CVE-to-ATT&CK Mapping via Evidence-Constrained Ranking

CVE-to-ATT&CK Mapping via Evidence-Constrained Ranking Kai Wei

Yuwen Cui

University of South Florida Tampa, FL, USA

University of South Florida Tampa, FL, USA

Kehan Shen

Guangjing Wang

University of South Florida Tampa, FL, USA

University of South Florida Tampa, FL, USA

arXiv:2610.33924v1 [cs.CR] 24 Oct 2026

Abstract Mapping CVEs to MITRE ATT&CK techniques helps defenders translate vulnerability information into hypotheses about adversary behavior. Automating this mapping is challenging because relevant evidence is fragmented across heterogeneous security sources. In addition, ATT&CK techniques can be semantically similar, and existing annotations cover a highly long-tailed subset of the technique space. Existing supervised, retrieval-based, and LLM-based approaches therefore face limitations from closed-set supervision, semantic ambiguity, or unconstrained prediction. We formulate CVE-to-ATT&CK mapping as multi-evidence constrained ranking. Our framework TRACE first integrates complementary structural and semantic evidence from multiple sources to construct a bounded, high-coverage candidate pool over the complete ATT&CK technique space. It then reranks the retained candidates by combining their accumulated evidence with CVE– technique textual interactions and frequency-aware scoring. We evaluate the framework across six public datasets with different annotation processes and vulnerability distributions. Candidate construction reduces the 201-technique ATT&CK search space by approximately 60% while retaining at least one ground-truth technique for 95.11%–100% of CVEs. These results show that combining heterogeneous security evidence with constrained ranking provides a more controlled and generalizable bridge from vulnerability information to adversary behavior.

1

INTRODUCTION

The number of reported vulnerabilities grows rapidly [31]. The reasons are twofold. First, the volume of code surges with agentic AI coding, which expands the vulnerability surface [13, 15, 33]. Second, many AI-driven security tools discover new vulnerabilities at scale. For example, Claude Mythos Preview identified thousands of vulnerabilities across major operating systems and web browsers [4]. A vulnerability report tells defenders which software flaws are present. For example, identified vulnerabilities are reported to the Common Vulnerabilities and Exposures (CVE) system. Each CVE record typically describes an affected product, exploitation conditions, and reported consequences. Yet, a CVE does not provide a complete account of how an adversary may operationalize the vulnerability within an attack. Thus, identifying a vulnerability is only the first step toward understanding its security implications. To understand potential adversary behaviors, MITRE ATT&CK1 provides a standardized framework that categorizes adversarial 1 Enterprise ATT&CK comprises 201 parent-level techniques, while some of the tech-

niques are divided into sub-techniques. Version: v14.1

Connection

CWE-XXX

CAPEC-XXX

Potential connection

CVE-XXX

Connection

ATT-XXX

CVSS AV:X PR:X UI:X

Figure 1: The connectivity among security report sources. objectives into tactics and the methods used to achieve objectives into techniques [28]. Mapping CVEs to ATT&CK techniques establishes a connection between software vulnerabilities and adversarial behaviors: CVEs identify specific software flaws, while ATT&CK techniques describe the actions attackers may perform by exploiting these vulnerabilities to achieve their objectives. Such mappings provide evidence-constrained behavioral hypotheses that analysts can combine with asset context and threat intelligence to reason about how a vulnerability may contribute to an attack. Different methods are proposed to achieve CVE-to-ATT&CK mapping. For example, supervised classifiers [3, 7, 10, 12] learn direct CVE-to-technique associations but depend on the coverage and frequency of labels in the training dataset. Knowledge-graph methods [6, 16, 17] exploit curated relationships among security entities but cannot recover a relevant technique when the required graph path is missing. Semantic retrieval methods [1, 14, 21] can search a broader ATT&CK space. However, semantic similarity alone cannot distinguish techniques supported by concrete vulnerability evidence from those that merely share similar terminology. More recent LLM-based approaches [22, 36, 37] provide flexible interpretation, but open-ended generation makes the prediction space difficult to constrain and may produce techniques that are insufficiently supported by the available evidence. Reliable CVE-to-ATT&CK mapping requires integrating evidence from heterogeneous security sources (datasets) to establish how a software vulnerability relates to specific adversarial behaviors. For instance, CVE descriptions capture affected components and reported effects [26]; CWE characterizes the underlying weakness [27]; CAPEC describes related attack patterns [25]; CVSS encodes exploitability and impact conditions [32]. Figure 1 illustrates the relationships among CVEs, CWEs, CAPEC attack patterns, CVSS attributes, and MITRE ATT&CK techniques, which connect vulnerabilities to adversarial behaviors. Yet, each source in Figure 1 captures only part of the relationship between a vulnerability and adversary behaviors. For example, the CVE-2021-44228 description reports JNDI-based arbitrary

Kai Wei, Yuwen Cui, Kehan Shen, and Guangjing Wang

10 10 10 10

100%

Observed label frequency Cumulative label mass

4

3

Top 10: 50%

131 observed / 201 total

Uncovered: 70 techniques (no observed labels)

75%

50%

2

1

25%

Cumulative Label Mass

Label Count

10

0

0

25

50

75 100 125 MITRE ATT&CK Techniques

150

175

0% 200

Figure 2: The label-frequency distribution over the complete ATT&CK technique space.

code execution [30], CWE-917 identifies the underlying expressionlanguage injection weakness [24], and CVSS indicates networkbased exploitation with low complexity, no required privileges, and no user interaction [29]. None of these sources explicitly identifies an ATT&CK technique. Nevertheless, taken together with the affected application’s exposure context, T1190 Exploit Public-Facing Application can be a plausible candidate. In addition, we observe that retrieving candidates from multiple sources can yield several plausible ATT&CK techniques for the same CVE. This creates ambiguity about which techniques are supported by vulnerability evidence. For example, direct semantic retrieval also identifies T1059 (Command and Scripting Interpreter) because "arbitrary code execution" in the CVE-2021-44228 description resembles "executing arbitrary commands" in T1059. However, arbitrary code execution does not necessarily involve a command or scripting interpreter, which makes additional evidence necessary to distinguish valid mappings from semantically plausible but unsupported candidates. Based on the above observations, we formulate CVE-to-ATT&CK mapping as a heterogeneous data-integration problem. Given a vulnerability, the task is to integrate structured and textual evidence to identify plausible candidates from the ATT&CK technique space. Constructing and evaluating candidate CVE-to-ATT&CK mappings presents two key challenges. First, incomplete and imbalanced evidence limits candidate coverage. Security sources are developed for different purposes and through different annotation processes, resulting in incomplete and highly imbalanced technique coverage. As shown in Figure 2, only 131 parent-level techniques appear across the six datasets considered in this study, with the ten most frequent techniques accounting for 50% of all observed labels. Consequently, relevant techniques may be overlooked when supporting evidence is missing or indirect. In addition, Table 1 shows substantial variation in evidence availability across different security sources. For example, only 26.35% of CVE records in the KEV dataset have an available CWE–CAPEC connection, highlighting the limitations of relying on a single evidence source and motivating complementary evidence paths. Second, multiple plausible candidates create mapping ambiguity. Different security sources may suggest different ATT&CK techniques for the same CVE, making it difficult to distinguish mappings from semantically plausible but weakly supported candidates. Ranking these candidates often relies on

Table 1: Availability of structured evidence and CWE–CAPEC connectivity among CVE identifiers. Dataset

CVEs

CWE

CVSS

CWE–CAPEC

All Evidence

KEV [23] ATCM [8] ENISA [11] CVE2Attack [12] SMET [1] CGVM [22]

296 374 8,019 1,661 303 31,298

99 (33.45%) 296 (79.14%) 5,805 (72.39%) 1,287 (77.48%) 233 (76.90%) 28,570 (91.29%)

262 (88.51%) 339 (90.64%) 7,978 (99.49%) 1,486 (89.46%) 280 (92.41%) 23,311 (74.48%)

78 (26.35%) 253 (67.65%) 5,391 (67.23%) 994 (59.84%) 192 (63.37%) 28,123 (89.86%)

71 (23.99%) 230 (61.50%) 5,366 (66.92%) 910 (54.79%) 182 (60.07%) 20,785 (66.41%)

historical CVE-to-ATT&CK annotations, whose sparsity and imbalance further complicate reliable candidate selection. In this work, we present TRACE, Technique Ranking with Aggregated CVE Evidence. TRACE is a multi-evidence constrainedranking framework for mapping CVEs to MITRE ATT&CK techniques. The central principle is that ATT&CK techniques should be prioritized according to the combined security evidence. We first aggregate complementary structural and semantic evidence from different sources. The aggregation constructs a bounded, highcoverage candidate pool over the complete ATT&CK technique space. We then separately rerank the retained candidates by combining this accumulated evidence with CVE–technique textual interactions. This design allows candidate construction to optimize for coverage, while reranking optimizes for precision. We evaluate TRACE across six public CVE-to-ATT&CK datasets spanning different annotation processes and vulnerability distributions. Step 1 reduces the 201-technique ATT&CK search space by 60% while retaining at least one ground-truth technique for 95.11%–100% of CVEs, which provides a compact yet high-coverage search space for downstream ranking. Step 2 improves the ordering of these retained candidates, with NDCG@10 gains ranging from 0.0607 to 0.2806 across the six datasets. Against prior CVE-toATT&CK mapping systems [1, 18], TRACE achieves the strongest performance across all five ranking metrics on both KEV [23] and CVE2Attack [12] datasets. On CVE2Attack, for example, TRACE improves MRR from 0.4177 to 0.4319 and Hit@10 from 0.7261 to 0.7457 over the state-of-the-art TRIAGE [18]. These results show that TRACE generalize beyond the datasets used for model development. Overall, our main contributions are listed as follows: • We formulate CVE-to-ATT&CK mapping as an evidenceconstrained data integration problem. We recover relevant techniques and distinguish evidence-supported mappings from incomplete and heterogeneous security evidence. • We propose TRACE, a two-stage framework that integrates heterogeneous structural and semantic evidence to construct high-coverage candidate pools, then reranks techniques using evidence-aware and frequency-aware scoring. • We evaluate the TRACE across six public datasets. Step 1 reduces the ATT&CK search space by 60% while retaining at least one ground-truth technique for 95.11%–100% of CVEs, and Step 2 consistently improves ranking quality.

2

RELATED WORK

In this section, we introduce existing studies on CVE-to-ATT&CK mapping, which can be broadly grouped into three categories.

