Work

V2W-LLM: Automated Vulnerability to Weakness Mapping Based on Large Language Model

Year: 2026

Type: article

Abstract: To address the rapid growth of software vulnerabilities, the latency of manual expert classification, and the limitations of existing methods restricted to fixed categories, this paper proposes V2W-LLM, an automated vulnerability-to-weakness mapping model based on Large Language Models (LLMs). First, a dataset of CVE-CWE description pairs is constructed based on established expert correlations from MITRE. Subsequently, the LLM is instruction-tuned on this dataset to leverage its reasoning capabilities in generating CWE-style descriptive text for newly disclosed, unmapped vulnerabilities. Finally, using a BAAI-based embedding model, the semantic representations of the generated text and official CWE descriptions are computed to identify the optimal mapping via cosine similarity (Top-1). Experimental results indicate that V2W-LLM achieves an accuracy of 90.18% and a Macro-F1 of 87.64% in common categories. Furthermore, on the public ChatGPT-VDMEval and the latest 2024 NVD datasets, the model attains F1 scores of 86.02% and 94.02% respectively, validating its effectiveness in automating the vulnerability-to-weakness mapping process.

Source: Information

DOI: 10.3390/info17060513

Authors: Ziguo Wang, Mei Nian, Yaling Jing, Jun Zhang

Institutions: Xinjiang Normal University, Chinese Academy of Sciences, Xinjiang Technical Institute of Physics & Chemistry

Language: English

Topic: Web Application Security Vulnerabilities

Subfield: Information Systems

Field: Computer Science

Domain: Physical Sciences

Open Access status: gold

Estimated APC paid: $1,930

Funder: Natural Science Foundation of Xinjiang Province