# CVE2 ATT&CK: BERT-Based Mapping of CVEs to MITRE ATT&CK Techniques
## 2 Method
### Our Labeled CVE Corpus  
#### 2.1.1 Data Collection  
Since no public datasets exist that map a CVE to all corresponding ATT&CK techniques, the first step consisted of building our own labeled corpus of 1813 CVEs, which was obtained using two different methods.  
First, we manually created a knowledge base of 993 labeled CVEs by individually mapping each CVE to tactics and techniques from MITRE ATT&CK Enterprise Matrix. We extracted CVEs that were published between 2020 to 2022 for relevance. The labeling process was performed by 4 experts to ensure consistency, following the standardized approach proposed by the _Mapping MITRE ATT&CK to CVEs for Impact_ methodology [11] and a set of common general guidelines.  
The _Mapping MITRE ATT&CK to CVEs for Impact_ methodology consists of three steps. The first one is to identify the type of vulnerability (e.g., cross-site scripting, buffer overflow, SQL injection) based on the vulnerability type mappings. The next step is to find the functionality to which the attacker gains access by exploiting the CVE. The final step refers to determining the exploitation technique using the provided tips that offer details about the necessary steps to exploit a vulnerability. Our methodology started from these steps and added other common general guidelines before labeling the tactics and techniques, such as searching for more details about a CVE on security blogs to obtain more relevant insights, or analyzing databases (e.g., the Vulnerability Database [21] and the Exploit Database--Exploits for Penetration Testers, Researchers, and Ethical Hackers [22]) for useful inputs about CVEs.  
The labeling was performed by three 4 th year undergraduate students in Computer Science with background courses in security, networking, and operating systems, and one Ph.D. student in Computer Science with 5+ years of experience in information security in the industry who provided guidance and helped reach consensus. The entire annotationprocess was overseen by a professor in cyber security. The dataset can be found on TagTog [19] and is split into the following collections:  
1. _Inter-rater_--A collection of 24 CVEs evaluated by all experts to ensure high agreement and consistent annotations; this collection was used for training the raters until perfect consensus was achieved;
2. _Double-rater_--A collection of 295 CVE evaluated by pairs of two raters; this collection was created after some experience was accumulated and consensus among raters was achieved using direct discussions;
3. _Individual_--A collection of 674 CVE evaluated by only one rater; this collection was annotated after the initial training phase was complete and raters gained experience.  
Second, besides the manual labeling process, we automatically extracted 820 already labeled CVEs provided by _Mapping MITRE ATT&CK to CVEs for Impact_[11] and imported them in our TagTog project. The provided CVEs date from 2014 to 2019; thus, there is no overlap with the manually annotated CVEs.  
Each CVE entry has associated the corresponding ID, the rich text description, and 14 labels denoting the possible tactics found in the MITRE ATT&CK Enterprise Matrix where the corresponding techniques are annotated. Extracting the data from TagTog can be performed automatically, using the TagTog API [23].