Beyond the Description: Structured Metadata and Label Semantics for CVE-to-ATT&CK Mapping

Status: complete. Experiments and deployment described in the paper are done; code is VulnTrain v3.3.0; abstract within the arXiv limit (abstract.txt).

LaTeX source and experiment notes for the follow-up to arXiv:2607.25572 (Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion).

That paper concluded the classifier is label-quality bound, not data bound: more curated rows help monotonically, while LLM-labeled rows at ≈0.39 agreement help nowhere. This follow-up therefore adds information per example and per label instead of adding examples:

1. structured metadata as auxiliary input — CVSS vector components, CWE (gold and predicted), affected-product CPE — in a controlled, multi-seed ablation;
2. a learned re-ranking that uses the noisy CWE → CAPEC → ATT&CK derivation chain as an inference-time prior rather than as labels;
3. a label-semantics model (bi-/cross-encoder over official ATT&CK technique descriptions) targeting the rare-technique tail, including zero-shot evaluation on techniques below the classifier's vocabulary floor.

Code baseline: VulnTrain release v3.2.0 (tagged before any follow-up code change).

Repository contents

File	Purpose
main.tex, references.bib	Paper source (skeleton)
NOTES.md	Raw lab notebook: experiment plan, protocol invariants, log
trainer-logs/	Trainer logs behind every table (populated as experiments run)
description_length_analysis.py	Per-CVE audit of recall/hit rate by description length

Auditing short descriptions

The archived validator logs contain aggregate metrics, so they cannot establish whether descriptions shorter than 256 characters are less accurate. The validator exports the per-row predictions behind its metrics with --dump-predictions (VulnTrain de20d54 or later); run it once per same-session description-only checkpoint, then the audit:

mkdir -p predictions
for seed in 42 43 44 45 46; do
  vulntrain-validate-attack-classification --method classifier \
    --model results-biencoder/desc-seed${seed} \
    --dump-predictions predictions/desc-seed${seed}.jsonl
done
python3 description_length_analysis.py predictions/desc-seed{42..46}.jsonl --threshold 256

Each line must contain description, a non-empty list of gold ATT&CK IDs, and ranked ATT&CK IDs in descending score order. An optional label_sources string or list enables the label-source-stratified permutation test. The five same-session baseline outputs are reported separately so repeated predictions of the same CVEs are not mistaken for independent rows; an effect should have the same direction across seeds. The report includes four predeclared character-length bands, recall@5, hit@5 with Wilson intervals, and the label-source-adjusted short-minus-long recall difference. The adjusted contrast is a row-count-weighted mean of within-source differences, excluding source strata that do not contain both length groups; the permutation test uses this zero-centered statistic rather than the confounded overall difference. Character length is intentionally measured on the description alone: 256 characters is not the model's 512 token truncation limit.

Building the PDF

pdflatex main.tex
bibtex main
pdflatex main.tex
pdflatex main.tex

License

The paper text and figures are licensed under CC BY-SA 4.0 (see LICENSE).