Multi-Class vs. Multi-Label BERT for CVE-to-CWE Mapping: How Taxonomy Structure Shapes the Errors
This study addresses the ongoing challenge of automatically mapping Common Vulnerabilities and Exposures (CVEs) to Common Weakness Enumerations (CWEs), particularly the lack of systematic evaluation in choosing between multi-class and multi-label modeling strategies. Framing the task as text classification, the authors compare these two approaches using three transformer-based encoders—BERT Base, SecureBERT, and CySecBERT—across CWE label spaces of varying granularity. They further introduce a hierarchical relaxed evaluation metric to more accurately assess model performance within the structured hierarchy of CWEs. Experimental results show that the multi-class approach generally achieves higher macro F1 scores, though this advantage diminishes as the label space narrows. CySecBERT performs best under the multi-label setting. Notably, the hierarchical relaxed metric elevates macro F1 from approximately 81% to 90%, indicating that most misclassifications stem from ambiguities in the CWE taxonomy rather than model limitations.