CVE-to-ATT&CK Mapping via Evidence-Constrained Ranking

STEP 1

INPUTS

Evidence Inputs Vulnerability Evidence CVE

CWE

CVSS

CAPEC

STEP 2

Candidate Pool Construction

Candidates Reranking Feature Vector

Semantic Branch

Structural Branch

𝜙𝑖𝑗

SRL Query

Lexical . Bridging . CVSS . Stage

Conditions

Pattern

𝐩final 𝑖𝑗

ARG0 (Attacker) V

Pair Construction (Cross-Encode Input)

(Action)

ARG1 (Target)

Candidate Technique (one candidate )

Data Integration Weakness

Preservation Probability

𝑓𝑖𝑛𝑎𝑙

𝜙𝑖𝑗 ; 𝑝𝑖𝑗

; 𝜓𝑖𝑗𝑡𝑒𝑥𝑡

𝑅sem 𝑑𝑖 , 𝒦ATT&CK

𝑅struct 𝑑𝑖 , 𝑤𝑖 , 𝑣𝑖 , 𝑎𝑖 , 𝒦ATT&CK

CVE . CWE . CVSS . CAPEC

Description

Feature Concatenation

Step1 Result

Multi-source Evidence for Candidate Retrieval

Semantic Candidates

Structured Candidates

CVE Description

𝐩final

Step1 𝑖𝑗 Preservation Probability

CVSS Evidence

𝐶𝑖,raw = 𝐶𝑖,struct ∪ 𝐶𝑖sem

𝜙𝑖𝑗

CVE Evidence

Technique Name

Raw Candidate pool

Step1 Feature Vector

Scoring Head h(·)

Ranking Score 𝑢𝑖𝑗

Description CWE Information

Feature Vector MITRE ATT&CK technique space

∅𝑖𝑗

Preservation Probability

Final CandidatePool

Score Model

SecRoBERTa(frozen) Encode

Sigmoid

Interaction Feature Vector 𝜓𝑖𝑗text

𝐪𝑖 ; 𝐜𝑖𝑗 𝐪𝑖 − 𝐜𝑖𝑗

𝐩final 𝑖𝑗

𝐂𝑖final

Interaction text Feature 𝑖𝑗 Vector

𝜓

Ranked ATT&CK Techniques

... ... ...

T1059 T1203 T1190

1 2 3

......

𝐪𝑖 ⊙ 𝐜𝑖𝑗

Figure 3: Overview of the proposed two-step CVE to ATT&CK mapping framework TRACE. Step 1 performs multi-source candidate recall and adaptive candidate preservation to build a high-coverage candidate pool, while Step 2 performs reranking over that candidate pool to produce the final ATT&CK techniques ranking. Knowledge-integrated mapping. The first category uses structured security knowledge to interpret vulnerability text. For example, BRON [16] links CVE, CWE, CAPEC, and ATT&CK records into a single relational graph. This graph-based approach returns the paths available in the graph. But the path coverage is limited by the completeness of the curated CVE–CWE–CAPEC–ATT&CK links. VDM-IoT [35] builds on a similar idea by retrieving knowledgegraph paths to steer an LLM toward the correct mapping. But the knowledge-graph paths are supplied only as prompt context and do not constrain the LLM’s output space. Consequently, the model may generate techniques unsupported by the retrieved evidence or omit relevant techniques whose supporting paths are absent. These methods demonstrate the value of structured security knowledge, but they rely heavily on the availability of curated graph paths. When no path connects a CVE to a relevant technique, neither method provides a mechanism for recovering the missing connection. By contrast, our framework TRACE does not rely on a single curated knowledge-graph path to retrieve a candidate. Instead, it derives CVE–technique evidence from multiple complementary structural and semantic retrieval strategies. As a result, when a particular knowledge-graph relation is missing, a relevant technique can still be recovered through alternative evidence sources. Supervised and retrieval-based mapping. The second category models CVE-to-ATT&CK mapping as multi-label classification. For example, CVE2ATTCK [12] evaluates classical and BERT-based classifiers with data augmentation. Although these methods learn direct vulnerability-to-technique associations, they remain sensitive to training data distribution. If a technique does not appear in the training data, the classifier struggles to predict it correctly. By contrast, retrieval-based methods such as SMET [1] extract attack-related phrases from CVE descriptions and rank ATT&CK techniques based on embedding similarity. However, semantic similarity alone may be insufficient when multiple techniques use similar terminology or describe related attack procedures. This is because their similarity scores may not reflect how strongly each

technique is supported by the available vulnerability evidence. To address this limitation, TRACE jointly considers CVE–technique textual relations, candidate evidence features, and preservation probabilities, enabling it to prioritize strongly supported techniques over alternatives that are merely semantically similar. LLM-based and generation-based mapping. Recent studies apply LLMs directly to CVE-to-ATT&CK mapping [22, 34, 36, 37]. TRIAGE [18], for example, uses rule-guided prompting and incontext examples to steer LLM-based CVE-to-ATT&CK mapping. Although such methods offer flexible semantic interpretation, their open-ended generation makes the prediction space difficult to constrain. As a result, they may produce redundant or semantically overlapping predictions, or techniques that are only weakly supported by the available vulnerability evidence.

3 SYSTEM DESIGN 3.1 System Overview TRACE maps a CVE to a ranked list of ATT&CK techniques through a two-step architecture as shown in Figure 3. The design separates two objectives that are difficult to satisfy simultaneously: candidate coverage and ranking precision. A retrieval mechanism that is sufficiently permissive to preserve relevant and long-tail techniques inevitably introduces weakly related candidates, whereas an aggressive predictor risks discarding relevant techniques before they can be considered. Therefore, TRACE first constructs a bounded, high-coverage candidate pool and then performs finegrained evidence-based reranking over the retained techniques. Step 1: Evidence-guided candidate construction. Given a CVE record 𝑥𝑖 containing its description, we incorporate auxiliary information including CWE information, CVSS attributes, and available CAPEC relations. Step 1 retrieves candidates from the complete set of 201 parent-level Enterprise ATT&CK techniques. We design two complementary retrieval branches. The structural branch exploits direct lexical evidence, CVE–CWE–CAPEC–ATT&CK relations, and CVSS-derived exploitation cues. The semantic branch

Kai Wei, Yuwen Cui, Kehan Shen, and Guangjing Wang

Algorithm 1: Step 1: Candidate-Pool Construction Input: Target CVE record 𝑥𝑖 = (𝑑𝑖 , 𝑤𝑖 , 𝑣𝑖 , 𝑎𝑖 ); ATT&CK technique set 𝐾𝐴𝑇𝑇 &𝐶𝐾 ; Trained candidate-preservation model 𝐹𝜃final ; Score-mass target 𝜏 and Maximum pool size 𝐾𝑚𝑎𝑥 . Output: Final candidate pool 𝐶𝑖final ; candidate-preservation scores 𝑝𝑖final 𝑗 ; and candidate feature vectors 𝜙𝑖 𝑗 . struct ← 𝑅 1 𝐶𝑖 struct (𝑥𝑖 , 𝐾𝐴𝑇𝑇 &𝐶𝐾 ) sem , {𝑧 } ) ← 𝑅 2 (𝐶𝑖 𝑖𝑗 sem (𝑑𝑖 , 𝐾𝐴𝑇𝑇 &𝐶𝐾 ) raw ← 𝐶 struct ∪ 𝐶 sem 3 𝐶𝑖 𝑖 𝑖 raw do 4 foreach 𝑐 𝑖 𝑗 ∈ 𝐶𝑖
5 𝜙𝑖 𝑗 ← ConstructFeatures 𝑥𝑖 , 𝑐𝑖 𝑗 , 𝐾𝐴𝑇𝑇 &𝐶𝐾   6 𝑝𝑖final ← Sigmoid 𝐹𝜃final (𝜙𝑖 𝑗 ) 𝑗 Sort 𝐶𝑖raw in descending order of 𝑝𝑖final 𝑗 𝐶𝑖final ← top-ranked candidates until cumulative normalized probability ≥ 𝜏, with |𝐶𝑖final | ≤ 𝐾max final , 𝑝 final , 𝜙 9 return 𝐶𝑖 𝑖𝑗 𝑖𝑗

7

8

extracts behavioral phrases from the CVE description using semantic role labeling and retrieves techniques according to semantic similarity to these behaviors. However, as broad retrieval improves coverage but can introduce noisy candidates, TRACE records the evidence supporting each retrieved technique and uses a lightweight candidate-preservation model to estimate whether it should be retained. The candidate pools are deduplicated into a single CVE-level pool. The model then truncates the raw candidate set according to the accumulated probability mass, which produces a compact candidate pool 𝐶𝑖final . Step 2: Evidence-aware candidate reranking. The retained candidates in Step 1 may have similar preservation probabilities despite differing substantially in how well they are supported by the complete vulnerability evidence. Therefore, Step 2 reranks 𝐶𝑖final by jointly considering three signals: (i) the evidence features accumulated in Step 1, (ii) the candidate-preservation probability, and (iii) the semantic interaction between the CVE and the candidate ATT&CK technique. Specifically, we use SecRoBERTa [19] to encode the CVE context and each candidate technique, and we finetune the scoring head of SecRoBERTa that combines their textual interaction features with the Step 1 evidence. A frequency-based correction further reduces systematic preference toward frequently observed techniques. The resulting scores are used to rank all retained candidates, which yield the final ATT&CK prediction 𝜂𝑖final . Overall, Step 1 favors recall so that relevant techniques are not irreversibly removed from consideration, while Step 2 favors precise ordering among the retained candidates. TRACE does not rely on any single lexical match, knowledge-graph path, or semantic similarity score to determine the final prediction. Instead, it aggregates complementary security evidence during candidate construction and preserves that evidence for the final ranking decision.

