2024). doi:DOI:10.5220/0012770400003767 [5] Daniel Alfasi, Tal Shapira, and Anat Bremler-Barr. 2024. VulnScopper: Unveiling Hidden Links Between Unseen Security Entities. In Proceedings of the 3rd GNNet Workshop on Graph Neural Networking Workshop (Los Angeles, CA, USA) (GNNet ’24). Association for Computing Machinery, New York, NY, USA, 33–40. doi:10.1145/3694811.3697819 [6] Afsah Anwar, Ahmed Abusnaina, Songqing Chen, Frank Li, and David Mohaisen. 2022. Cleaning the NVD: Comprehensive Quality Assessment, Improvements, and Analyses. IEEE Transactions on Dependable and Secure Computing 19, 6 (2022), 4255–4269. doi:10.1109/TDSC.2021.3125270 [7] Abdallah Arioua and Angela Bonifati. 2018. User-guided repairing of inconsistent knowledge bases. In EDBT 2018-21st International Conference on Extending Database Technology. OpenProceedings. org, 133–144. [8] Hiba Arnaout, Trung-Kien Tran, Daria Stepanova, Mohamed Hassan Gad-Elrab, Simon Razniewski, and Gerhard Weikum. 2022. Utilizing language model probes for knowledge graph repair. In Wiki Workshop 2022. [9] Berk Atil, Sarp Aykent, Alexa Chittams, Lisheng Fu, Rebecca J. Passonneau, Evan Radcliffe, Guru Rajan Rajagopal, Adam Sloan, Tomasz Tudrej, Ferhan Ture, Zhe Wu, Lixinyu Xu, and Breck Baldwin. 2025. Non-Determinism of "Deterministic" LLM Settings. arXiv:2408.04667 [cs.CL] https://arxiv.org/abs/2408.04667 Repair the bridge before it cracks: Understanding vulnerabilities and weaknesses in modern IT. [10] Judy Kelly Austin Kimbrell. 2025. https://www.redhat.com/en/blog/repair-bridge-it-cracks-understanding-vulnerabilities-and-weaknesses-modern-it. [11] Antoine Bordes, Nicolas Usunier, Alberto Garcia-Duran, Jason Weston, and Oksana Yakhnenko. 2013. Translating Embeddings for Modeling Multi-relational Data. In Advances in Neural Information Processing Systems, C.J. Burges, L. Bottou, M. Welling, Z. Ghahramani, and K.Q. Weinberger (Eds.), Vol. 26. Curran Associates, Inc. https://proceedings.neurips.cc/paper_files/paper/2013/file/1cecc7a77928ca8133fa24680a88d2f9-Paper.pdf [12] Jay Chen. 2020. The State of Exploit Development: 80% of Exploits Publish Faster than CVEs. https://unit42.paloaltonetworks.com/state-of-exploitdevelopment/. [13] Alec Summers Chris Madden. [n. d.]. Vulnerability Root Cause Mapping with CWE. https://www.first.org/resources/papers/vulncon25/VulnerabilityRoot-Cause-Mapping-with-CWE_-Challenges-Solutions-and-Insights-from-Grounded-LLM/index. [14] Roland Croft, M. Ali Babar, and M. Mehdi Kholoosi. 2023. Data Quality for Software Vulnerability Datasets. In 2023 IEEE/ACM 45th International Conference on Software Engineering (ICSE). 121–133. doi:10.1109/ICSE48619.2023.00022 [15] National Vulnerability Database. [n. d.]. NVD General Update, May 29, 2024. https://www.nist.gov/itl/nvd/nvd-news. Manuscript submitted to ACM

