Technical Summary: CATBridge – Enhancing CVE-ATT&CK Alignment in Low-Resource Environments

1. Problem Statement

The alignment of Common Vulnerabilities and Exposures (CVE) with the MITRE ATT&CK framework is critical for active defense, yet it faces significant challenges in low-resource environments characterized by limited computational power and scarce high-quality labeled samples.

Existing approaches fall into three categories, each with distinct limitations:

• Machine Learning (ML) and Deep Learning (DL): While offering high detection accuracy, these methods struggle to capture deep semantic associations between specific vulnerability descriptions (e.g., "buffer overflow") and macro-level attack tactics (e.g., "privilege escalation"). They often rely on surface-level text features or require massive labeled datasets and computational resources.
• Prompt-based Large Language Models (LLMs): Models like GPT-5 or DeepSeek-R1 possess strong semantic understanding but suffer from high computational costs, low inference efficiency, and data privacy concerns, making them impractical for deployment in resource-constrained settings.
• Fine-tuned Small-scale LLMs: While computationally efficient and deployable, small models (e.g., 7B parameters) lack sufficient cybersecurity domain knowledge. They struggle to comprehend complex attack patterns, leading to poor performance on long-tail data and difficulty distinguishing between similar techniques.

The paper identifies three specific challenges in utilizing LLMs for this task in low-resource settings:

1. Long-tail Distribution: CVE data is imbalanced, with rare ATT&CK techniques lacking sufficient training samples. Knowledge extracted from large models tends to bias toward head-class samples.
2. Semantic Gap: A disconnect exists between the technical details of CVEs and the tactical objectives of ATT&CK. Small models fail to grasp the implicit reasoning required to bridge "vulnerability exploitation" to "attacker intent."
3. Technical Similarity: Many ATT&CK techniques share surface-level functional semantics (e.g., code execution) but differ fundamentally in tactical intent. Large models may overemphasize shared functions, failing to provide the discriminative logic needed for small models to learn clear decision boundaries.

2. Methodology: The CATBridge Framework

The authors propose CATBridge, a multi-stage knowledge enhancement framework that establishes a "teacher-student" collaboration mechanism. A large-scale LLM (Teacher) acts as a domain expert to guide a lightweight small-scale LLM (Student) through three progressive stages.

Stage 1: Targeted Data Enhancement

To address the long-tail distribution problem (C1), the framework employs refined prompt engineering to guide the Teacher model in synthesizing high-quality CVE samples for scarce ATT&CK technique categories.

• Mechanism: The Teacher is role-played as a "Cybersecurity Vulnerability Modeling Expert." It receives a target technique ID and seed CVE samples, then generates logically coherent, semantically standardized CVE descriptions specifically for underrepresented techniques.
• Goal: To alleviate sample scarcity without distorting key behavior semantics, effectively expanding the training data for long-tail classes.

Stage 2: Domain Knowledge Enhancement

To bridge the semantic gap (C2), the framework constructs a Vulnerability Knowledge Graph to create a logical chain from CVE to ATT&CK.

• Knowledge Graph Construction: The Teacher extracts structured domain knowledge (CWE for weaknesses, CAPEC for attack patterns) from enhanced CVE samples. Entities (Vulnerability, Weakness, Attack Pattern, Tactic/Technique) and relationships (hasWeakness, exploitedBy, mapsToTechnique) are organized into a graph.
• Knowledge Chain Extraction: An algorithm traverses the graph to extract complete chains: CVE → CWE → CAPEC → ATT&CK.
• Student Training: These chains are serialized into explicit textual contexts and incorporated into the Student model's training data via Supervised Fine-Tuning (SFT). This allows the Student to learn the cross-source logical relations directly, rather than relying on opaque reasoning paths.

Stage 3: Reasoning Knowledge Enhancement

To address technical similarity and improve discrimination (C3), the framework utilizes Chain-of-Thought (CoT) techniques.

