README.md

---
title: CVE to MITRE ATT&CK Mapper
emoji: 🛡️
colorFrom: blue
colorTo: green
sdk: gradio
sdk_version: 6.22.0
app_file: app.py
short_description: Map CVE descriptions to MITRE ATT&CK techniques
python_version: "3.12"
startup_duration_timeout: 30m
---

# CVE to MITRE ATT&CK Technique Mapper

This Space demonstrates the model
[`CIRCL/vulnerability-attack-technique-classification-roberta-base`](https://huggingface.co/CIRCL/vulnerability-attack-technique-classification-roberta-base),
a RoBERTa-base multi-label classifier that maps free-text vulnerability (CVE)
descriptions to **MITRE ATT&CK Enterprise** techniques.

The model was trained on a curated gold set of 1,207 CVEs assembled from
expert MITRE CTID mappings, as described in the paper
[*Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and
the Limits of LLM-Assisted Label Expansion*](https://arxiv.org/abs/2607.25572).

## Usage

1. Paste a CVE / vulnerability description into the text box.
2. Click **Classify**.
3. The model returns the top-K MITRE ATT&CK techniques ranked by sigmoid
   probability, along with a high-confidence summary.

## Technical details

- **Architecture:** `roberta-base` with a sigmoid head
- **Labels:** 53 parent MITRE ATT&CK techniques (sub-techniques collapsed)
- **Input:** Free-text vulnerability description (max 512 tokens)
- **Output:** Sigmoid probability for each of the 53 techniques

## Links

- [Paper (arXiv)](https://arxiv.org/abs/2607.25572)
- [Model card](https://huggingface.co/CIRCL/vulnerability-attack-technique-classification-roberta-base)
- [VulnTrain library](https://github.com/vulnerability-lookup/VulnTrain)
- [Gold dataset](https://huggingface.co/datasets/CIRCL/vulnerability-attack-techniques)