# Linking Common Vulnerabilities and Exposures to the MITRE ATT&CK Framework: A Self-Distillation Approach

arXiv: https://arxiv.org/abs/2108.01696 · HTML: https://mlsanity.com/paper/2108.01696/

## Key facts

- Cited by 9 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 3 Aug 2021.

## Built on by (most cited first, 9 of 9)

- [Automatic Mapping of Unstructured Cyber Threat Intelligence: An Experimental Study](https://mlsanity.com/paper/2208.12144/) (2022)
- [Large Language Models for Security Operations Centers: A Comprehensive Survey](https://mlsanity.com/paper/2509.10858/) (2025)
- [Deep Reinforcement Learning for Autonomous Cyber Defence: A Survey](https://mlsanity.com/paper/2310.07745/) (2023)
- [CVE-driven Attack Technique Prediction with Semantic Information Extraction and a Domain-specific Language Model](https://mlsanity.com/paper/2309.02785/) (2023)
- [CVE-LLM : Ontology-Assisted Automatic Vulnerability Evaluation Using Large Language Models](https://mlsanity.com/paper/2502.15932/) (2025)
- [Towards the generation of hierarchical attack models from cybersecurity vulnerabilities using language models](https://mlsanity.com/paper/2410.05351/) (2024)
- [A Systematic Approach to Predict the Impact of Cybersecurity Vulnerabilities Using LLMs](https://mlsanity.com/paper/2508.18439/) (2025)
- [Constructing Multi-label Hierarchical Classification Models for MITRE ATT&CK Text Tagging](https://mlsanity.com/paper/2601.14556/) (2026)
- [CVE-LLM : Automatic vulnerability evaluation in medical device industry using large language models](https://mlsanity.com/paper/2407.14640/) (2024)

## Abstract (arXiv)

Due to the ever-increasing threat of cyber-attacks to critical cyber infrastructure, organizations are focusing on building their cybersecurity knowledge base. A salient list of cybersecurity knowledge is the Common Vulnerabilities and Exposures (CVE) list, which details vulnerabilities found in a wide range of software and hardware. However, these vulnerabilities often do not have a mitigation strategy to prevent an attacker from exploiting them. A well-known cybersecurity risk management framework, MITRE ATT&CK, offers mitigation techniques for many malicious tactics. Despite the tremendous benefits that both CVEs and the ATT&CK framework can provide for key cybersecurity stakeholders (e.g., analysts, educators, and managers), the two entities are currently separate. We propose a model, named the CVE Transformer (CVET), to label CVEs with one of ten MITRE ATT&CK tactics. The CVET model contains a fine-tuning and self-knowledge distillation design applied to the state-of-the-art pre-trained language model RoBERTa. Empirical results on a gold-standard dataset suggest that our proposed novelties can increase model performance in F1-score. The results of this research can allow cybersecurity stakeholders to add preliminary MITRE ATT&CK information to their collected CVEs.