3.2

Evidence-Guided Candidate Construction

We introduce Step 1 of TRACE to construct a compact, high-coverage ATT&CK technique candidate pool for each CVE, as illustrated in Algorithm 1. Formally, given a CVE record 𝑥𝑖 , where 𝑥𝑖 comprises the available CVE description 𝑑𝑖 , CWE labels 𝑤𝑖 , CVSS attributes 𝑣𝑖 , and CAPEC relations 𝑎𝑖 . We design two complementary retrieval

branches, structural retrieval 𝑅struct and semantic retrieval 𝑅sem , to retrieve candidate techniques using evidence from 𝑥𝑖 . The retrieval space consists of ATT&CK techniques, denoted as 𝐾𝐴𝑇𝑇 &𝐶𝐾 . 3.2.1 Candidate Construction in Structural Branch. In the structural retrieval branch 𝑅struct , the structural candidate set 𝐶𝑖struct is constructed for each CVE. For each CVE, the framework applies three complementary retrieval strategies over the CVE record 𝑥𝑖 and the full ATT&CK technique space 𝐾𝐴𝑇𝑇 &𝐶𝐾 . The applicability of these three strategies varies depending on the availability of security evidence and the characteristics of individual CVEs. First, direct lexical retrieval compares the CVE and CWE description with each ATT&CK technique’s name and description, and retains a technique when they share at least one relevant nonstopword token. Parent-level lexical matching is also performed against parent-technique names and descriptions, allowing a parent technique to be recovered when the strongest lexical evidence is associated with one of its sub-techniques. Second, we establish a CVE–CWE–CAPEC–ATT&CK bridge as shown in Figure 1, which uses the CWE identifiers in 𝑤𝑖 and the available CAPEC information in 𝑎𝑖 . A CAPEC pattern is retained when its related-weakness field shares at least one CWE identifier with the CVE. The CAPEC patterns are then projected to ATT&CK techniques through the available CAPEC-to-ATT&CK links. Third, CVSS-informed retrieval transforms the attack-vector, privileges, and user-interaction attributes in 𝑣𝑖 into natural language cues. The cue describes the vulnerability’s access conditions (e.g., network-accessible and requiring no prior privileges). These descriptions are appended to the CVE query and compared with the names and descriptions of ATT&CK techniques. 3.2.2 Candidate Construction in Semantic Branch. We observe that although candidates in the structural branch exploit several explicit evidence sources, they may still omit techniques whose attack semantics are expressed indirectly in the CVE description. Direct lexical retrieval only retrieves a technique when the CVE description shares at least one non-stopword token with the technique name or description. Therefore, semantically related techniques expressed using different terminology may be missed. In addition, CVE–CWE– CAPEC–ATT&CK bridging also cannot recover a technique when the relevant 𝑤𝑖 or 𝑎𝑖 is unavailable. Furthermore, CVSS-derived cues provide supporting evidence, but they do not always identify the specific attacker behavior. To improve candidate coverage, the semantic branch uses the CVE description 𝑑𝑖 to retrieve indirectly related ATT&CK techniques. Therefore, we apply an AllenNLP BERT-based semantic role labeling (SRL) model [2] to 𝑑𝑖 to extract predicate–argument structures. The model identifies actions expressed by the main predicates and associates them with their arguments, such as the actor, affected object, exploitation condition, instrument, and resulting effect. These elements are combined into compact behavioral phrases that preserve the central action and its context. For example, a description stating that a remote attacker can execute arbitrary commands through a vulnerable service may produce phrases such as "attacker executes arbitrary commands". The extracted behavioral phrases and the ATT&CK technique descriptions are encoded using ATT&CK-BERT [5]. Cosine similarity is computed between each extracted phrase and each technique description. Considering

CVE-to-ATT&CK Mapping via Evidence-Constrained Ranking

that a CVE may express multiple behaviors, the semantic support score of each technique is defined as the maximum phrase-level similarity across all phrases extracted from 𝑑𝑖 . Techniques are then ranked by semantic score 𝑧𝑖 𝑗 . The top 96 techniques out of 625 ATT&CK techniques that include sub-techniques are retained in the semantic candidate set 𝐶𝑖sem . Finally, 𝐶𝑖struct and 𝐶𝑖sem are merged to form the raw candidate set 𝐶𝑖raw . For each candidate 𝑐𝑖 𝑗 ∈ 𝐶𝑖raw , we construct a 19-dimensional feature vector 𝜙𝑖 𝑗 that summarizes the evidence supporting its retrieval. The features fall into four groups. (i) Five structural-retrieval features characterize the amount of structured evidence, including the number of retrieval sources supporting the candidate, direct lexical relevance, CWE–CAPEC association strength, parent-level lexical relevance, and token overlap between the CVE and technique text. These features measure how the CVE text matches the candidate technique and how many relevant tokens they share. (ii) Four semantic features capture the maximum similarity between SRL-extracted behavioral phrases and the technique description, token overlap, and the number of behavioral phrases extracted from the CVE. The cvss_semantic_score measures the semantic similarity between the technique text and a natural-language cue rendered from the CVSS attack vector, privilege, and userinteraction attributes. They provide behavioral evidence when lexical correspondence alone is insufficient. (iii) Six binary provenance indicators record whether a candidate was retrieved through CWE–CAPEC bridging, direct lexical retrieval, parent-level lexical retrieval, SRL-based semantic retrieval, CVSS-informed retrieval, or CWE-based retrieval. These indicators allow the model to distinguish the presence of evidence from its numerical strength. (iv) Four CVSS-derived binary features encode whether the vulnerability is network-accessible, requires no prior privileges, requires user interaction, or requires no user interaction. These features capture exploitation-context information. 3.2.3 Candidate Preservation Score Model Training. Although 𝐶𝑖raw is constructed to achieve high candidate coverage, its broad structural and semantic retrieval strategies may introduce many weakly related or irrelevant techniques. Passing the entire raw candidate set to Step 2 would unnecessarily enlarge the reranking space and make the reranker more susceptible to noisy candidates. Therefore, we train a lightweight neural network model (𝐹𝜃 ) as a candidatepreservation model to further reduce the Step 2 search space while retaining candidates that contain the ground-truth technique. For each candidate technique 𝑐𝑖 𝑗 ∈ 𝐶𝑖raw , the 𝐹𝜃 model takes the candidate-level feature vector 𝜙𝑖 𝑗 as input. The model is a twohidden-layer MLP with ReLU activation and dropout. Applying a sigmoid function to the MLP output 𝐹𝜃 (𝜙𝑖 𝑗 ) yields the candidatepreservation probability 𝑝𝑖 𝑗 . This probability estimates whether 𝑐𝑖 𝑗 should be retained and passed to Step 2. The features in 𝜙𝑖 𝑗 allow 𝐹𝜃 to learn which combinations of structural and semantic retrieval sources provide more reliable evidence, thereby affecting its predicted preservation probability 𝑝𝑖 𝑗 . The scoring model 𝐹𝜃 is trained using the training splits of KEV [23], ATCM [8], and ENISA [11]. As ENISA is larger than KEV and ATCM, directly training on the combined training data

could cause the optimization to be dominated by ENISA. Therefore, we employ dataset-balanced sampling and dataset-specific loss weighting to control the contribution of each training source. The final checkpoint is selected based on macro-averaged validation performance across KEV and ATCM. For each CVE record 𝑥𝑖 , let 𝐺𝑖 denote its ground-truth technique set. Before training, we compare each candidate 𝑐𝑖 𝑗 in the raw candidate pool with the ground-truth ATT&CK techniques annotated for the current CVE. If 𝑐𝑖 𝑗 ∈ 𝐺𝑖 , we assign it a label of 1; otherwise, we assign it a label of 0. We denote this binary training label by 𝑦𝑖 𝑗 . Then, we train the candidate-preservation model 𝐹𝜃 in a single supervised stage. For each raw candidate 𝑐𝑖 𝑗 , 𝐹𝜃 takes its feature vector 𝜙𝑖 𝑗 as input and produces a candidate score 𝑠𝑖 𝑗 , which is converted into the preservation probability 𝑝𝑖 𝑗 through a sigmoid function. The binary annotation-derived label 𝑦𝑖 𝑗 indicates whether the candidate is a ground-truth technique for the CVE record. The binary cross-entropy (BCE) optimization objective encourages high preservation probabilities for ground-truth candidates and low preservation probabilities for incorrect candidates. To further distinguish candidates within the same raw candidate set, we add a pairwise ranking loss. For each CVE record, the pairwise loss encourages the score 𝑠𝑖 𝑗 of a ground-truth candidate to be higher than that of an incorrect candidate. Thus, the BCE term learns candidate-level preservation probabilities, while the pairwise term explicitly improves the relative ordering of correct and incorrect candidates within the same candidate pool. The resulting BCE–pairwise objective is used to train the final model 𝐹𝜃final . 3.2.4 Final Candidate-Pool Generation. After BCE-pairwise training, final candidate-preservation model 𝐹𝜃final computes a preservation probability 𝑝𝑖final for each candidate 𝑐𝑖 𝑗 ∈ 𝐶𝑖raw . For each CVE 𝑗 record 𝑥𝑖 , candidates are ranked in descending order of 𝑝𝑖final 𝑗 . Before dynamic selection, TRACE maps all 625 ATT&CK parent techniques and sub-techniques to 201 parent-level identifiers to ensure consistency with the ground-truth annotations and avoid redundant candidates associated with the same parent technique. For candidates associated with the same parent technique, TRACE retains the representative having the highest preservation probability. TRACE then ranks the parent-level candidates in descending order of their retained probabilities. Rather than applying a fixed probability threshold, Step 1 dynamically selects final Candidate-Pool 𝐶𝑖final according to the relative preservation probabilities within 𝐶𝑖raw . Specifically, the preservation probabilities of all candidates in the same raw candidate set are normalized by their sum, producing the normalized preservation probabilities 𝑝˜𝑖 𝑗 . Starting from the highest-ranked candidate, Step 1 retains candidates until the cumulative normalized probability reaches the target value 𝜏 = 0.90, while limiting the pool to at most 𝐾max candidates. If the cumulative normalized probability does not reach 𝜏 within this limit, the top 𝐾max = 80 candidates are retained. We select 𝜏 and 𝐾max using the held-out validation split by balancing ground-truth technique coverage against the number of candidates passed to Step 2.

3.3

Step 2: Candidate Reranking

Step 2 reranks the final candidate pool 𝐶𝑖final produced by Step 1. Each candidate 𝑐𝑖 𝑗 ∈ 𝐶𝑖final is provided with its feature vector 𝜙𝑖 𝑗 and

Kai Wei, Yuwen Cui, Kehan Shen, and Guangjing Wang

Algorithm 2: Step 2: Candidate Reranking Input: Final candidate pool 𝐶𝑖final ; Candidate features 𝜙𝑖 𝑗 ; Step 1 preservation probabilities 𝑝𝑖final 𝑗 ; CVE description 𝑑𝑖 ; CWE information 𝑤𝑖 ; CVSS attributes 𝑣𝑖 Output: Ranked candidate list 𝜂𝑖final 1 𝑞𝑖 ← [𝑑𝑖 ; 𝑤 𝑖 ; 𝑣 𝑖 ]; 2 q𝑖 ← SecRoBERTa(𝑞𝑖 ); final do 3 foreach 𝑐 𝑖 𝑗 ∈ 𝐶𝑖 4 𝑡𝑖 𝑗 ← [Name(𝑐𝑖 𝑗 ); Description(𝑐𝑖 𝑗 )]; 5 c𝑖 𝑗 ← SecRoBERTa(𝑡𝑖 𝑗 ); 6 𝜓𝑖text 𝑗 ← [q𝑖 ; c𝑖 𝑗 ; |q𝑖 − c𝑖 𝑗 |; q𝑖 ⊙ c𝑖 𝑗 ]; text 7 𝑢𝑖 𝑗 ← ℎ𝜔 [𝜙𝑖 𝑗 ; 𝑝𝑖final 𝑗 ;𝜓𝑖 𝑗 ] − 𝜆freq 𝜌 (𝑐 𝑖 𝑗 );
final ← Sort {(𝑐 , 𝑢 ) | 𝑐 ∈ 𝐶 final } ; 8 𝜂𝑖 𝑖𝑗 𝑖𝑗 𝑖𝑗 ↓ 𝑖 final 9 return 𝜂𝑖

