hugging-apps/cve-to-mitre-attack-mapper

CVE to MITRE ATT&CK Technique Mapper

This Space demonstrates the model `CIRCL/vulnerability-attack-technique-classification-roberta-base`, a RoBERTa-base multi-label classifier that maps free-text vulnerability (CVE) descriptions to MITRE ATT&CK Enterprise techniques.

The model was trained on a curated gold set of 1,207 CVEs assembled from expert MITRE CTID mappings, as described in the paper *Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion*.

Usage

1. 1.Paste a CVE / vulnerability description into the text box.
2. 2.Click Classify.
3. 3.The model returns the top-K MITRE ATT&CK techniques ranked by sigmoid probability, along with a high-confidence summary.

Technical details

• —Architecture: roberta-base with a sigmoid head
• —Labels: 53 parent MITRE ATT&CK techniques (sub-techniques collapsed)
• —Input: Free-text vulnerability description (max 512 tokens)
• —Output: Sigmoid probability for each of the 53 techniques

Links

• —Paper (arXiv)
• —Model card
• —VulnTrain library
• —Gold dataset