FixV2W: Correcting Invalid CVE-CWE Mappings with Knowledge Graph Embeddings

[16] Hedeker Donald and D Gibbons Robert. 2006. Longitudinal data analysis. John Wiley & Sons, Inc., Hoboken, NJ. DOI 10 (2006), 0470036486. [17] Ying Dong, Wenbo Guo, Yueqi Chen, Xinyu Xing, Yuqing Zhang, and Gang Wang. 2019. Towards the detection of inconsistencies in public security vulnerability reports. In Proceedings of the 28th USENIX Conference on Security Symposium (Santa Clara, CA, USA) (SEC’19). USENIX Association, USA, 869–885. [18] Jens Dörpinghaus, Vera Weil, Carsten Düing, and Martin W. Sommer. 2022. Centrality Measures in multi-layer Knowledge Graphs. arXiv:2203.09219 [cs.SI] https://arxiv.org/abs/2203.09219 [19] FIRST.org. 2024. Common Vulnerability Scoring System version 4.0: Specification Document. https://www.first.org/cvss/v4.0/specification-document. [20] Google. 2023. Google OSV. https://google.github.io/osv-scanner/. [21] Wanyu Hu and Vrizlynn LL Thing. 2024. CPE-Identifier: Automated CPE identification and CVE summaries annotation with Deep Learning and NLP. arXiv preprint arXiv:2405.13568 (2024). [22] Yuning Jiang, Manfred Jeusfeld, and Jianguo Ding. 2021. Evaluating the Data Inconsistency of Open-Source Vulnerability Repositories. In Proceedings of the 16th International Conference on Availability, Reliability and Security (Vienna, Austria) (ARES ’21). Association for Computing Machinery, New York, NY, USA, Article 86, 10 pages. doi:10.1145/3465481.3470093 [23] Rudolf Kadlec, Ondrej Bajgar, and Jan Kleindienst. 2017. Knowledge Base Completion: Baselines Strike Back. arXiv:1705.10744 [cs.LG] https: //arxiv.org/abs/1705.10744 [24] Hakan Kekül, Burhan Ergen, and Halil Arslan. 2022. Estimating missing security vectors in NVD database security reports. International Journal of Engineering and Manufacturing 12, 3 (2022), 1. [25] Diederik P. Kingma and Jimmy Ba. 2017. Adam: A Method for Stochastic Optimization. arXiv:1412.6980 [cs.LG] https://arxiv.org/abs/1412.6980 [26] Philipp Kuehn, Markus Bayer, Marc Wendelborn, and Christian Reuter. 2021. OVANA: An Approach to Analyze and Improve the Information Quality of Vulnerability Databases. In Proceedings of the 16th International Conference on Availability, Reliability and Security (Vienna, Austria) (ARES ’21). Association for Computing Machinery, New York, NY, USA, Article 22, 11 pages. doi:10.1145/3465481.3465744 [27] Timothée Lacroix, Nicolas Usunier, and Guillaume Obozinski. 2018. Canonical Tensor Decomposition for Knowledge Base Completion. arXiv:1806.07297 [stat.ML] https://arxiv.org/abs/1806.07297 [28] Xiaozhou Li, Sergio Moreschini, Zheying Zhang, Fabio Palomba, and Davide Taibi. 2023. The anatomy of a vulnerability database: A systematic mapping study. Journal of Systems and Software 201 (2023), 111679. doi:10.1016/j.jss.2023.111679 [29] Chris Madden and Alec Summers. 2025. Vulnerability Root Cause Mapping with CWE: Challenges, Solutions, and Insights from Grounded LLMbased Analysis. Presentation, FIRST VulnCon. https://www.first.org/resources/papers/vulncon25/Vulnerability-Root-Cause-Mapping-with-CWE_Challenges-Solutions-and-Insights-from-Grounded-LLM/index Presented by Chris Madden (Yahoo) and Alec Summers (MITRE). [30] Francesco Marchiori, Denis Donadel, and Mauro Conti. 2025. Can LLMs Classify CVEs? Investigating LLMs Capabilities in Computing CVSS Vectors. arXiv:2504.10713 [cs.CR] https://arxiv.org/abs/2504.10713 [31] Mend.io. 2023. Mend Vulnerability Database. https://www.mend.io/wp-content/media/2021/11/Mend-Vulnerability-Database.pdf. [32] MITRE. 2006. Common Weakness Enumeration (CWE). https://cwe.mitre.org. [33] MITRE. 2021. 2021 CWE Top 25 Most Dangerous Software Weaknesses. https://cwe.mitre.org/top25/archive/2021/2021_cwe_top25.html# methodology [34] MITRE. 2024. Common Vulnerability and Exposures. https://cve.mitre.org [35] MITRE. 2024. CWE Research Concepts View. https://cwe.mitre.org/data/graphs/1000.html. Accessed = 09-01-2024. [36] MITRE. 2024. CWE Top 25 Most Dangerous Software Weaknesses. https://cwe.mitre.org/top25/. [37] Shubham Mittal, Aditi Joshi, Tim Finin, and Kunal Joshi. 2019. Cyber-All-Intel: An AI for cybersecurity knowledge graph generation. arXiv preprint arXiv:1905.02895 (2019). [38] Viet Hung Nguyen and Fabio Massacci. 2013. The (Un)Reliability of NVD Vulnerable Versions Data: An Empirical Experiment on Google Chrome Vulnerabilities. In Proceedings of the 8th ACM SIGSAC Symposium on Information, Computer and Communications Security (Hangzhou, China) (ASIA CCS ’13). Association for Computing Machinery, New York, NY, USA, 493–498. doi:10.1145/2484313.2484377 [39] NIST. 2002. National Vulnerability Database. https://nvd.nist.gov/ [40] NIST. 2024. Common Platform Enumeration. https://nvd.nist.gov/products/cpe. [41] NIST. 2024. Vulnerability APIs. https://nvd.nist.gov/developers/vulnerabilities [42] OffSec. 2025. Exploit Database. https://www.exploit-db.com. Accessed on September 23, 2025. [43] Thomas Pellissier Tanon and Fabian Suchanek. 2021. Neural Knowledge Base Repairs. In The Semantic Web: 18th International Conference, ESWC 2021, Virtual Event, June 6–10, 2021, Proceedings. Springer-Verlag, Berlin, Heidelberg, 287–303. doi:10.1007/978-3-030-77385-4_17 [44] Red Hat Inc. 2025. RedHat CVE Database. https://access.redhat.com/security/security-updates/cve. [45] Zhenpeng Shi, Nikolay Matyunin, Kalman Graffi, and David Starobinski. 2024. Uncovering CWE-CVE-CPE Relations with Threat Knowledge Graphs. ACM Trans. Priv. Secur. 27, 1, Article 13 (feb 2024), 26 pages. doi:10.1145/3641819 [46] Adam Shostack. 2014. Threat modeling: Designing for security. John wiley & sons. [47] Sevval Simsek, Varsha Athreya, and David Starobinski. [n. d.]. Threat Knowledge Graphs - FixV2W. https://github.com/nislab/threat-knowledge-graph. [48] Snyk OS. [n. d.]. Snyk Vulnerability Database. https://snyk.io/vuln. [49] Haotong Yang, Zhouchen Lin, and Muhan Zhang. 2022. Rethinking Knowledge Graph Evaluation Under the Open-World Assumption. In Advances in Neural Information Processing Systems, S. Koyejo, S. Mohamed, A. Agarwal, D. Belgrave, K. Cho, and A. Oh (Eds.), Vol. 35. Curran Associates, Inc., Manuscript submitted to ACM