Step 1 preservation probability 𝑝𝑖final 𝑗 . Although Step 1 constructs a compact candidate pool while preserving high coverage, its objective is to determine whether a candidate should be retained rather than to establish the final ranking. Consequently, multiple plausible techniques supported by different structural or semantic evidence may receive similarly high preservation probabilities. However, these techniques may differ substantially in how well their attack behaviors are supported by the complete vulnerability evidence. Furthermore, the Step 1 preservation probability 𝑝𝑖final alone can𝑗 not fully resolve this ambiguity because it estimates whether a candidate should be retained rather than its relative relevance among the retained candidates. Therefore, Step 2 performs reranking over 𝐶𝑖final by directly modeling the semantic relationship between the CVE description and each candidate technique while incorporating the evidence accumulated in Step 1. Specifically, we train a scoring head ℎ𝜔 on top of frozen SecRoBERTa [19] representations to assign a ranking score to each retained candidate. 3.3.1 Candidate Reranker. We introduce how the final scoring head ℎ𝜔 incorporates CVE–technique semantic relevance with Step 1 evidence to compute the final candidate score 𝑢𝑖 𝑗 . As illustrated in Algorithm 2, we first construct the CVE input 𝑞𝑖 by combining the CVE description 𝑑𝑖 , CWE information 𝑤𝑖 , and CVSS attributes 𝑣𝑖 . For each retained candidate 𝑐𝑖 𝑗 , let 𝑡𝑖 𝑗 denote the concatenation of its ATT&CK technique name and description. SecRoBERTa separately encodes 𝑞𝑖 and 𝑡𝑖 𝑗 into the CVE representation q𝑖 and candidate-technique representation c𝑖 𝑗 , respectively. We then derive the CVE–technique textual interaction feature vector 𝜓𝑖text 𝑗 from these two representations. Specifically, q𝑖 and c𝑖 𝑗 are combined through concatenation, element-wise absolute difference, and element-wise multiplication to construct 𝜓𝑖text 𝑗 . This interaction feature captures the semantic relevance and fine-grained semantic interactions between the CVE and the candidate technique. Finally, the Step 1 candidate feature vector 𝜙𝑖 𝑗 , the Step 1 preservation probability 𝑝𝑖final 𝑗 , and the CVE-technique textual interaction feature vector 𝜓𝑖text are jointly provided to the SecRoBERTa-based 𝑗

scoring head to compute the final candidate score:   text 𝑢𝑖 𝑗 = ℎ𝜔 [𝜙𝑖 𝑗 ; 𝑝𝑖final 𝑗 ;𝜓𝑖 𝑗 ] − 𝜆freq 𝜌 (𝑐 𝑖 𝑗 ). Here, ℎ𝜔 (·) is the learned SecRoBERTa-based scoring head, which jointly models the Step 1 evidence and CVE–technique textual interactions. To reduce systematic preference toward frequently observed techniques during reranking, we further apply a frequencybased score correction. The term 𝜌 (𝑐𝑖 𝑗 ) denotes the training-set frequency statistic of technique 𝑐𝑖 𝑗 , while 𝜆freq controls the strength of the corresponding penalty against systematically over-ranking frequent, generic techniques. 3.3.2 Score Head Training. The scoring head ℎ𝜔 is trained to rank ground-truth ATT&CK techniques above other candidates retained by Step 1. We use the same training datasets as those described in Section 3.2.3. Unlike the candidate-preservation model in Step 1, which estimates whether a candidate should remain in the candidate pool, the scoring head directly optimizes the relative ordering of the retained candidates. This distinction allows Step 1 to focus on preserving potentially relevant techniques, while Step 2 learns to place the most relevant techniques at higher ranks. For each CVE, retained ground-truth techniques are treated as positive candidates, while the remaining retained techniques are treated as negative candidates. We construct positive–negative candidate pairs within the same candidate pool and train the scoring head using a margin-based pairwise ranking loss. The objective encourages each ground-truth technique to receive a higher score than non-ground-truth candidates by a fixed margin. At inference time, given the Step 1 candidate pool 𝐶𝑖final , the final reranker computes a final score 𝑢𝑖 𝑗 for each retained candidate 𝑐𝑖 𝑗 . The Rerank module then ranks all candidates in 𝐶𝑖final in descending order of 𝑢𝑖 𝑗 . The resulting ordered list, denoted by 𝜂𝑖final , constitutes the final ATT&CK prediction.

3.4

TRACE for Unseen CVEs: An Example

A newly disclosed CVE may contain a vulnerability description, CVSS attributes, and CWE identifiers. For example, CVE-202673570 [9], disclosed in August 2026, affects Zimbra Collaboration Suite and allows an unauthenticated attacker to execute operating system commands through SMTP requests. Its CVSS is 3.1/𝐴𝑉 : 𝑁 /𝐴𝐶 : 𝐻 /𝑃𝑅 : 𝑁 /𝑈 𝐼 : 𝑁 /𝑆 : 𝐶/𝐶 : 𝐻 /𝐼 : 𝐻 /𝐴 : 𝐿, indicating network-based exploitation without required privileges or user interaction. The corresponding CWE-78 identifies the underlying OS command injection weakness. Given this information, TRACE retrieves potential ATT&CK techniques through structural and semantic retrieval paths. For this CVE, CWE-78 is associated with five CAPEC patterns, but none has a corresponding ATT&CK relationship. Meanwhile, semantic retrieval identifies additional candidates using SRL from the CVE description and natural-language representations of CVSS. Among the Step 1 retrieved candidates, T1059.003 and T1190 receive the most support from multiple evidence sources. Specifically, T1059.003 is supported by direct lexical matching, semantic retrieval, and CWE direct lexical matching. T1190 is supported by direct lexical evidence, CWE direct lexical matching, and CVSSbased semantic matching. Other candidates generally rely on fewer

CVE-to-ATT&CK Mapping via Evidence-Constrained Ranking

Table 2: Summary of the datasets used for training and evaluation. Source CVEs denote the number of CVEs in the original dataset. Effective CVEs denote the number remaining after cross-dataset deduplication and used in our experiments. For external test datasets, it corresponds to the actual evaluation size after removing CVEs overlapping with the Step 2 training and validation partitions. Avg. labels denote the average number of unique ATT&CK technique labels per effective CVE.

KEV [23] ATCM [8] ENISA [11] CVE2Attack [12] SMET [1] CGVM [22]

Source CVEs

Effective CVEs

Avg. labels

296 836 8,072 1,661 303 31,298

296 374 8,019 1,329 270 27,859

2.69 2.44 8.03 1.74 1.47 5.48

or less directly relevant evidence sources. For each retrieved technique, TRACE constructs an independent 19-dimensional feature vector. Each vector records the evidence associated with that specific candidate. For example, T1059.003 is represented by its direct lexical score of 0.7561, semantic similarity of 0.5722, and active source indicators for direct lexical retrieval, semantic retrieval, and CWE matching. The 19-dimensional vectors are then independently fed into the previously trained Step 1 MLP, which outputs a preservation probability for each technique candidate. The T1059.003 receives a preservation probability of 0.7661, the highest within the T1059 family, while T1190 receives 0.4786. Then, TRACE maps sub-techniques to their parent-level techniques and retains the highest-scoring representative within each family, along with its preservation probability and features. Thus, T1059 will proceed to Step 2. TRACE then normalizes these probabilities and selects a dynamic candidate pool. For this CVE, Step 1 retains 78 parent techniques, with T1059 and T1190 ranked first and second. In Step 2, each retained technique is represented by its inherited Step 1 evidence features, preservation probability, and additional scoring features, forming a 23-dimensional structured feature vector. Meanwhile, SecRoBERTa separately encodes the CVE description, CWE information, and CVSS-derived textual representation, as well as the name and description of each parent technique. The resulting CVE–technique semantic interactions are combined with the Step 1 features. Meanwhile, SecRoBERTa separately encodes the CVE description, CWE identifiers, and CVSS-derived textual representation, as well as the parent technique’s identifier, name, and description. The resulting 3,072-dimensional CVE–technique interaction vector is projected to 64 dimensions through a twolayer fusion network. This representation is concatenated with the 23-dimensional scalar features, forming an 87-dimensional input to the trained scoring head. The scoring head assigns a ranking score to each candidate. TRACE then sorts the candidates to produce the final ATT&CK ranking. For CVE-2026-73570, T1059 remains ranked first, and T1190 remains ranked second. From manual analysis, T1059 is the technique that best reflects this vulnerability. The description states that an unauthenticated remote attacker can supply crafted input that results in the execution of operating system commands on the affected system. What the attacker ultimately gains is the ability to run arbitrary commands through the system’s command interpreter, which is exactly the behavior T1059 describes.

Role Step 1/2 train/val/test (178/59/59) Step 1/2 train/val/test (224/75/75) Step 1/2 train/val/test (4,811/1,604/1,604) External test External test External test Pairwise CVE overlap KEV

296

26

45

6

9

40

ATCM

26

836

776

55

81

188

CVE2Attack

45

776

1,661

303

74

455

SMET

6

55

303

303

7

97

ENISA

9

81

74

7

8,072

4,192

10

CGVM

40

188

455

97

4,192

31,298

10

KEV

ATCM

CVE2Attack

SMET

ENISA

CGVM

10

10

10

4

3

2

Number of shared CVEs

Dataset

1

0

Figure 4: Pairwise CVE overlap across the six datasets. Each off-diagonal cell reports the number of CVEs shared by the corresponding pair of datasets, while each diagonal cell reports the total number of unique CVEs in that dataset. Colors are shown on a logarithmic scale to accommodate the substantial differences in dataset size.

4 EVALUATION 4.1 Datasets As shown in Table 2, we evaluate the framework TRACE on six CVE-to-ATT&CK mapping datasets. Steps 1 and 2 are trained using KEV, ATCM, and ENISA, whereas CVE2Attack, SMET, and CGVM are used exclusively for external evaluation.

4.2

Dataset Overlap Analysis

To characterize cross-dataset relationships and control potential evaluation leakage, we analyze overlap among the six benchmarks at the CVE level. Figure 4 shows the pairwise CVE overlap across the six datasets. The largest pairwise overlap occurs between ENISA and CGVM, which share 4,192 CVEs. Among the shared CVEs, 3,724 have at least one common parent-level ATT&CK technique label. CVE2Attack and ATCM also exhibit substantial overlap, sharing 776 CVEs, of which 773 have at least one common parent-level technique label. In addition, all 303 CVEs in SMET are also present in CVE2Attack.

