Search papers, labs, and topics across Lattice.
This study evaluates the effectiveness of multi-class versus multi-label approaches in assigning Common Weakness Enumeration (CWE) categories to Common Vulnerabilities and Exposures (CVE) records using three transformer encoders: BERT Base, SecureBERT, and CySecBERT. The findings reveal that while multi-class training consistently outperforms multi-label training in macro-F1 scores, the performance gap diminishes as the label space decreases, with post-hoc threshold optimization further improving multi-label results. Notably, confusion analysis indicates that misclassification patterns are primarily influenced by the taxonomy structure rather than the choice of encoder, highlighting the importance of taxonomy design in classification tasks.
Multi-class classification outperforms multi-label approaches in CWE assignment, but taxonomy design plays a crucial role in error patterns, revealing deeper insights into classification challenges.
Assigning Common Weakness Enumeration (CWE) categories to Common Vulnerabilities and Exposures (CVE) records remains an important but largely manual step in vulnerability analysis. We study this task as a text classification problem and compare two modelling choices: a \emph{multi-class} formulation that predicts a single CWE per CVE and a \emph{multi-label} formulation that allows multiple assignments. Three transformer encoders (BERT Base, SecureBERT, and CySecBERT) are evaluated on three nested label spaces (83, 47, and 25 classes). Multi-class training achieves higher macro-F1 across all settings, although the gap to multi-label narrows from 21 to 2 percentage points as the label space shrinks. Post-hoc threshold optimisation on the multi-label side closes this gap on the 25-class setting. Confusion analysis shows that the dominant misclassification patterns follow the CWE hierarchy and are shared across all three encoders (Pearson $r>0.92$), which suggests that the error structure is driven more by taxonomy design than by encoder choice. A hierarchy-relaxed evaluation that forgives within-family confusions raises macro-F1 from ${\sim}$81\% to ${\sim}$90\%, indicating that strict metrics understate branch-level classifier quality. CySecBERT achieves the strongest results overall, with statistically significant gains concentrated in the multi-label setting.
