FixV2W: Correcting Invalid CVE-CWE Mappings with Knowledge Graph Embeddings

2026-04-23

AI Summary

This study addresses the prevalent inconsistencies and invalid mappings between CVEs and CWEs in public vulnerability databases such as the National Vulnerability Database (NVD), which undermine the accuracy of automated vulnerability analysis. To rectify deprecated or discouraged CVE–CWE associations, this work proposes a novel approach that integrates knowledge graph embeddings, hierarchical modeling of CVE–CWE relationships, and longitudinal analysis of historical remapping trends. Evaluated on data spanning from August 2021 to December 2024, the method achieves a Top-10 prediction accuracy of 69% and substantially improves the Mean Reciprocal Rank (MRR) of an NVD-dependent machine learning model from 0.174 to 0.608, thereby significantly enhancing the reliability of vulnerability-to-weakness linkage.

Technology Category

• Data Mining & Knowledge Management: Anomaly/Outlier Detection
• Computer Vision: Adversarial Attacks & Robustness
• Cognitive Modeling & Cognitive Systems: Conceptual Inference and Reasoning

Application Category

• Graph Algorithms and Modeling for the Web: Graph embeddings and representation learning for Web-related graphs
• Web Mining and Content Analysis: Web data provenance, reliability, and authenticity
• Semantics and Knowledge: Scalable techniques for the creation, curation, publication, maintenance, and consumption of large, Web-based, structured, reusable, knowledge graphs and ontologies

Abstract

Accurate mapping between Common Vulnerabilities and Exposures (CVE) and Common Weakness Enumeration (CWE) entries is critical for effective vulnerability management and risk assessment. However, public databases, such as the National Vulnerability Database (NVD), suffer from inconsistent and incomplete CVE to CWE mappings, complicating automated analysis and remediation. We introduce FixV2W, a lightweight approach that leverages knowledge graph embeddings and longitudinal trends to improve mapping accuracy of the NVD. FixV2W systematically analyzes historical remapping patterns and leverages hierarchical relationships within NVD and CWE data to predict more precise CWE mappings for vulnerabilities linked to Prohibited or Discouraged categories. We run extensive experimental evaluation of FixV2W, based on test data set collected between August 2021 and December 2024. Considering the Top 10 ranked predictions, the results show that FixV2W predicts the correct CWE mappings for 69% of exploited vulnerabilities that had invalid CWEs before they were exploited. We also show that FixV2W significantly improves the performance of ML models relying on NVD data. For instance, for a model geared at uncovering unknown CVE-CWE mappings, FixV2W improves the Mean Reciprocal Rank (MRR) from 0.174 to 0.608. These results show that FixV2W is a promising approach to identify and thwart emerging threats.

Problem

• CVE-CWE mapping
• vulnerability management
• inconsistent mappings
• knowledge graph
• NVD

Innovation

• knowledge graph embeddings
• CVE-CWE mapping
• vulnerability management
• longitudinal analysis
• NVD correction