Researchers Cédric Bonhomme and Alexandre Dulaunoy introduced a reproducible pipeline designed to map Common Vulnerabilities and Exposures (CVEs) to MITRE ATT&CK Enterprise techniques using free-text descriptions. Moving away from the traditional CWE-to-CAPEC-to-ATT&CK derivation chain, the authors trained a multi-label classifier on a curated gold dataset comprising 1,207 CVEs previously mapped by the MITRE Center for Threat-Informed Defense. This approach significantly outperformed zero-shot embedding-similarity baselines, approximately doubling the recall@5 metric. The study specifically investigated the efficacy of using Large Language Models (LLMs) to expand the training set through automated labeling. While initial tests suggested potential gains, the authors demonstrated that these improvements were evaluation artifacts caused by noise when selecting checkpoints from small test splits. Rigorous replication using a validation-split selection protocol revealed that LLM-generated labels—which showed only 0.39 agreement with expert annotations—provide no reliable performance boost. In fact, expanding the dataset with approximately 1,000 LLM-labeled CVEs caused macro-F1 to decrease by 0.04 and reduced coverage of rare techniques. The findings conclude that while increasing the volume of expert-curated data consistently improves model performance, LLM-assisted expansion is limited by poor label quality rather than dataset scale.
Read original
huggingface/daily-papers