Kai Wei, Yuwen Cui, Kehan Shen, and Guangjing Wang CVEs sharing at least one label KEV

--

ATCM

30.8%

CVE2Attack

30.8% 42.2% 16.7% --

42.2% 99.6%

99.6% 47.3% --

64.7%

KEV

--

3.8%

4.4%

0.0%

0.0%

0.0%

4.9%

13.3%

ATCM

3.8%

--

79.4%

5.5%

0.0%

4.3%

Dataset KEV ATCM CVE2Attack SMET ENISA CGVM

4.1%

24.0%

CVE2Attack

4.4%

79.4%

--

21.5%

0.0%

7.9%

14.3% 20.6%

SMET

0.0%

5.5%

21.5%

--

0.0%

6.2%

88.8%

ENISA

0.0%

0.0%

0.0%

0.0%

--

1.4%

--

CGVM

0.0%

4.3%

7.9%

6.2%

1.4%

--

KEV

ATCM CVE2Attack SMET

ENISA

CGVM

16.7% 47.3% 64.7%

ENISA

0.0%

4.9%

CGVM

7.5%

13.3% 24.0% 20.6% 88.8%

KEV

ATCM CVE2Attack SMET

14.3%

Table 3: Candidate-pool quality of the Step 1 with 𝜏 = 0.90.

7.5%

SMET

4.1%

--

CVEs with identical label sets

0.0%

--

ENISA

CGVM

Figure 5: ATT&CK annotation consistency for CVEs shared across the six benchmark datasets. The left figure reports the proportion of shared CVEs for which each dataset pair has at least one parent-technique label in common. The right figure reports the proportion for which the complete parenttechnique label are identical. The number of shared CVEs is reported separately in Figure 4. However, CVE-level overlap does not necessarily imply identical annotations, as different datasets may assign different ATT&CK technique labels to the same CVE. In contrast, KEV has relatively limited overlap with the other datasets. It shares only 9 CVEs with ENISA, none of which have a common parent-level technique label, and 40 CVEs with CGVM, of which only 3 share at least one label. These overlaps are explicitly considered in the experimental protocol. Dataset splitting and deduplication are performed at the CVE level, and CVEs appearing in the Step 2 training or validation partitions are removed from external evaluation sets. Consequently, the reported external evaluation results do not treat CVEs observed during model development as unseen test instances. As shown in Figure 5, CVE-level overlap does not necessarily imply annotation consistency. ATCM and CVE2Attack show the strongest agreement: 99.61% of their shared CVEs have at least one common parent-technique label, and 79.38% have identical label sets. In contrast, ENISA and CGVM share at least one label for 88.84% of their overlapping CVEs, but only 1.41% have identical label sets. CVE2Attack and SMET show moderate agreement, whereas KEV has relatively low agreement with several external datasets. These differences indicate that the same CVE may receive different ATT&CK labels across datasets. Consequently, candidates supported by similar evidence may be treated as positive examples in one dataset but as negative examples in another. Cross-dataset performance therefore reflects both model generalization and differences in annotation scope and labeling criteria.

4.3

Evaluation Design

We conduct experiments to answer the following questions. • RQ1: Can Step 1 preserve relevant techniques while maintaining a compact candidate pool? • RQ2: Can the proposed reranker improve candidate ordering across different datasets? • RQ3: Is candidate restriction necessary for controllable CVE to ATT&CK mapping? • RQ4: How does the proposed framework compare with existing baselines?

Full Cov.

Partial Cov.

Avg. Cand.

0.6780 0.7067 0.8412 0.9333 0.4395 0.7619

1.0000 0.9600 0.9511 0.9778 0.9994 0.9705

80.00 80.00 79.93 79.81 79.67 79.63

Note. Full Cov. denotes the proportion of CVEs for which all ground-truth techniques are retained. Partial Cov. denotes the proportion of CVEs for which at least one ground-truth technique is retained. Avg. Cand. denotes the average number of retained candidates per CVE.

Evaluation metrics: (i) Normalized Discounted Cumulative Gain at 10 (NDCG@10) [20] measures ranking quality within the top 10 while assigning greater importance to higher positions. (ii) Mean Reciprocal Rank (MRR) computes the reciprocal rank of the first ground-truth technique for each CVE and reports the mean across the evaluation set. (iii) Hit Rate at 10 (Hit@10) indicates whether at least one ground-truth technique appears in the top 10. 4.3.1 RQ1: Candidate Pool Quality. Table 3 reports the quality of the candidate pools produced by Step 1 on six datasets. With 𝜏 = 0.90, 𝐾min = 8, and 𝐾max = 80, Step 1 reduces the search space of 201 parent-level ATT&CK techniques by approximately 60%. Despite this reduction, Step 1 retains at least one ground-truth technique for 95.11%–100% of CVEs across the six datasets. These results show that Step 1 constructs a bounded candidate pool while maintaining high partial coverage. In ENISA and CGVM, full-coverage rates are 43.95% and 76.19%, respectively, despite partial-coverage rates of 99.94% and 97.05%. This gap is primarily due to their denser multi-label annotations, averaging 8.03 and 5.48 ground-truth techniques per CVE, respectively. Since full coverage requires retaining every ground-truth technique, missing even one label results in a full-coverage failure, while partial coverage only requires retaining at least one. Consequently, high partial coverage can coexist with lower full coverage on densely annotated datasets. 4.3.2 RQ2: Reranking Performance across Datasets. Table 4 compares the Step 1 candidate ordering with Step 2 reranking over exactly the same dynamically selected candidate pools. Thus, all observed differences are attributable to reranking rather than to the retrieval of additional techniques. Step 2 improves all five ranking metrics on five of the six datasets. The largest gains occur on KEV and ATCM: NDCG@10 increases from 0.3236 to 0.6042 on KEV and from 0.2912 to 0.5449 on ATCM. The improvement is also substantial on ENISA, where Hit@10 increases from 0.5636 to 0.8872. SMET is the only exception, with NDCG@10 decreasing from 0.4618 to 0.4399 and Hit@10 decreasing from 0.8074 to 0.7741. This behavior reflects a benchmark-specific semantic mismatch. SMET follows a semantic attack-vector mapping procedure: CVE descriptions are decomposed into attack vectors and mapped to ATT&CK techniques through semantic correspondence with ATT&CK attack vectors. In contrast, Step 2 uses SecRoBERTa-based CVE–technique

CVE-to-ATT&CK Mapping via Evidence-Constrained Ranking

Table 4: Effect of Step 2 reranking over the same dynamically selected candidate pools. Step 1 Candidate Ordering Dataset KEV ATCM CVE2Attack SMET ENISA CGVM

Step 2 Reranking

Gain

NDCG@10

MRR

Hit@1

Hit@5

Hit@10

NDCG@10

MRR

Hit@1

Hit@5

Hit@10

ΔNDCG

ΔMRR

ΔHit@1

ΔHit@5

ΔHit@10

0.3236 0.2912 0.3631 0.4618 0.2183 0.4113

0.4196 0.3476 0.3902 0.4414 0.2282 0.3882

0.2712 0.2133 0.2626 0.2704 0.0704 0.1965

0.5932 0.5467 0.5320 0.6741 0.4370 0.6981

0.7627 0.6533 0.6697 0.8074 0.5636 0.7995

0.6042 0.5449 0.4268 0.4399 0.3097 0.4720

0.7404 0.5816 0.4319 0.4127 0.3395 0.5019

0.6271 0.4267 0.2822 0.2407 0.1234 0.3194

0.8983 0.8133 0.6110 0.6222 0.6340 0.7455

0.9661 0.9200 0.7457 0.7741 0.8872 0.8495

+0.2806 +0.2537 +0.0637 −0.0220 +0.0915 +0.0607

+0.3207 +0.2340 +0.0417 −0.0286 +0.1113 +0.1138

+0.3559 +0.2133 +0.0196 −0.0296 +0.0530 +0.1229

+0.3051 +0.2667 +0.0790 −0.0519 +0.1970 +0.0475

+0.2034 +0.2667 +0.0760 −0.0333 +0.3236 +0.0500

interaction representations. This difference in semantic representation can alter the ordering of related techniques and reduce agreement with SMET’s labeling criteria, even when the candidate pool contains relevant techniques. Accordingly, the SMET decrease should be interpreted as sensitivity to annotation semantics rather than a failure of candidate-pool preservation. 4.3.3 RQ3: Effectiveness of Candidate-Pool Restriction. Table 5 reports the results on the KEV dataset. Restricting the mapping space to the Step 1 candidate pool improves all ranking metrics for both LLMs. For GPT-4o-mini, NDCG@10 increases from 0.3553 to 0.5172 and MRR increases from 0.5236 to 0.6767. Hit@10 also improves from 0.6959 to 0.9155. GPT-5.4-mini also improves consistently across all five metrics. Although the gains are smaller than those observed for GPT-4o-mini, its Hit@10 increases from 0.9155 to 0.9324. These results show that the benefit of Step 1 is not limited to our Step 2 reranker. Restricting the search space to the retained candidates can also improve the ranking performance of generalpurpose LLMs by reducing interference from irrelevant ATT&CK techniques while preserving relevant candidates. 4.3.4 RQ4: Comparison with Baselines. Figure 6 compares our framework TRACE with TRIAGE [18] and SMET [1]. TRACE achieves the best performance across all five metrics on both KEV and CVE2ATT&CK. On KEV, TRACE reaches an NDCG@10 of 0.6042 and an MRR of 0.7404, compared with 0.5627 and 0.6689 for TRIAGE. On CVE2ATT&CK, TRACE also achieves the highest ranking scores, including an NDCG@10 of 0.4268 and a Hit@10 of 0.7457, demonstrating its effectiveness across datasets with different annotation distributions. On the SMET dataset, the SMET baseline achieves the strongest performance, with an NDCG@10 of 0.5777 and a Hit@10 of 0.8556, compared with 0.4399 and 0.7741 for TRACE. This difference may reflect the benchmark-specific semantic alignment between the SMET method and its annotation procedure, whereas TRACE integrates heterogeneous structural and semantic evidence rather than relying exclusively on semantic attack-vector correspondence.

