# CVE-TTP KG: Knowledge Graph Linking Software Vulnerabilities to Attack Behaviors

arXiv: https://arxiv.org/abs/2606.31557 · HTML: https://mlsanity.com/paper/2606.31557/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 7 of its 22 references that are in the map.
- First posted on arXiv 30 Jun 2026.

## Builds on (most cited first, 7 of 7)

- [Span-based Joint Entity and Relation Extraction with Transformer Pre-training](https://mlsanity.com/paper/1909.07755/) (2019)
- [CySecBERT: A Domain-Adapted Language Model for the Cybersecurity Domain](https://mlsanity.com/paper/2212.02974/) (2022)
- [ThreatKG: An AI-Powered System for Automated Open-Source Cyber Threat Intelligence Gathering and Management](https://mlsanity.com/paper/2212.10388/) (2022)
- [Uncovering CWE-CVE-CPE Relations with Threat Knowledge Graphs](https://mlsanity.com/paper/2305.00632/) (2023)
- [Software Security Patch Management -- A Systematic Literature Review of Challenges, Approaches, Tools and Practices](https://mlsanity.com/paper/2012.00544/) (2020)
- [Software Updates Strategies: a Quantitative Evaluation against Advanced Persistent Threats](https://mlsanity.com/paper/2205.07759/) (2022)
- [A survey on cutting-edge relation extraction techniques based on language models](https://mlsanity.com/paper/2411.18157/) (2024)

## Abstract (arXiv)

In the evolving threat landscape, adversaries exploit software vulnerabilities to launch sophisticated attacks, challenging traditional defenses. Although databases like CVE and NVD provide detailed technical information, they often lack links to attacker behaviors such as tactics and techniques, limiting effective threat interpretation and response. This work bridges this gap by connecting vulnerabilities with behavioral patterns from the MITRE ATT&CK framework. We construct a CVE-TTP Knowledge Graph that links CVEs to tactics and techniques using classification and relation extraction. Transformer-based models are developed for behavior identification, with CySecBERT achieving macro F1-scores of 87.71% (techniques) and 96.16% (tactics). Also, we created an annotated dataset with 24,820 entities and 43,608 relations for entity and relation extraction. The pipeline-based approach achieves macro F1-scores of 0.86 (entity extraction) and 0.99 (relation extraction), while a span-based joint model achieves 0.78. These outputs are integrated into a Neo4j-based Cyber Threat Knowledge Graph, enabling structured visualization of vulnerabilities.