README.md

metadata

title: CVE to MITRE ATT&CK Mapper
emoji: 🛡️
colorFrom: blue
colorTo: green
sdk: gradio
sdk_version: 6.22.0
app_file: app.py
short_description: Map CVE descriptions to MITRE ATT&CK techniques
python_version: '3.12'
startup_duration_timeout: 30m

CVE to MITRE ATT&CK Technique Mapper

This Space demonstrates the model CIRCL/vulnerability-attack-technique-classification-roberta-base, a RoBERTa-base multi-label classifier that maps free-text vulnerability (CVE) descriptions to MITRE ATT&CK Enterprise techniques.

The model was trained on a curated gold set of 1,207 CVEs assembled from expert MITRE CTID mappings, as described in the paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Usage

1. Paste a CVE / vulnerability description into the text box.
2. Click Classify.
3. The model returns the top-K MITRE ATT&CK techniques ranked by sigmoid probability, along with a high-confidence summary.

Technical details

• Architecture: roberta-base with a sigmoid head
• Labels: 53 parent MITRE ATT&CK techniques (sub-techniques collapsed)
• Input: Free-text vulnerability description (max 512 tokens)
• Output: Sigmoid probability for each of the 53 techniques

Links

• Paper (arXiv)
• Model card
• VulnTrain library
• Gold dataset