4.4

Ablation Study

We conduct ablation studies to isolate the contributions of the two-step design. For Step 1, we separately remove the structural, semantic retrieval branches, and direct lexical retrieval to assess their roles in retaining ground-truth techniques within a bounded candidate pool. For Step 2, we separately remove the SecRoBERTabased textual interaction representation and the Step 1 candidate features to evaluate their contributions to candidate reranking. We further evaluate robustness to missing evidence at inference time

Figure 6: Comparison of TRACE with the TRIAGE and SMET baselines. by removing individual evidence sources while keeping both model checkpoints frozen. Finally, we examine generalization to long-tail techniques. 4.4.1 Ablation Study of Step 1. Table 6 evaluates the contributions of the structural and semantic retrieval branches to candidate-pool construction. Removing the structural branch consistently causes the largest coverage loss. For example, on CVE2Attack, Label Coverage decreases from 0.8988 to 0.5045, while Partial Coverage decreases from 0.9511 to 0.5989, demonstrating that structural evidence provides the principal source of candidate recall. The effect of the semantic branch is dataset dependent. It substantially improves coverage on KEV and SMET and recovers candidates that are absent from the structural paths. Overall, the structural branch supplies the majority of candidate recall, whereas the semantic branch provides complementary but distribution-dependent evidence. 4.4.2 Ablation Study of Step 2. Table 7 evaluates the contributions of CVE–technique textual interactions and Step 1 evidence to

Kai Wei, Yuwen Cui, Kehan Shen, and Guangjing Wang

Table 5: Effect of candidate-pool construction on LLM-based CVE-to-ATT&CK mapping performance. Without Candidate Pool Model GPT-4o-mini GPT-5.4-mini

With Candidate Pool

Gain

NDCG@10

MRR

Hit@1

Hit@5

Hit@10

NDCG@10

MRR

Hit@1

Hit@5

Hit@10

ΔNDCG

ΔMRR

ΔHit@1

ΔHit@5

ΔHit@10

0.3553 0.5241

0.5236 0.6665

0.4291 0.5507

0.6318 0.8345

0.6959 0.9155

0.5172 0.5329

0.6767 0.6904

0.5473 0.5574

0.8615 0.8682

0.9155 0.9324

+0.1619 +0.0088

+0.1531 +0.0239

+0.1182 +0.0068

+0.2297 +0.0338

+0.2196 +0.0169

Table 6: Ablation study of Step 1 candidate-pool construction under the current CVE-level merged retrieval setting. Dataset

Method

Label Cov.

Full Cov.

Partial Cov.

Avg. Pool

KEV KEV KEV KEV

Full TRACE − Semantic retrieval − Structural retrieval − Direct retrieval

0.8387 0.6516 0.6129 0.6194

0.6780 0.3729 0.3390 0.3390

1.0000 0.9661 0.8305 0.8475

80.00 80.00 35.53 35.81

ATCM ATCM ATCM ATCM

Full TRACE − Semantic retrieval − Structural retrieval − Direct retrieval

0.8208 0.8266 0.4740 0.5029

0.7067 0.6667 0.3067 0.2933

0.9600 0.9467 0.6800 0.7600

80.00 80.00 29.79 30.88

CVE2Attack CVE2Attack CVE2Attack CVE2Attack

Full TRACE − Semantic retrieval − Structural retrieval − Direct retrieval

0.8988 0.8508 0.5045 0.5750

0.8412 0.7833 0.3702 0.4447

0.9511 0.9202 0.5989 0.6862

79.93 79.89 29.34 29.91

SMET SMET SMET SMET

Full TRACE − Semantic retrieval − Structural retrieval − Direct retrieval

0.9545 0.8712 0.6540 0.7298

0.9333 0.8222 0.5704 0.6444

0.9778 0.9185 0.7111 0.8074

79.81 79.61 32.09 32.66

ENISA ENISA ENISA ENISA

Full TRACE − Semantic retrieval − Structural retrieval − Direct retrieval

0.5791 0.5607 0.2055 0.3894

0.4395 0.4133 0.1640 0.3454

0.9994 0.9956 0.6590 0.8847

79.67 79.18 30.22 32.96

CGVM CGVM CGVM CGVM

Full TRACE − Semantic retrieval − Structural retrieval − Direct retrieval

0.7803 0.7476 0.2446 0.6264

0.7619 0.6818 0.2508 0.6305

0.9705 0.9465 0.6189 0.8908

79.63 79.20 27.49 30.96

Note. Label Cov. is the proportion of individual ground-truth parent-technique labels retained in the Step 1 dynamic candidate pool.

Table 7: Ablation study of the Step 2 reranker under the CVElevel merged candidate-pool setting. Dataset

Method

NDCG@10

MRR

Hit@1

Hit@5

Hit@10

KEV

Full model w/o SecRoBERTa w/o Step 1 evidence

0.6042 0.3433 0.5932

0.7404 0.4457 0.6956

0.6271 0.3051 0.5593

0.8983 0.5254 0.8814

0.9661 0.7797 0.9153

ATCM

Full model w/o SecRoBERTa w/o Step 1 evidence

0.5449 0.3002 0.4846

0.5816 0.3418 0.5199

0.4267 0.1867 0.3733

0.8133 0.5467 0.7067

0.9200 0.6800 0.8000

CVE2Attack

Full model w/o SecRoBERTa w/o Step 1 evidence

0.4268 0.3198 0.3556

0.4319 0.3416 0.3727

0.2822 0.2160 0.2378

0.6110 0.4808 0.5305

0.7457 0.6275 0.6479

SMET

Full model w/o SecRoBERTa w/o Step 1 evidence

0.4399 0.3661 0.3377

0.4127 0.3512 0.3206

0.2407 0.2037 0.1593

0.6222 0.5111 0.5000

0.7741 0.6815 0.6444

ENISA

Full model w/o SecRoBERTa interaction w/o all Step 1 evidence

0.3097 0.2815 0.3526

0.3395 0.3434 0.4047

0.1234 0.1870 0.2712

0.6340 0.5237 0.6165

0.8872 0.6652 0.8615

CGVM

Full model w/o SecRoBERTa w/o Step 1 evidence

0.4720 0.2758 0.3988

0.5019 0.2689 0.4569

0.3194 0.1197 0.3117

0.7455 0.4438 0.6306

0.8495 0.6301 0.7508

the Step 2 reranker. Removing the SecRoBERTa interaction representation decreases NDCG@10, Hit@5, and Hit@10 across all six datasets. The largest NDCG@10 decreases occur on KEV and ATCM, from 0.6042 to 0.3433 and from 0.5449 to 0.3002, respectively. On

ENISA, removing textual interactions increases MRR from 0.3395 to 0.3434 and Hit@1 from 0.1234 to 0.1870, but reduces Hit@10 from 0.8872 to 0.6652. These results demonstrate that textual interactions are essential for maintaining top-𝑘 ranking performance, although their effects on the highest-ranked predictions can vary across datasets. Removing all Step 1 evidence, including the candidate feature vector and preservation probability, decreases Hit@5 and Hit@10 across all six datasets. On SMET, NDCG@10 decreases from 0.4399 to 0.3377 and Hit@10 from 0.7741 to 0.6444. Similar reductions occur on ATCM and CVE2Attack, indicating that the retained evidence provides additional information for distinguishing relevant techniques beyond textual similarity. However, ENISA exhibits a different pattern: removing Step 1 evidence improves NDCG@10 from 0.3097 to 0.3526, MRR from 0.3395 to 0.4047, and Hit@1 from 0.1234 to 0.2712, while reducing Hit@10 from 0.8872 to 0.8615. This suggests that Step 1 evidence improves the inclusion of relevant techniques within the top-ranked results but may introduce less effective ordering signals for the highest-ranked predictions on ENISA. Overall, both information sources consistently improve Hit@5 and Hit@10 across all six datasets, demonstrating their complementary contributions to reranking. SecRoBERTa interactions provide the stronger and more consistent contribution to NDCG@10, whereas Step 1 evidence further improves top-𝑘 coverage. The mixed effects on MRR and Hit@1, particularly on ENISA, indicate that improving the inclusion of relevant techniques within the top𝑘 results does not necessarily improve their ordering at the highest ranks. 4.4.3 Performance on Missing Evidence. Table 8 shows that missing evidence affects both candidate coverage and ranking performance. Notably, Partial Coverage decreases by only 3.17 percentage points, compared with a 14.76-point decrease in Full Coverage, indicating that missing evidence affects complete label-set recovery more strongly than the preservation of at least one relevant technique. When both CWE and CVSS are unavailable, macro-average Label Coverage decreases from 0.8121 to 0.7160, Full Coverage from 0.7268 to 0.5792, and Partial Coverage from 0.9765 to 0.9448, while Hit@10 decreases from 0.8571 to 0.7570. These results indicate that the remaining evidence sources can still recover at least one relevant technique for most CVEs, but recovering complete label sets and ranking relevant techniques highly become more challenging. The effects also differ by source: removing CVSS reduces macro-average Hit@10 from 0.8571 to 0.7922, whereas removing CWE or CAPEC particularly affects ENISA and CGVM. Overall, TRACE maintains relatively strong performance under missing evidence, preserving high partial coverage and retaining useful ranking capability despite the reduced information.

CVE-to-ATT&CK Mapping via Evidence-Constrained Ranking

Table 8: Performance of TRACE under missing evidence at inference time. The Step 1 and Step 2 checkpoints remain frozen for all configurations. Macro Avg. denotes the average over the six datasets. Dataset

Evidence setting

Label Cov.

Full Cov.

Partial Cov.

