TRACE ranks CVE-to-ATT&CK mappings with constrained multi-evidence
Original title: CVE-to-ATT&CK Mapping via Evidence-Constrained Ranking
Candidate construction cuts a 201-technique space by about 60% while retaining a ground-truth technique for 95.11%–100% of CVEs.
Researchers frame CVE-to-ATT&CK mapping as multi-evidence constrained ranking. TRACE builds a bounded candidate pool from structural and semantic evidence across the full technique space, then reranks using accumulated evidence, CVE–technique text, and frequency-aware scoring. On six public datasets, candidate construction reduced the 201-technique search space by about 60% while keeping at least one ground-truth technique for 95.11%–100% of CVEs. The authors present this as a more controlled bridge from vulnerability data to adversary behavior.
- Evaluation covers six public datasets with different annotation processes.
- The candidate pool spans the complete ATT&CK technique space.
- Reranking combines evidence, textual interaction, and frequency-aware scores.
- Ground-truth retention ranged from 95.11% to 100% of CVEs.
- Organizations
- MITRE
From the original article
1 min read at arxiv.orgMapping CVEs to MITRE ATT&CK techniques helps defenders translate vulnerability information into hypotheses about adversary behavior. Automating this mapping is challenging because relevant evidence is fragmented across heterogeneous security sources. In addition, ATT&CK techniques can be semantically similar, and existing annotations cover a highly long-tailed subset of the technique space.
By Kai Wei · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.