Taxonomy Structure Shapes BERT Errors in CVE-to-CWE Security Mapping

arXiv·medium signal

This study compares multi-class versus multi-label BERT approaches for assigning Common Weakness Enumeration (CWE) categories to CVE records, a persistent bottleneck in vulnerability triage. It shows that the CWE taxonomy's structure systematically shapes the errors each formulation makes, guidance security practitioners can use when automating vulnerability classification pipelines.