NDCG@10

MRR

Hit@1

Hit@5

Hit@10

KEV

Full evidence w/o CWE w/o CVSS w/o CAPEC w/o SRL w/o CWE and CVSS

0.8387 0.8387 0.6968 0.8387 0.6968 0.6903

0.6780 0.6780 0.4068 0.6780 0.4746 0.3729

1.0000 1.0000 0.9322 1.0000 0.9831 0.9492

0.6042 0.6008 0.4979 0.6042 0.5448 0.4920

0.7404 0.7326 0.6433 0.7408 0.6685 0.6548

0.6271 0.6102 0.5254 0.6271 0.5424 0.5424

0.8983 0.8983 0.8136 0.8983 0.8814 0.8305

0.9661 0.9831 0.8475 0.9661 0.9322 0.8644

ATCM

Full evidence w/o CWE w/o CVSS w/o CAPEC w/o SRL w/o CWE and CVSS

0.8208 0.8000 0.7771 0.8114 0.7771 0.7771

0.7067 0.6933 0.6133 0.7067 0.6267 0.6133

0.9600 0.9600 0.9467 0.9600 0.9467 0.9467

0.5449 0.5430 0.4762 0.5413 0.4725 0.4788

0.5816 0.5746 0.5263 0.5756 0.5154 0.5216

0.4267 0.4133 0.3467 0.4133 0.3467 0.3467

0.8133 0.8133 0.7600 0.8267 0.7600 0.7333

0.9200 0.9200 0.8267 0.9333 0.8933 0.8400

CVE2Attack

Full evidence w/o CWE w/o CVSS w/o CAPEC w/o SRL w/o CWE and CVSS

0.8988 0.8902 0.8115 0.8980 0.8236 0.7817

0.8412 0.8284 0.7171 0.8397 0.7449 0.6734

0.9511 0.9436 0.9014 0.9488 0.9097 0.8789

0.4268 0.4295 0.3872 0.4263 0.3645 0.3611

0.4319 0.4349 0.4067 0.4302 0.3692 0.3925

0.2822 0.2799 0.2656 0.2777 0.2212 0.2573

0.6110 0.6238 0.5854 0.6147 0.5433 0.5621

0.7457 0.7517 0.7035 0.7555 0.6862 0.6764

SMET

Full evidence w/o CWE w/o CVSS w/o CAPEC w/o SRL w/o CWE and CVSS

0.9545 0.9571 0.9040 0.9545 0.8965 0.8939

0.9333 0.9370 0.8704 0.9333 0.8519 0.8556

0.9778 0.9815 0.9556 0.9778 0.9481 0.9519

0.4399 0.4715 0.3701 0.4248 0.3438 0.3728

0.4127 0.4498 0.3474 0.3944 0.3154 0.3689

0.2407 0.2889 0.1704 0.2185 0.1444 0.2111

0.6222 0.6296 0.5481 0.6111 0.5037 0.5481

0.7741 0.7815 0.7000 0.7704 0.6889 0.6963

ENISA

Full evidence w/o CWE w/o CVSS w/o CAPEC w/o SRL w/o CWE and CVSS

0.5791 0.4699 0.5974 0.4680 0.6101 0.5158

0.4395 0.4034 0.4289 0.4046 0.4408 0.3884

0.9994 0.9963 0.9988 0.9975 0.9994 0.9975

0.3097 0.1718 0.2851 0.1804 0.3524 0.1483

0.3395 0.2186 0.2954 0.2200 0.3810 0.1809

0.1234 0.0249 0.0867 0.0299 0.1559 0.0193

0.6340 0.4688 0.5848 0.4638 0.7001 0.3510

0.8872 0.8198 0.8435 0.8229 0.9021 0.7132

CGVM

Full evidence w/o CWE w/o CVSS w/o CAPEC w/o SRL w/o CWE and CVSS

0.7803 0.6131 0.7943 0.6124 0.7890 0.6372

0.7619 0.5759 0.7516 0.5842 0.7510 0.5715

0.9705 0.9477 0.9635 0.9519 0.9592 0.9446

0.4720 0.2730 0.4589 0.2832 0.5405 0.2729

0.5019 0.2991 0.4904 0.3145 0.5856 0.3059

0.3194 0.1128 0.3173 0.1385 0.4219 0.1373

0.7455 0.5593 0.7224 0.5553 0.7957 0.5326

0.8495 0.7747 0.8319 0.7753 0.8649 0.7515

Macro Avg.

Full evidence w/o CWE w/o CVSS w/o CAPEC w/o SRL w/o CWE and CVSS

0.8121 0.7615 0.7635 0.7638 0.7655 0.7160

0.7268 0.6860 0.6313 0.6911 0.6483 0.5792

0.9765 0.9715 0.9497 0.9727 0.9577 0.9448

0.4663 0.4149 0.4126 0.4100 0.4364 0.3543

0.5013 0.4516 0.4516 0.4459 0.4725 0.4041

0.3366 0.2883 0.2853 0.2842 0.3054 0.2524

0.7207 0.6655 0.6690 0.6617 0.6974 0.5929

0.8571 0.8385 0.7922 0.8373 0.8279 0.7570

4.4.4 Performance on Long-Tail Techniques. To evaluate cross-dataset generalization to low-frequency and unseen techniques, we calculate each technique’s frequency using the ground-truth labels in the pooled KEV, ATCM, and ENISA training partitions. A technique is counted at most once for each training CVE whose ground-truth set contains it. We classify techniques with more than 50 training occurrences as Head, those with 20–50 occurrences as Medium, those with 1–19 occurrences as Tail, and those with no training occurrences as Unseen.

Table 9 reports the performance of these four frequency groups on the external CVE2Attack, SMET, and CGVM datasets. Step 1 retains substantial coverage of Tail and Unseen techniques across all three external datasets. For Tail techniques, Partial Cov. reaches 0.9238, 0.9813, and 0.8643 on CVE2Attack, SMET, and CGVM, respectively. For Unseen techniques, it remains 0.7000, 1.0000, and 0.8185. However, ranking performance degrades markedly for rare techniques. These results show that Step 1 can often retain lowfrequency and unseen techniques in the candidate pool, while accurately prioritizing them remains challenging.

Kai Wei, Yuwen Cui, Kehan Shen, and Guangjing Wang

Table 9: Performance across technique-frequency groups on external evaluation datasets. Dataset

Group

#Tech.

#Gold Cases

Partial Cov.

Hit@10

NDCG@10

MRR

CVE2Attack

Head Medium Tail Unseen

12 5 12 2

867 419 551 40

0.9423 0.8783 0.9238 0.7000

0.8316 0.7661 0.2632 0.0000

0.5294 0.4399 0.1071 0.0000

0.4938 0.3574 0.0955 0.0157

SMET

Head Medium Tail Unseen

15 4 16 5

148 105 107 6

0.9527 0.9524 0.9813 1.0000

0.7838 0.8381 0.4206 0.0000

0.4749 0.5433 0.1725 0.0000

0.4041 0.4607 0.1294 0.0269

CGVM

Head Medium Tail Unseen

33 3 18 14

23,638 2,340 11,729 2,039

0.9929 0.9688 0.8643 0.8185

0.9118 0.9274 0.2297 0.0113

0.5128 0.6237 0.0718 0.0035

0.5346 0.5770 0.0724 0.0219

Note. #Gold Cases denotes the number of CVEs containing at least one ground truth technique in each frequency group. A CVE may belong to multiple groups. Partial Cov. and Hit@10 measure whether at least one group-specific ground truth technique is retained in the Step 1 pool and final top 10, respectively. NDCG@10 and MRR are computed using only group-specific ground truth techniques.

Table 10: Sensitivity analysis of 𝜏 on the pooled KEV and ATCM validation partitions. 𝜏

Label Cov.

Full Cov.

Partial Cov.

Avg. Cand.

0.50 0.60 0.70 0.80 0.90†

0.8367 0.8453 0.8453 0.8453 0.8453

0.7015 0.7164 0.7164 0.7164 0.7164

0.9776 0.9776 0.9776 0.9776 0.9776

75.66 78.75 79.64 79.84 79.91

† denotes the setting used in the main experiments.

4.5

Hyperparameter Study

4.5.1 Sensitivity to 𝜏. The score-mass threshold 𝜏 is used during Step 1 inference to determine the number of candidates retained for each CVE. After candidates are sorted by their preservation scores, the scores are normalized to sum to one. Step 1 retains the smallest prefix whose cumulative normalized score reaches 𝜏, subject to the fixed bounds 𝐾min = 8 and 𝐾max = 80. A larger 𝜏 generally preserves more candidates and may improve coverage, but it also increases the candidate-pool size passed to Step 2. Table 10 shows that increasing 𝜏 from 0.50 to 0.60 improves Label Coverage from 0.8367 to 0.8453 and Full Coverage from 0.7015 to 0.7164, while Partial Coverage remains at 0.9776. Beyond 𝜏 = 0.60, coverage saturates, and the average candidate-pool size increases only marginally from 78.75 to 79.91. We adopt 𝜏 = 0.90 as a conservative candidate-retention setting, prioritizing the preservation of potentially relevant techniques over aggressive early pruning. Since the candidate-pool size is already constrained by 𝐾max = 80, a higher threshold introduces little additional computational overhead while allowing Step 2 to make the final ranking decisions based on richer CVE–technique interactions. 4.5.2 Sensitivity to 𝜆freq . The frequency-penalty coefficient 𝜆freq appears in the final Step 2 scoring function and controls the penalty applied to frequently observed techniques. Table 11 shows that the effect of 𝜆freq varies across datasets and ranking metrics. On KEV, Hit@10 remains unchanged at 0.9661 across all tested values, while NDCG@10 and MRR fluctuate. On

Table 11: Sensitivity analysis of 𝜆freq on the KEV and ATCM validation partitions.

𝜆freq

NDCG@10

KEV MRR

Hit@10

NDCG@10

ATCM MRR

Hit@10

0.00 0.05 0.10† 0.20

0.5875 0.5930 0.5834 0.5890

0.7255 0.7585 0.7151 0.7469

0.9661 0.9661 0.9661 0.9661

0.6238 0.6051 0.6050 0.5992

0.6905 0.6830 0.6853 0.7018

0.8933 0.8933 0.9067 0.8667

Table 12: Sensitivity analysis of the pairwise margin 𝛾 on the KEV and ATCM validation partitions.

𝛾

NDCG@10

KEV MRR

Hit@10

NDCG@10

ATCM MRR

Hit@10

0.50 1.00† 1.50 2.00

0.5819 0.5834 0.5921 0.5859

0.7119 0.7151 0.7341 0.6938

0.9492 0.9661 0.9661 0.9661

0.6216 0.6050 0.6095 0.6078

0.6914 0.6853 0.6944 0.6775

0.8933 0.9067 0.8800 0.8933

ATCM, increasing the penalty from 0.00 to 0.10 improves Hit@10 from 0.8933 to 0.9067, whereas a stronger penalty of 0.20 reduces it to 0.8667. We adopt 𝜆freq = 0.10 as a moderate frequency regularization setting, intended to reduce the dominance of frequently observed techniques without excessively suppressing candidates supported by other evidence. 4.5.3 Sensitivity to 𝛾. The margin 𝛾 appears in the supervised pairwise loss used to train the Step 2 reranker. It controls the required score separation between ground-truth and incorrect candidates and is not used during inference. Table 12 shows that ranking performance varies moderately across the tested margins, without a consistent improvement as 𝛾 increases. On KEV, Hit@10 reaches 0.9661 for all margins greater than or equal to 1.00, while on ATCM, 𝛾 = 1.00 achieves the highest Hit@10 of 0.9067. We adopt 𝛾 = 1.00 as a standard unit-margin constraint, encouraging the reranker to distinguish relevant from irrelevant techniques without imposing an unnecessarily large score separation.

5

CONCLUSION

In this work, we formulate CVE-to-ATT&CK mapping as an evidenceconstrained data integration and ranking problem. So we propose TRACE, a two-step framework that integrates heterogeneous security evidence to construct high-coverage candidate pools and prioritizes techniques through evidence-aware ranking. Experiments across six public datasets show that TRACE reduces the ATT&CK search space by approximately 60% while retaining at least one ground-truth technique for 95.11%–100% of CVEs. The work offers a reusable design for integrating heterogeneous, incomplete, and inconsistent data sources to infer implicit relationships, with demonstrated effectiveness in vulnerability-to-adversary behavior mapping. Given the growing volume and diversity of cybersecurity threat intelligence data, we hope this work inspires further research on evidence-aware data integration to support more reliable security analysis and data-driven decision-making.

