Skip to content
NewA calmer, faster ZeroHour
Researchinfo

Evaluating the NIST Bugs Framework Against CWE as a Successor for Automated Vulnerability Classification

arXiv cs.CRby Md Nazmul Hoque ()1 min read2 · 1 read
Read at arxiv.org
AI summary · glm-5.3Summaries by Vani AI

NIST Bugs Framework evaluation shows it is more structured and automation-friendly than CWE for automated vulnerability classification, with gaps in attribute guidance.

The paper evaluates NIST SP 800-231's Bugs Framework (BF) against CWE as a target for automated CVE classification using a systematically screened corpus of CVE-to-CWE research. An inter-rater study with 2 subject-matter experts mapping 13 CVEs showed strong agreement on BF's cause and operation axes but only fair agreement on the attribute axis. Automated classification was tested across two LLM deployments under different budgets, and findings support BF as more structured and automation-friendly than CWE, though gaps include under-specified attribute guidance and missing fix commits for closed-source software.

Key facts
  • Inter-rater study: strong agreement on cause/operation axes, fair on attributes
  • BF outperforms CWE for automated, reproducible CVE classification
  • LLM-based automated BF classification tested across two deployments
  • Gaps include under-specified attribute guidance and missing fix commits for closed-source software
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat
Tags
bugs-frameworkcvecwellmnistroot-cause-analysisvulnerability-classification

From the original article

1 min read at arxiv.org

Vulnerability classification based on root cause weaknesses is essential for numerous cybersecurity activities, where the Common Weakness Enumeration (CWE) serves as a public repository of such flaws. However, its overlapping entries create a non-orthogonal structure. The result is the same vulnerability being mapped to multiple weaknesses, complicating Root Cause Analysis (RCA) and triage.

arXiv cs.CR

By Md Nazmul Hoque · arxiv.org

Read the full article at arXiv cs.CR

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.