Şimşek et al.

8374–8385. https://proceedings.neurips.cc/paper_files/paper/2022/file/378226e5df7eded3e401de5c9493143c-Paper-Conference.pdf [50] Siqi Zhang, Minjie Cai, Mengyuan Zhang, Lianying Zhao, and Xavier de Carné de Carnavalet. 2023. The flaw within: Identifying CVSS score discrepancies in the NVD. In 2023 IEEE International Conference on Cloud Computing Technology and Science (CloudCom). IEEE, 185–192. [51] Su Zhang, Doina Caragea, and Xinming Ou. 2011. An Empirical Study on Using the National Vulnerability Database to Predict Software Vulnerabilities. In Database and Expert Systems Applications, Abdelkader Hameurlain, Stephen W. Liddle, Klaus-Dieter Schewe, and Xiaofang Zhou (Eds.). Springer Berlin Heidelberg, Berlin, Heidelberg, 217–231. [52] Şevval Şimşek, Howell Xia, Jonah Gluck, David Sastre Medina, and David Starobinski. 2025. Fixing Invalid CVE-CWE Mappings in Threat Databases. In 2025 IEEE 49th Annual Computers, Software, and Applications Conference (COMPSAC). 950–960. doi:10.1109/COMPSAC65507.2025.00124

Manuscript submitted to ACM

Record · ID 134509 · SHA-256 914e08a9290c9b33
Retrieved via Conceptio — every document is proof-bundled with source, license, and retrieval metadata.