Boosting Vulnerability Intelligence: How Accurate CWE Mappings Transform ML Model Performance
summary
FixV2W uses knowledge graph embeddings (TransE) plus NVD–CWE hierarchy and remap trends to replace prohibited or discouraged CWE placeholders with ranked candidates, boosting ML quality: Mean Reciprocal Rank rises from 0.174 to 0.608 and 69% of exploited vulnerabilities would have been correctly remapped before exploitation. The team builds a retraining pipeline on OpenShift AI pipeline for weekly updates, evaluates on 1999–2024 data, and reports best results using TransE embeddings and their lightweight FixV2W ranking.
AI-written summary · about
chapters (12)
- 0:00CWE mapping challenges
- 3:57Invalid mappings impact on training
- 6:06Knowledge graphs for CWE
- 8:35Prediction with graph embeddings
- 10:03CNA remapping patterns
- 13:39Evaluation methodology and results
- 15:28Exploit avoidance improvements
- 16:55Applying predictions to CWEs
- 17:58Automated retraining pipeline
- 20:29Contributions and future pipeline
- 21:55Acknowledgements
- 22:18Q&A
related talks
57mVulnerability Root Cause Mapping with CWE
28mHow Do We Leverage CVE Root Cause Mapping and CWE Data to Prevent New Vulnerabilities?
58mWhy Can't We All Just Get Along? Bridging the Gap in Vulnerability Prioritization Standards
12mEnhancing Code Vulnerability Detection via Vulnerability-Preserving Data Augmentation
21mMaking Sense of Unstructured Threat Data
53mPanel Discussion: Enabling Accurate, Decentralized Root Cause Mapping at Scale
56mCVE Is The Worst Vulnerability Framework (Except For All The Others)
54mTowards Real World Cyber Risk (Panel)