CVE-to-ATT&CK Mapping via Evidence-Constrained Ranking

Overview & Synopsis

Mapping CVEs to MITRE ATT&CK techniques helps defenders translate vulnerability information into hypotheses about adversary behavior. Automating this mapping is challenging because relevant evidence is fragmented across heterogeneous security sources. In addition, ATT&CK techniques can be semantically similar, and existing annotations cover a highly long-tailed subset of the technique space. Existing supervised, retrieval-based, and LLM-based approaches therefore face limitations from closed-set supervision, semantic ambiguity, or unconstrained prediction. We formulate CVE-to-ATT&CK mapping as multi-evidence constrained ranking. Our framework TRACE first integrates complementary structural and semantic evidence from multiple sources to construct a bounded, high-coverage candidate pool over the complete ATT&CK technique space. It then reranks the retained candidates by combining their accumulated evidence with CVE--technique textual interactions and frequency-aware scoring. We evaluate the framework across six public datasets with different annotation processes and vulnerability distributions. Candidate construction reduces the 201-technique ATT&CK search space by approximately 60% while retaining at least one ground-truth technique for 95.11%-100% of CVEs. These results show that combining heterogeneous security evidence with constrained ranking provides a more controlled and generalizable bridge from vulnerability information to adversary behavior.