• Discriminative Abstract Generation: For pairs of similar ATT&CK techniques that the Student struggles to distinguish, the Teacher generates structured summaries analyzing three dimensions based on the Cyber Kill Chain:
  1. Precondition: System state or access permissions required.
  2. Core Actions: Fundamental atomic operations executed.
  3. Achieved Outcomes: Tactical-level results and impact.
• Student Training: The Student undergoes a second SFT stage where training instances pair CVE samples with these Teacher-generated discriminative abstracts. This transfers the explicit reasoning logic, enabling the Student to learn clear decision boundaries between confusable techniques.

3. Key Contributions

• LLM-Driven Knowledge Acquisition: The paper introduces a "teacher-student" pipeline that extracts professional knowledge from large-scale LLMs to fine-tune small-scale LLMs. This addresses the trade-off between the high overhead of large models and the knowledge scarcity of small models in low-resource environments.
• Multi-Stage Knowledge Enhancement: The framework proposes a novel three-stage process (Targeted Data, Domain Knowledge, and Reasoning Knowledge) that complements standard fine-tuning, significantly improving alignment accuracy.
• Performance in Low-Resource Environments: The study demonstrates that a lightweight 7B model, enhanced by this framework, can outperform both traditional SOTA methods and zero-shot general-purpose large models (e.g., GPT-5, DeepSeek-R1 671B) in resource-constrained settings.

4. Experimental Results

The framework was evaluated on the ChatGPT-VDMEval test set (7,013 samples) using a Qwen2.5-7B-instruct student model.

• Overall Performance: CATBridge achieved an accuracy of 83.50%, a precision of 90.98%, a recall of 93.01%, and an F1-score of 85.55%.
• Comparative Gains:
  • vs. SOTA: An absolute improvement of 33.29 percentage points over the best baseline (GuardLink, 50.21%).
  • vs. Zero-shot Large Models: An average improvement of 46.24 percentage points over zero-shot general large models (GPT-5, DeepSeek-R1, Qwen3).
  • vs. Baseline Fine-tuning: A 41.15 percentage point improvement over the same student model trained with standard SFT without the enhancement pipeline (42.35% vs. 83.50%).
• Ablation Study: The results confirmed that each stage contributed distinct gains. Domain Knowledge Enhancement provided the largest single-stage jump (+16.28 pp accuracy), while Reasoning Knowledge Enhancement further refined performance (+11.04 pp).
• Few-Shot and Zero-Shot Scenarios:
  • In few-shot settings (14 long-tail techniques), the framework improved accuracy from 25.33% to 90.94%.
  • In zero-shot settings (8 unseen techniques), accuracy improved from 0.96% to 75.73%, demonstrating strong generalization capabilities.
• Model Compatibility: The framework showed robust performance across different student models (Mistral-7B, Llama3-8B, Gemma2-9B, Qwen2.5-7B), indicating it is not reliant on a specific model architecture.

5. Significance and Claims

The paper claims that CATBridge is among the first works to introduce a multi-stage teacher-student knowledge enhancement pipeline specifically for CVE-ATT&CK alignment, moving beyond prior single-stage fine-tuning or chained-template approaches.

Its primary significance lies in:

1. Resource Efficiency: It significantly reduces dependence on large-scale labeled data and massive computational resources, enabling reliable threat knowledge correlation in resource-constrained environments.
2. Practical Deployment: It allows for the deployment of lightweight models (7B) that achieve performance levels comparable to or exceeding much larger, zero-shot models, making automated vulnerability governance feasible for organizations with limited infrastructure.
3. Methodological Advancement: By explicitly transferring reasoning logic and domain knowledge chains rather than just final labels, the framework addresses the "black box" nature of LLM reasoning, providing a structured path for small models to learn complex semantic mappings.

The authors acknowledge limitations, noting that the teacher model's pre-training data may contain some CVE records (potential data contamination), though they argue the gains stem from the structured knowledge transfer rather than memorization. They also note current limitations in output interpretability and propose future work on attention visualization to aid security analysts.