Evaluating the NIST Bugs Framework Against CWE as a Successor for Automated Vulnerability Classification
cs.CR, cs.SE
Submitted: 2026-09-14
Updated: 2026-09-14
Comments: 48 pages, 21 figures, 11 tables, code link: github.com/shaswata09/cve2bf
Code: https://github.com/shaswata09/cve2bf
Project page: https://samate.nist.gov/BF
License: http://creativecommons.org/licenses/by-nc-nd/4.0/
The gist: Vulnerability classification based on root cause weaknesses is essential for numerous cybersecurity activities, where the Common Weakness Enumeration (CWE) serves as a public repository of such flaws.
Terminology
Abstract
Vulnerability classification based on root cause weaknesses is essential for numerous cybersecurity activities, where the Common Weakness Enumeration (CWE) serves as a public repository of such flaws. However, its overlapping entries create a non-orthogonal structure. The result is the same vulnerability being mapped to multiple weaknesses, complicating Root Cause Analysis (RCA) and triage. To address this, NIST Special Publication 800-231 introduces the Bugs Framework (BF), which organizes vulnerabilities into <cause, operation, consequence> triples and links such triples into a causal chain, so that a vulnerability carries its root cause and its sink together instead of a single terminal label. To date, however, BF has been specified but not evaluated regarding its performance against the challenges to automated classification. The evidence required for adoption has not been investigated empirically. We evaluate BF as a classification target and a complement to CWE using a systematically screened corpus of automated Common Vulnerabilities and Exposures (CVEs) linked to CWE research. We assess the reproducibility of CVE-to-BF classification through two evaluations. The first is qualitative: an anonymized inter-rater study in which 2 subject-matter experts (SMEs) independently mapped 13 CVEs onto the four BF axes. Annotators showed strong agreement on the cause and operation axes, while the attribute axis indicated fair agreement. We also tested our automated framework across two large language model (LLM) deployments under different budgets for reproducibility analysis. Despite limitations, such as evidence availability and the absence of retrievable fix commits for closed-source software, our findings support the claim that BF is a more structured and automation-friendly framework than CWE. Our exploration reveals specific gaps in BF, including under-specified guidance on attributes.
Sources
- Automated CVE Analysis for Threat Prioritization and Impact Prediction
- Unveiling Hidden Links Between Unseen Security Entities
- Streamlining Security Vulnerability Triage with Large Language Models
- Out of Distribution, Out of Luck: How Well Can LLMs Trained on Vulnerability Datasets Detect Top 25 CWE Weaknesses?
- FALCON: Transforming Cyber Threat Intelligence into Deployable IDS Rules with Self-Reflection
- Fine-tuning RoBERTa for CVE-to-CWE Classification: A 125M Parameter Model Competitive with LLMs
- Agentra: A Supervisable Multi-Agent Framework for Enterprise Intrusion Response
- FixV2W: Correcting Invalid CVE-CWE Mappings with Knowledge Graph Embeddings
- What Are Adversaries Doing? Automating Tactics, Techniques, and Procedures Extraction: A Systematic Review
Related papers
- SoK: AI-Augmented Binary Reversing
- Relaxed Sender Anonymity for CBDC Interbank Settlement: A Zero-Knowledge Approach on Permissioned EVM
- Calibration-Family Overfit: Why Trusted Sabotage Monitors Don't Transfer Across Lineages
- Efficient Fuzzy PSI under One-Sided Assumptions
- Sealing the Audit-Runtime Gap for LLM Skills
- Token Composition: A Graph Based on EVM Logs