You can deploy this model and start earning money today!

Sana9/
distilbert-vuln2attack-flat

Name: distilbert-vuln2attack-flat
Availability: InStock

distilbert/distilbert-base-uncased

finetune

mit

Views

No views yet

DistilBERT — CVE-LMTune ATT&CK Classifier (Flat)

Part of the CVE-LMTune model suite, a collection of language models fine-tuned for multi-taxonomy vulnerability classification across widely used cybersecurity taxonomies, including CWE, CAPEC, and MITRE ATT&CK.

Paper

Franco Terranova, Sana Rekbi, Abdelkader Lahmadi, Isabelle Chrisment. Multi-Taxonomy Vulnerability Classification with Hierarchically Finetuned Language Models. The 23rd Conference on Detection of Intrusions and Malware & Vulnerability Assessment (DIMVA '26).

Overview

This model performs multi-label ATT&CK classification from vulnerability descriptions. Given a CVE-style description, it predicts one or more ATT&CK identifiers associated with the described vulnerability.

Property	Value
Taxonomy	MITRE ATT&CK Enterprise Subtechniques
Task	Multi-label text classification
Input	Vulnerability description (e.g., CVE summary)
Output	One or more ATT&CK identifiers
Number of labels	175
Number of samples	231,009
Latest CVE update included	17/06/2026
Split	train (60%), val (20%), test (20%)

Evaluation Results

The model was evaluated on the held-out test set using standard multi-label classification metrics using sigmoid activation and a default threshold of 0.5.

Ranking Metrics

LRAP	MRR	Coverage Error	Label Ranking Loss	P@1	P@3	P@5	R@1	R@3	R@5
0.9071	0.9409	20.00	0.0208	0.9255	0.9044	0.8417	0.1279	0.3757	0.5522

Threshold = 0.5

Micro P	Micro R	Micro F1	Macro F1	Weighted F1	Hamming Loss	Subset Accuracy
0.8420	0.7650	0.8017	0.3859	0.7905	0.0286	0.6777

Quick Start

python

from transformers import AutoTokenizer, AutoModelForSequenceClassification
import torch

tokenizer = AutoTokenizer.from_pretrained("Sana9/distilbert-vuln2attack-flat")
model = AutoModelForSequenceClassification.from_pretrained("Sana9/distilbert-vuln2attack-flat")

text = "Buffer overflow vulnerability in OpenSSL allows remote attackers to execute arbitrary code."

with torch.no_grad():
    probs = torch.sigmoid(
        model(**tokenizer(text, return_tensors="pt", truncation=True)).logits
    )[0]

predictions = {
    model.config.id2label[i]: p.item()
    for i, p in enumerate(probs)
    if p > 0.5
}

print(predictions)

Citation

bibtex

@inproceedings{terranova2026multitaxonomy,
  author    = {Franco Terranova and Sana Rekbi and Abdelkader Lahmadi and Isabelle Chrisment},
  title     = {Multi-Taxonomy Vulnerability Classification with Hierarchically Finetuned Language Models},
  booktitle = {Proceedings of the International Conference on Detection of Intrusions and Malware, and Vulnerability Assessment (DIMVA)},
  year      = {2026},
  month     = jul,
  address   = {Chania, Crete, Greece},
  note      = {HAL identifier: hal-05500820v2}
}

Related Resources

Disclaimers

This product is a result of the use of the NVD API but is not endorsed or certified by the NVD. The same for the CVE2CAPEC project and the Hugging Face API.
This project relies on data publicly available from the CWE, CAPEC, and MITRE ATT&CK projects.
This work has been partially supported by the French National Research Agency under the France 2030 label (Superviz ANR-22-PECY-0008). The views reflected herein do not necessarily reflect the opinion of the French government.