Datasetpublic

Lightcap/cbeeg-evidence-graphs

CBEEG — Compute-Budgeted Exploitability Evidence Graphs (derived artifacts) Reproducible derived artifacts for the paper Compute-Budgeted Exploitability Evidence Graphs for Prospective Vulnerability Triage (Alpay & Alpay). The paper frames prospective CVE triage as a leakage-safe, compute-budgeted evidence selection problem: for each CVE we admit only public evidence visible by a fixed decision time, select a few documents under a budget, and attach an auditable evidence… See the full description on the dataset page: https://huggingface.co/datasets/Lightcap/cbeeg-evidence-graphs.

sourceHugging Faceotherupdated 3mo agoView on Hugging Face

0likes73downloads

Dataset Card

CBEEG — Compute-Budgeted Exploitability Evidence Graphs (derived artifacts)

Reproducible derived artifacts for the paper Compute-Budgeted Exploitability Evidence Graphs for Prospective Vulnerability Triage (Alpay & Alpay). The paper frames prospective CVE triage as a leakage-safe, compute-budgeted evidence selection problem: for each CVE we admit only public evidence visible by a fixed decision time, select a few documents under a budget, and attach an auditable evidence certificate to every risk score.

These are the GB-scale outputs that do not fit in the paper's arXiv ancillary bundle: bi-encoder embeddings, retrieval/rerank candidate edges, the temporal evidence graph (node tables), 12,012 risk certificates, and the full metrics table for the A–E experiment grid. The code lives with the paper; this repository holds the data needed to reproduce every figure and number.

Files

File	Rows / shape	Description
`cve_nodes.parquet`	25,000	CVE nodes: `cve_id, description, cwe_id, cvss_v3/v2/v4, severity, cve_year, published, decision_time, vendor, product, kev, kev_date_added, epss, epss_percentile, split`
`evidence_nodes.parquet`	56,050	Evidence corpus: `evidence_id, cve_id, source_layer, source, text*, timestamp, url, text_len, text_sha256`
`candidates.parquet`	1,200,000	Retrieved/reranked candidate edges: `cve_id, evidence_id, retrieval_score, rerank_score, source_layer, evidence_timestamp, decision_time, leak`
`retrieval_edges.parquet`	—	Selected edges with `selected`/`leak` flags
`cwe_nodes.parquet`	420	`cwe_id, name, n_cves`
`product_nodes.parquet`	531	`product_key, vendor, product, n_cves`
`certificates.jsonl`	12,012	One auditable evidence certificate per test CVE (nested `evidence[]` with layer, timestamp, score, leak flag)
`metrics.parquet` / `metrics.csv`	489	`experiment, setting, budget, split, metric, value` for the full A–E grid
`cve_emb.npy`	(25000, 768)	`e5-base-v2` CVE-description embeddings, L2-normalised float32
`evidence_emb.npy`	(56050, 768)	`e5-base-v2` evidence embeddings, L2-normalised float32

text* is redacted for restricted source layers (see below).

How to load

python

import numpy as np, pandas as pd
from huggingface_hub import hf_hub_download
R = "Lightcap/cbeeg-evidence-graphs"

cve   = pd.read_parquet(hf_hub_download(R, "cve_nodes.parquet", repo_type="dataset"))
cand  = pd.read_parquet(hf_hub_download(R, "candidates.parquet", repo_type="dataset"))
ev_emb = np.load(hf_hub_download(R, "evidence_emb.npy", repo_type="dataset"))
# certificates
import json
certs = [json.loads(l) for l in open(hf_hub_download(R, "certificates.jsonl", repo_type="dataset"))]

Or browse any table directly in the Dataset Viewer via the config dropdown.

Provenance

Built from public sources: CISA KEV, FIRST EPSS, NVD (publication dates), stasvinokur/cve-and-cwe-dataset-1999-2025, CIRCL/vulnerability-cwe-patch, exploitintel/cve-cwe-consensus, iris-sast/CWE-Bench-Java, and the HackerSignal multi-source corpus (DatasetSubmission/HackerSignal).

Redaction & terms (important)

HackerSignal is released for academic and defensive use only. To respect its terms, raw text from restricted layers (forum/discourse, exploit archives, fix commits, advisories, CIRCL patches) is redacted here: we keep evidence_id, source_layer, provenance, timestamp, text_len, and a truncated text_sha256, plus the embedding vectors and scores — enough to reproduce every number without redistributing the underlying corpora. Public NVD CVE/description text (source_layer = nvd_text) is kept verbatim. To recover restricted text, obtain the original datasets under their licenses and join on the provided ids/hashes.

Intended use

Defensive vulnerability triage and reproducibility research only. Do not use to build automated exploitation tooling, to operate a live threat feed, or to de-anonymise forum authors.

Citation

bibtex

@misc{alpay2026cbeeg,
  title  = {Compute-Budgeted Exploitability Evidence Graphs for Prospective Vulnerability Triage},
  author = {Alpay, Faruk and Alpay, Taylan},
  year   = {2026}
}