CVE-to-ATT&CK Mapping via Evidence-Constrained Ranking

References [1] Basel Abdeen, Ehab Al-Shaer, Anoop Singhal, Latifur Khan, and Kevin Hamlen. 2023. Smet: Semantic mapping of cve to att&ck and its application to cybersecurity. In IFIP annual conference on data and applications security and privacy. Springer, 243–260. [2] Allen Institute for AI. 2022. AllenNLP Models: Officially Supported AllenNLP Models. https://github.com/allenai/allennlp-models. Archived December 16, 2022. [3] Benjamin Ampel, Sagar Samtani, Steven Ullman, and Hsinchun Chen. 2021. Linking Common Vulnerabilities and Exposures to the MITRE ATT&CK Framework: A Self-Distillation Approach. arXiv:2108.01696 [cs.CR] https://arxiv.org/abs/ 2108.01696 [4] Anthropic. 2026. Assessing Claude Mythos Preview’s Cybersecurity Capabilities. https://red.anthropic.com/2026/mythos-preview/. [Accessed: 2026-05-03]. [5] Ahmad Basel. 2023. ATT&CK BERT: A Cybersecurity Language Model. https:// huggingface.co/basel/ATTACK-BERT. Hugging Face model repository, accessed July 16, 2026. [6] Anson Bastos, Abhishek Nadgeri, Kuldeep Singh, Isaiah Onando Mulang, Saeedeh Shekarpour, Johannes Hoffart, and Manohar Kaul. 2021. RECON: relation extraction using knowledge graph context in a graph neural network. In Proceedings of the web conference 2021. 1673–1685. [7] Ioana Branescu, Octavian Grigorescu, and Mihai Dascalu. 2024. Automated Mapping of Common Vulnerabilities and Exposures to MITRE ATT&CK Tactics. Information 15, 4 (2024). doi:10.3390/info15040214 [8] Center for Threat-Informed Defense. 2026. ATT&CK to CVE Mappings Dataset. https://github.com/center-for-threat-informed-defense/attack_to_cve/ blob/master/Att%26ckToCveMappings.csv. [Accessed: 2026-05-05]. [9] CVE Program. 2026. CVE-2026-73570. https://nvd.nist.gov/vuln/detail/cve-202673570. CVE Record. [10] Saad El Jaouhari, Nouredine Tamani, and Rohan Isaac Jacob. 2024. GuardLink: Dynamic Linking of CVE to MITRE ATT&CK Techniques using Machine Learning. In GLOBECOM 2024 - 2024 IEEE Global Communications Conference. 4811–4817. doi:10.1109/GLOBECOM52923.2024.10900988 [11] European Union Agency for Cybersecurity (ENISA). 2026. Vulnerability Report Repository. https://github.com/enisaeu/vuln-report/. [Accessed: 2026-05-05]. [12] Octavian Grigorescu, Andreea Nica, Mihai Dascalu, and Razvan Rughinis. 2022. CVE2ATT&CK: BERT-Based Mapping of CVEs to MITRE ATT&CK Techniques. Algorithms 15, 9 (2022). doi:10.3390/a15090314 [13] Jonas Guan, Tom Blanchard, Hanna Foerster, Hengrui Jia, Gabriel Huang, and Nicolas Papernot. 2026. AI Agents Enable Adaptive Computer Worms. arXiv:2606.03811 [cs.CR] https://arxiv.org/abs/2606.03811 [14] Jiafeng Guo, Yixing Fan, Qingyao Ai, and W Bruce Croft. 2016. A deep relevance matching model for ad-hoc retrieval. In Proceedings of the 25th ACM international on conference on information and knowledge management. 55–64. [15] Ariful Haque, Sunzida Siddique, Md. Mahfuzur Rahman, Ahmed Rafi Hasan, Laxmi Rani Das, Marufa Kamal, Tasnim Masura, and Kishor Datta Gupta. 2025. SOK: Exploring Hallucinations and Security Risks in AI-Assisted Software Development with Insights for LLM Deployment. arXiv:2502.18468 [cs.SE] https://arxiv.org/abs/2502.18468 [16] Erik Hemberg, Jonathan Kelly, Michal Shlapentokh-Rothman, Bryn Reinstadler, Katherine Xu, Nick Rutar, and Una-May O’Reilly. 2021. Linking Threat Tactics, Techniques, and Patterns with Defensive Weaknesses, Vulnerabilities and Affected Platform Configurations for Cyber Hunting. arXiv:2010.00533 [cs.CR] https://arxiv.org/abs/2010.00533 [17] Aidan Hogan, Eva Blomqvist, Michael Cochez, Claudia d’Amato, Gerard De Melo, Claudio Gutierrez, Sabrina Kirrane, José Emilio Labra Gayo, Roberto Navigli, Sebastian Neumaier, et al. 2021. Knowledge graphs. ACM Computing Surveys (Csur) 54, 4 (2021), 1–37. [18] Anders Mølmen Høst, Pierre Lison, and Leon Moonen. 2025. A Systematic Approach to Predict the Impact of Cybersecurity Vulnerabilities Using LLMs. arXiv:2508.18439 [cs.CR] [19] jackaduma. 2026. SecRoBERTa. https://huggingface.co/jackaduma/SecRoBERTa. Hugging Face model repository, accessed July 16, 2026. [20] Kalervo Järvelin and Jaana Kekäläinen. 2002. Cumulated gain-based evaluation of IR techniques. ACM Trans. Inf. Syst. 20, 4 (Oct. 2002), 422–446. doi:10.1145/ 582415.582418 [21] Xiaoxi Li, Jiajie Jin, Yujia Zhou, Yuyao Zhang, Peitian Zhang, Yutao Zhu, and Zhicheng Dou. 2025. From matching to generation: A survey on generative information retrieval. ACM Transactions on Information Systems 43, 3 (2025), 1–62. [22] Xin Liu, Yuan Tan, Zhenghang Xiao, Jianwei Zhuge, and Rui Zhou. 2023. Not The End of Story: An Evaluation of ChatGPT-Driven Vulnerability Description Mappings. In Findings of the Association for Computational Linguistics: ACL 2023, Anna Rogers, Jordan Boyd-Graber, and Naoaki Okazaki (Eds.). Association for Computational Linguistics, Toronto, Canada, 3724–3731. doi:10.18653/v1/2023. findings-acl.229

[23] MITRE Center for Threat-Informed Defense. 2026. Known Exploited Vulnerabilities (KEV) to MITRE ATT&CK Mappings. https://center-for-threat-informeddefense.github.io/mappings-explorer/external/kev/all-data.html. [Accessed: 2026-05-03]. [24] MITRE Corporation. 2025. CWE-917: Improper Neutralization of Special Elements used in an Expression Language Statement (’Expression Language Injection’). https://cwe.mitre.org/data/definitions/917.html. [25] MITRE Corporation. 2026. Common Attack Pattern Enumeration and Classification (CAPEC). https://capec.mitre.org/. [Accessed: 2026-05-03]. [26] MITRE Corporation. 2026. Common Vulnerabilities and Exposures (CVE). https: //www.cve.org/. [Accessed: 2026-05-03]. [27] MITRE Corporation. 2026. Common Weakness Enumeration (CWE). https: //cwe.mitre.org/. [Accessed: 2026-05-03]. [28] MITRE Corporation. 2026. MITRE ATT&CK. https://attack.mitre.org/. Accessed: 2026-06-10. [29] National Institute of Standards and Technology. [n. d.]. CVSS v3.1 Calculator for CVE-2021-44228. https://nvd.nist.gov/vuln-metrics/cvss/v3calculator?cveId=CVE-2021-44228&vector=CVSS:3.1/AV:N/AC:L/PR:N/UI: N/S:C/C:H/I:H/A:H&version=3.1&sourceName=nvd@nist.gov. Accessed: 2026-10-17. [30] National Institute of Standards and Technology. 2021. CVE-2021-44228 Detail. https://nvd.nist.gov/vuln/detail/CVE-2021-44228. [31] National Institute of Standards and Technology. 2026. NIST Updates NVD Operations to Address Record CVE Growth. https://www.nist.gov/news-events/news/ 2026/04/nist-updates-nvd-operations-address-record-cve-growth Published April 15, 2026. [32] National Institute of Standards and Technology (NIST). 2026. Common Vulnerability Scoring System (CVSS) - Vulnerability Metrics. https://nvd.nist.gov/vulnmetrics/cvss. [Accessed: 2026-05-03]. [33] Hammond Pearce, Baleegh Ahmad, Benjamin Tan, Brendan Dolan-Gavitt, and Ramesh Karri. 2021. Asleep at the Keyboard? Assessing the Security of GitHub Copilot’s Code Contributions. arXiv:2108.09293 [cs.CR] https://arxiv.org/abs/ 2108.09293 [34] Pasha Rafiey and Amin Namadchian. 2025. Mapping Vulnerability Description to MITRE ATT&CK Framework by LLM. Adv. Artif. Intell. Mach. Learn. 5 (2025), 4379–4396. https://api.semanticscholar.org/CorpusID:281542544 [35] Ziyu Wang, Liyi Zeng, Lin Zhong, Ye Wang, Huan Zhang, Zhaoquan Gu, and Yanchun Zhang. 2026. VDM-IoT: Context Enhanced Knowledge Graph-Prompted LLMs for Internet of Things Vulnerability Description Mappings. IEEE Internet of Things Journal 13, 8 (2026), 17105–17120. doi:10.1109/JIOT.2026.3661184 [36] Fengrui Yu and Yanhui Du. 2026. VDM-IOG, a framework of inference on graph in retrieval-augmented generation for vulnerability description mapping. Cybersecurity 9, 1 (2026), 14. [37] Chenhui Zhang, Le Wang, Dunqiu Fan, Junyi Zhu, Tang Zhou, Liyi Zeng, and Zhaohua Li. 2024. VTT-LLM: Advancing Vulnerability-to-Tactic-and-Technique Mapping through Fine-Tuning of Large Language Model. Mathematics 12, 9 (2024). doi:10.3390/math12091286

Related documents

• CVE-to-ATT&CK Mapping via Evidence-Constrained Ranking#1456747
• Polar: LLM-Powered Synthesis of Real-World Cyber Evidence for Prioritization and Mitigation#1216673
• JEV as a Judge for Agent Trace Security: An Empirical Comparison with Generative LLM Judges#1129475
• JEV as a Judge for Agent Trace Security: An Empirical Comparison with Generative LLM Judges#1108630
• EviRepair: Evidence-Driven Agents for Reliable Vulnerability Repair#1297843