# Uncovering CWE-CVE-CPE Relations with Threat Knowledge Graphs

arXiv: https://arxiv.org/abs/2305.00632 · HTML: https://mlsanity.com/paper/2305.00632/

## Key facts

- Cited by 6 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 1 May 2023.

## Built on by (most cited first, 6 of 6)

- [Towards Security-Auditable LLM Agents: A Unified Graph Representation](https://mlsanity.com/paper/2605.06812/) (2026)
- [Unveiling Hidden Links Between Unseen Security Entities](https://mlsanity.com/paper/2403.02014/) (2024)
- [The Road of Adaptive AI for Precision in Cybersecurity](https://mlsanity.com/paper/2512.06048/) (2025)
- [FixV2W: Correcting Invalid CVE-CWE Mappings with Knowledge Graph Embeddings](https://mlsanity.com/paper/2604.22176/) (2026)
- [CVE-TTP KG: Knowledge Graph Linking Software Vulnerabilities to Attack Behaviors](https://mlsanity.com/paper/2606.31557/) (2026)
- [The History Is the Detector: Executing CVE Patch History, End-to-End](https://mlsanity.com/paper/2609.05335/) (2026)

## Abstract (arXiv)

Security assessment relies on public information about products, vulnerabilities, and weaknesses. So far, databases in these categories have rarely been analyzed in combination. Yet, doing so could help predict unreported vulnerabilities and identify common threat patterns. In this paper, we propose a methodology for producing and optimizing a knowledge graph that aggregates knowledge from common threat databases (CVE, CWE, and CPE). We apply the threat knowledge graph to predict associations between threat databases, specifically between products, vulnerabilities, and weaknesses. We evaluate the prediction performance both in closed world with associations from the knowledge graph, and in open world with associations revealed afterward. Using rank-based metrics (i.e., Mean Rank, Mean Reciprocal Rank, and Hits@N scores), we demonstrate the ability of the threat knowledge graph to uncover many associations that are currently unknown but will be revealed in the future, which remains useful over different time periods. We propose approaches to optimize the knowledge graph, and show that they indeed help in further uncovering associations.