BERT — CVE-LMTune CAPEC Classifier (Flat)
Part of the CVE-LMTune model suite, a collection of language models fine-tuned for multi-taxonomy vulnerability classification across widely used cybersecurity taxonomies, including CWE, CAPEC, and MITRE ATT&CK.
Paper
Franco Terranova, Sana Rekbi, Abdelkader Lahmadi, Isabelle Chrisment. Multi-Taxonomy Vulnerability Classification with Hierarchically Finetuned Language Models. The 23rd Conference on Detection of Intrusions and Malware & Vulnerability Assessment (DIMVA '26).
Overview
This model performs multi-label CAPEC classification from vulnerability descriptions. Given a CVE-style description, it predicts one or more CAPEC identifiers associated with the described vulnerability.
| Property | Value |
|---|---|
| Taxonomy | CAPEC (Common Attack Pattern Enumeration and Classification) |
| Task | Multi-label text classification |
| Input | Vulnerability description (e.g., CVE summary) |
| Output | One or more CAPEC identifiers |
| Number of labels | 445 |
| Number of samples | 239,931 |
| Latest CVE update included | 17/06/2026 |
| Split | train (60%), val (20%), test (20%) |
Evaluation Results
The model was evaluated on the held-out test set using standard multi-label classification metrics using sigmoid activation and a default threshold of 0.5.
Ranking Metrics
| LRAP | MRR | Coverage Error | Label Ranking Loss | P@1 | P@3 | P@5 | R@1 | R@3 | R@5 |
|---|---|---|---|---|---|---|---|---|---|
| 0.8250 | 0.8800 | 65.44 | 0.0330 | 0.8585 | 0.8492 | 0.8440 | 0.0392 | 0.1189 | 0.1968 |
Threshold = 0.5
| Micro P | Micro R | Micro F1 | Macro F1 | Weighted F1 | Hamming Loss | Subset Accuracy |
|---|---|---|---|---|---|---|
| 0.8670 | 0.7541 | 0.8066 | 0.3376 | 0.7872 | 0.0257 | 0.4671 |
Quick Start
from transformers import AutoTokenizer, AutoModelForSequenceClassification
import torch
tokenizer = AutoTokenizer.from_pretrained("Sana9/bert-vuln2capec-flat")
model = AutoModelForSequenceClassification.from_pretrained("Sana9/bert-vuln2capec-flat")
text = "Buffer overflow vulnerability in OpenSSL allows remote attackers to execute arbitrary code."
with torch.no_grad():
probs = torch.sigmoid(
model(**tokenizer(text, return_tensors="pt", truncation=True)).logits
)[0]
predictions = {
model.config.id2label[i]: p.item()
for i, p in enumerate(probs)
if p > 0.5
}
print(predictions)
Citation
@inproceedings{terranova2026multitaxonomy,
author = {Franco Terranova and Sana Rekbi and Abdelkader Lahmadi and Isabelle Chrisment},
title = {Multi-Taxonomy Vulnerability Classification with Hierarchically Finetuned Language Models},
booktitle = {Proceedings of the International Conference on Detection of Intrusions and Malware, and Vulnerability Assessment (DIMVA)},
year = {2026},
month = jul,
address = {Chania, Crete, Greece},
note = {HAL identifier: hal-05500820v2}
}
Related Resources
Disclaimers
- This product is a result of the use of the NVD API but is not endorsed or certified by the NVD. The same for the CVE2CAPEC project and the Hugging Face API.
- This project relies on data publicly available from the CWE, CAPEC, and MITRE ATT&CK projects.
- This work has been partially supported by the French National Research Agency under the France 2030 label (Superviz ANR-22-PECY-0008). The views reflected herein do not necessarily reflect the opinion of the French government.