CVE-TTP KG: Knowledge Graph Linking Software Vulnerabilities to Attack Behaviors

Technical Summary: CVE-TTP KG

Problem Statement
In the contemporary cybersecurity landscape, software vulnerabilities have evolved into strategic assets weaponized by threat actors. While repositories like the Common Vulnerabilities and Exposures (CVE) and the National Vulnerability Database (NVD) provide structured identifiers and technical metadata, they frequently lack operational context. Specifically, these databases do not inherently link vulnerabilities to attacker behaviors, such as tactics and techniques, which are essential for understanding how flaws are exploited in real-world scenarios. This disconnect limits the ability of security teams to prioritize threats based on adversary intent and capability. With over 40,000 new CVEs reported in 2024 alone, manual analysis is insufficient, necessitating automated solutions that can correlate vulnerability data with behavioral patterns defined in frameworks like MITRE ATT&CK.

Methodology
The authors propose the CVE-TTP Knowledge Graph (CVE-TTP KG), a framework designed to link software vulnerabilities to attacker behaviors (Tactics, Techniques, and Procedures). The system architecture comprises four primary modules:

1. Data Collection and Enrichment:

   • A dataset of 276,289 CVE records (1999–2025) was aggregated from NVD and the MITRE CVE List V5.
   • A multi-stage mapping pipeline (CVE → CWE → CAPEC → Technique → Tactic) was used to generate ground-truth labels for 178,233 enriched records. This process linked vulnerabilities to 95 ATT&CK techniques and 14 tactic categories.
   • To address the limitations of sparse public mappings, an automated classification model was developed to predict tactics and techniques directly from CVE textual descriptions.

2. CVE-to-TTP Classification:

   • Transformer-based models were fine-tuned for multi-label classification.
   • Two pre-trained cybersecurity-specific models were evaluated: SecBERT and CySecBERT.
   • Input instances combined the CVE identifier, textual description, and associated CWE identifier.

3. Entity and Relation Extraction (ERE):

   • A manually annotated dataset of 1,080 CVE descriptions was created, containing 24,820 entities and 43,608 relations, aligned with the STIX 2.0 schema.
   • Two extraction strategies were implemented and compared:
     • Pipeline Approach: A two-stage process using a BERT–BiLSTM–CRF architecture for Cybersecurity Entity Recognition (CER) followed by a BERT-based classifier for Relation Extraction (RE).
     • Joint Approach: A span-based transformer framework (using CySecBERT) that simultaneously extracts entities and relations, treating spans as candidates to avoid error propagation inherent in pipeline methods.

4. Knowledge Graph Construction:

   • Extracted triples ($<entity, relation, entity>$) were populated into a Neo4j graph database.
   • The graph models vulnerabilities, products, vendors, weaknesses, and TTPs as nodes, connected by semantic edges (e.g., affects, has_weakness, achieved_through, associated_with).

Key Contributions

• Novel Datasets: The authors introduced multi-label classification datasets for ATT&CK tactics and techniques, alongside a manually annotated dataset for vulnerability entity and relation extraction.
• Automated Classification Framework: Implementation of a transformer-based model to automatically map CVE descriptions to relevant ATT&CK tactics and techniques without relying solely on manual mapping.
• Comparative Extraction Analysis: Development and evaluation of both pipeline and joint learning approaches for extracting cybersecurity entities and their semantic relationships from vulnerability text.
• Structured Knowledge Graph: Construction of a comprehensive KG that integrates CVE data with adversarial behavior, enabling structured visualization and machine reasoning for threat detection and risk prioritization.

Experimental Results

• Classification Performance:
  • CySecBERT consistently outperformed SecBERT.
  • Technique Classification: CySecBERT achieved a macro F1-score of 87.71% and a Jaccard score of 0.9659.
  • Tactic Classification: CySecBERT achieved a macro F1-score of 96.16% and a Jaccard score of 0.9858.
• Entity and Relation Extraction Performance:
  • Pipeline Approach: Achieved an entity extraction macro F1-score of 0.86 and a relation extraction F1-score of 0.99.
  • Joint Approach: Achieved an entity extraction macro F1-score of 0.88 (micro-F1 0.9586) and a relation extraction macro F1-score of 0.78 (under strict NEC constraints).
• Graph Generation:
  • The Joint Model produced a more semantically precise graph, correctly identifying complex relationships (e.g., distinguishing "Denial of Service" as an impact type rather than a weakness) and reducing error propagation.
  • The Pipeline Model demonstrated high precision in relation extraction but suffered from semantic inconsistencies, such as replacing specific achieved_through relations with generic associated_with links and misclassifying vulnerability types.

Significance and Claims
The paper claims that the CVE-TTP KG addresses a critical gap in vulnerability analysis by explicitly modeling connections between CVEs and adversary behaviors. The authors assert that this approach enables:

• Deeper Understanding: A clearer view of exploitation patterns, threat objectives, and attack chains.
• Enhanced Situational Awareness: Structured visualization for human analysts and machine reasoning for automated threat detection.
• Scalability: An automated pipeline capable of processing the growing volume of vulnerability disclosures.

The authors conclude that while the joint model offers superior robustness in end-to-end extraction, future work is required to integrate Large Language Models (LLMs) to further improve extraction quality, specifically addressing challenges in entity disambiguation and coreference resolution.