Multi-Class vs. Multi-Label BERT for CVE-to-CWE Mapping: How Taxonomy Structure Shapes the Errors

Jul 16, 2026

CVE-to-CWE assignment remains a largely manual step in vulnerability analysis. The study formulates CWE prediction as text classification and compares two modelling strategies: multi-class (one CWE per CVE) versus multi-label (multiple CWEs per CVE). Three transformer encoders—BERT Base, SecureBERT, and CySecBERT—are tested on nested label spaces (83, 47, 25 classes). Multi-class achieves higher macro-F1, while label-space shrink and multi-label threshold optimization reduce the gap. Error patterns align with the CWE hierarchy across all encoders, and hierarchy-relaxed evaluation boosts macro-F1 from ~81% to ~90%.

LanguageEnglish

CategoryResearch & Report

FormatPDF

Pages9

Reading Time23 min

Abstract

Introduction

Research questions

Contributions

Background

CVE, CWE, and annotation granularity

MULTI-CLASS VS . MULTI-LABEL BERT FOR CVE-TO-CWE MAPPING: HOW TAXONOMY STRUCTURE SHAPES THE ERRORS* A PREPRINT Ana Schwengber Kelm mindsquare AG Bielefeld, Germany [ana.luisa.kelm@mindsquare.de](ana.luisa.kelm@mindsquare.de) Christian Bockermann Bochum University of Applied Sciences Bochum, Germany [christian.bockermann@hs-bochum.de](christian.bockermann@hs-bochum.de) arXiv :2607 .07573v 1 [ cs .LG] 8 Jul 2026 Jörg Frochte Bochum University of Applied Sciences Bochum, Germany [joerg.frochte@hs-bochum.de](joerg.frochte@hs-bochum.de) ABSTRACT Assigning Common Weakness Enumeration (CWE) categories to Common Vulnerabilities and Exposures (CVE) records remains an important but largely manual step in vulnerability analysis. We study this task as a text classification problem and compare two modelling choices: a multi-class formulation that predicts a single CWE per CVE and a multi-label formulation that allows multiple assignments. Three transformer encoders (BERT Base, SecureBERT, and CySecBERT) are evaluated on three nested label spaces (83, 47, and 25 classes) . Multi-class training achieves higher macro-F1 across all settings, although the gap to multi-label narrows from 21 to 2 percentage points as the label space shrinks. Post-hoc threshold optimisation on the multi-label side closes this gap on the 25-class setting. Confusion analysis shows that the dominant misclassification patterns follow the CWE hierarchy and are shared across all three encoders (Pearson r > 0.92), which suggests that the error structure is driven more by taxonomy design than by encoder choice. A hierarchy-relaxed evaluation that forgives within-family confusions raises macro-F1 from ∼81% to ∼90%, indicating that strict metrics understate branch-level classifier quality. CySecBERT achieves the strongest results overall, with statistically significant gains concentrated in the multi-label setting. Keywords CVE · CWE · vulnerability classification · cybersecurity NLP · error analysis · multi-label classification · domain-adaptive pretraining 1 Introduction In today’s increasingly interconnected digital landscape, modern IT infrastructures are becoming frequent targets of cyberattacks, many of which are only made possible due to flaws and vulnerabilities in the underlying software. To address these threats systematically, the Common Vulnerabilities and Exposures (CVE) program provides a standardized mechanism for identifying and cataloging publicly disclosed vulnerabilities [17] . This system enables interoperable referencing of security-relevant software defects across tools and organizations. Identifying individual vulnerabilities is, however, only the first step: effective vulnerability management requires understanding root causes. This is where the Common Weakness Enumeration (CWE) becomes essential [18] . While ∗Accepted for publication at ICANN 2026 (International Conference on Artificial Neural Networks) . This is the authors’ version of the work; the final authenticated version will be published by Springer. Software Bug/Defect CVE-2024-37032 Software Dev. Research Concepts Improper CWE-707 Access Control Improper Neutralization CWE-20 CWE-170 Figure 1: A CVE mapped to a CWE taxonomy node. The hierarchy mixes abstraction levels: CWE-707 (“Pillar”) and CWE-20 (“Base”) coexist as valid targets, creating uneven supervision for classifiers. a CVE describes a specific incident, CWE provides a community-developed taxonomy of the underlying weakness types. Mapping CVEs to CWEs enables pattern recognition across incidents [13], systematic mitigation [9, 7], and aggregation at the level of root causes [1] . This mapping is currently performed largely by hand, and the workload is growing rapidly: annual CVE volume has risen from approximately 1,500 in 1999 to over 40,000 in 2024 [5] . Automated classification is therefore not merely convenient but operationally necessary. From a machine-

FAQs

What problem does the paper address in vulnerability analysis?

It addresses the task of assigning CWE categories to CVE records, which is important but often performed manually.

How does the paper compare multi-class and multi-label modelling?

It compares a multi-class setup that predicts a single CWE per CVE with a multi-label setup that allows multiple CWE assignments, evaluating performance across different label-space sizes.

What role does the CWE taxonomy hierarchy play in the model errors?

The dominant misclassification patterns follow the CWE hierarchy and are shared across different BERT encoders, indicating the taxonomy structure drives much of the error structure.

Jul 16, 2026

Upload by Evangeline