You can deploy this model and start earning money today!

Sana9/
bert-vuln2capec-flat

Name: bert-vuln2capec-flat
Availability: InStock

google-bert/bert-base-uncased

finetune

mit

Views

No views yet

BERT — CVE-LMTune CAPEC Classifier (Flat)

Part of the CVE-LMTune model suite, a collection of language models fine-tuned for multi-taxonomy vulnerability classification across widely used cybersecurity taxonomies, including CWE, CAPEC, and MITRE ATT&CK.

Paper

Franco Terranova, Sana Rekbi, Abdelkader Lahmadi, Isabelle Chrisment. Multi-Taxonomy Vulnerability Classification with Hierarchically Finetuned Language Models. The 23rd Conference on Detection of Intrusions and Malware & Vulnerability Assessment (DIMVA '26).

Overview

This model performs multi-label CAPEC classification from vulnerability descriptions. Given a CVE-style description, it predicts one or more CAPEC identifiers associated with the described vulnerability.

Property	Value
Taxonomy	CAPEC (Common Attack Pattern Enumeration and Classification)
Task	Multi-label text classification
Input	Vulnerability description (e.g., CVE summary)
Output	One or more CAPEC identifiers
Number of labels	445
Number of samples	239,931
Latest CVE update included	17/06/2026
Split	train (60%), val (20%), test (20%)

Evaluation Results

The model was evaluated on the held-out test set using standard multi-label classification metrics using sigmoid activation and a default threshold of 0.5.

Ranking Metrics

LRAP	MRR	Coverage Error	Label Ranking Loss	P@1	P@3	P@5	R@1	R@3	R@5
0.8250	0.8800	65.44	0.0330	0.8585	0.8492	0.8440	0.0392	0.1189	0.1968

Threshold = 0.5

Micro P	Micro R	Micro F1	Macro F1	Weighted F1	Hamming Loss	Subset Accuracy
0.8670	0.7541	0.8066	0.3376	0.7872	0.0257	0.4671

Quick Start

python

from transformers import AutoTokenizer, AutoModelForSequenceClassification
import torch

tokenizer = AutoTokenizer.from_pretrained("Sana9/bert-vuln2capec-flat")
model = AutoModelForSequenceClassification.from_pretrained("Sana9/bert-vuln2capec-flat")

text = "Buffer overflow vulnerability in OpenSSL allows remote attackers to execute arbitrary code."

with torch.no_grad():
    probs = torch.sigmoid(
        model(**tokenizer(text, return_tensors="pt", truncation=True)).logits
    )[0]

predictions = {
    model.config.id2label[i]: p.item()
    for i, p in enumerate(probs)
    if p > 0.5
}

print(predictions)

Citation

bibtex

@inproceedings{terranova2026multitaxonomy,
  author    = {Franco Terranova and Sana Rekbi and Abdelkader Lahmadi and Isabelle Chrisment},
  title     = {Multi-Taxonomy Vulnerability Classification with Hierarchically Finetuned Language Models},
  booktitle = {Proceedings of the International Conference on Detection of Intrusions and Malware, and Vulnerability Assessment (DIMVA)},
  year      = {2026},
  month     = jul,
  address   = {Chania, Crete, Greece},
  note      = {HAL identifier: hal-05500820v2}
}

Related Resources

Disclaimers

This product is a result of the use of the NVD API but is not endorsed or certified by the NVD. The same for the CVE2CAPEC project and the Hugging Face API.
This project relies on data publicly available from the CWE, CAPEC, and MITRE ATT&CK projects.
This work has been partially supported by the French National Research Agency under the France 2030 label (Superviz ANR-22-PECY-0008). The views reflected herein do not necessarily reflect the opinion of the French government.