vulnerability-attack-techniques

This dataset maps 1,207 CVEs to MITRE ATT&CK (Enterprise) techniques, joining hand-curated mappings from the MITRE Center for Threat-Informed Defense (CTID) with vulnerability descriptions from CIRCL/vulnerability-scores. It is intended for training and evaluating models that suggest candidate ATT&CK techniques from a vulnerability description: CVSS tells you how bad a vulnerability is, CWE what kind of flaw it is — ATT&CK tells defenders what adversary behavior to expect and detect.

Every label in the techniques column was written by an analyst following the CTID "Mapping ATT&CK to CVE for Impact" methodology, which assigns each CVE up to three kinds of techniques: an exploitation technique (how it is exploited), a primary impact (what exploitation directly yields), and a secondary impact (what the attacker can do next).

This is the gold set of the paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion (arXiv:2607.25572). The classifier trained on it, CIRCL/vulnerability-attack-technique-classification-roberta-base, runs in production on Vulnerability-Lookup.

DOI: 10.57967/hf/9621

Label sources

label_sources	CVEs	Origin
ctid_cve	788	attack_to_cve (2021), ATT&CK v9 era
ctid_kev	392	Mappings Explorer KEV mappings, ATT&CK 16.1
both	27

All technique IDs are normalized to enterprise ATT&CK v19.1: techniques revoked since the original mappings are remapped to their successor via the STIX revoked-by relationships (e.g. T1562 Impair Defenses → T1685 Disable or Modify Tools), and Mobile/ICS techniques are dropped (enterprise domain only).

⚠️ techniques vs techniques_derived

The techniques_derived column contains labels from the automatically derived CVE → CWE → CAPEC → ATT&CK chain maintained by CVE2CAPEC. Do not train on this column. Analysis of the chain shows a median fan-out of 4–20 techniques per CVE and top-frequency techniques (e.g. T1574.007 on 53% of 2024 CVEs) that are artifacts of the cross-framework table expansion, not descriptions of real adversary behavior. The column is included as:

1. a baseline that a trained model must beat;
2. a comparison column for studying where the deterministic chain diverges from analyst judgment.

Its use as an inference-time candidate prior was measured and rejected (2026-08-06): at the parent-technique level the derived candidate sets cover only 3.3% of the analyst-chosen techniques on the test split, so any re-ranking toward them degrades every ranking metric.

The full source analysis is documented in the VulnTrain documentation.

Fields

Field	Type	Description
id	string	CVE identifier
title	string	Vulnerability title
description	string	Vulnerability description in English (model input)
exploitation_techniques	list[string]	CTID exploitation technique(s)
primary_impact	list[string]	CTID primary impact technique(s)
secondary_impact	list[string]	CTID secondary impact technique(s)
techniques	list[string]	Union of all curated techniques — the training target
techniques_derived	list[string]	CVE2CAPEC weak labels — not for training
label_sources	list[string]	ctid_cve and/or ctid_kev
attack_version	string	Enterprise ATT&CK version the IDs are normalized to
cvss_vector	string	CVSS vector string, highest available version (empty if none) — v2
cvss_version	string	Version of cvss_vector: 4.0, 3.1, 3.0 or 2.0 — v2
cwes	list[string]	CWE assignments, e.g. CWE-502 Deserialization of Untrusted Data — v2
affected_products	list[string]	vendor product pairs from the CVE record — v2
cpes	list[string]	CPE identifiers — v2

Structured metadata columns (v2, added 2026-08-06)

The v2 columns are extracted from the raw CVE records served by Vulnerability-Lookup (CNA container preferred, CISA ADP Vulnrichment filling many gaps — notably 100% CVSS/CWE coverage on the KEV subset); cpes is joined from CIRCL/vulnerability-scores. v1 columns are unchanged (the update is strictly additive: identical rows and splits). Coverage differs by label source — report results stratified by label_sources when using these columns as model inputs:

Subset	CVEs	cvss_vector	cwes	affected_products	cpes
all	1,207	72.0%	84.3%	67.4%	93.2%
ctid_kev	392	100%	100%	79.8%	79.1%
ctid_cve	788	57.1%	76.0%	62.2%	100%
both	27	100%	100%	40.7%	100%

CVSS versions among the 869 vectors: 677 × v3.1, 173 × v3.0, 18 × v4.0, 1 × v2.0.

Label statistics

192 distinct techniques; 66 with at least 5 examples. Most CVEs carry 1–3 techniques. Top techniques: T1190 Exploit Public-Facing Application (348), T1059 Command and Scripting Interpreter (262), T1203 Exploitation for Client Execution (213), T1068 Exploitation for Privilege Escalation (189).

Known limitations

• Size: ~1,200 CVEs supports a proof-of-concept, not a production model.
• Selection bias: both label sources over-represent exploited-in-the-wild vulnerabilities (the KEV set by construction).
• Inherent task ceiling: a CVE description describes a flaw, while ATT&CK describes attacker behavior around it — even human annotators disagree on such mappings. Models trained on this data should suggest candidate techniques for analyst review, not produce authoritative mappings.

Usage

from datasets import load_dataset

dataset = load_dataset("CIRCL/vulnerability-attack-techniques")

for entry in dataset["train"].select(range(3)):
    print(entry["id"], entry["techniques"], "-", entry["description"][:80])

Licensing of upstream sources

The CTID mappings are Apache-2.0. Descriptions come from CIRCL/vulnerability-scores (CC BY 4.0). The techniques_derived column is derived from the GPLv3 CVE2CAPEC project. MITRE ATT&CK® is a registered trademark of The MITRE Corporation; ATT&CK content is used in accordance with the MITRE ATT&CK terms of use.

Related artifacts

Artifact	Location	DOI
Released model trained on this dataset	CIRCL/vulnerability-attack-technique-classification-roberta-base	10.57967/hf/9623
LLM expansion dataset (negative result)	CIRCL/vulnerability-attack-techniques-llm-scaling	10.57967/hf/9622
LLM-expanded comparison model	CIRCL/vulnerability-attack-technique-classification-roberta-base-llm-expanded	10.57967/hf/9624
Code	vulnerability-lookup/VulnTrain	—
Paper	arXiv:2607.25572	—
Paper LaTeX source + trainer logs	vulnerability-lookup/cve-attack-mapping-paper	—

References

• Vulnerability-Lookup — the vulnerability data source
• VulnTrain — generation pipeline (vulntrain-dataset-attack-generation)
• Methodology documentation
• MITRE CTID attack_to_cve and Mappings Explorer
• CVE2CAPEC by Galeax

Citation

@misc{bonhomme2026mappingcvesmitreattck,
      title={Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion},
      author={Cédric Bonhomme and Alexandre Dulaunoy},
      year={2026},
      eprint={2607.25572},
      archivePrefix={arXiv},
      primaryClass={cs.CR},
      url={https://arxiv.org/abs/2607.25572},
}

Acknowledgements

Developed at CIRCL in the context of the AIPITCH project, co-funded by the European Union.