{"id":"https://openalex.org/W7153309785","doi":"https://doi.org/10.1145/3779208.3785376","title":"Knowing your weaknesses is your greatest strength: Mapping CVE to CWE by leveraging CWE Hierarchy and fine-tuned LLMs","display_name":"Knowing your weaknesses is your greatest strength: Mapping CVE to CWE by leveraging CWE Hierarchy and fine-tuned LLMs","publication_year":2026,"publication_date":"2026-06-01","ids":{"openalex":"https://openalex.org/W7153309785","doi":"https://doi.org/10.1145/3779208.3785376"},"language":"en","primary_location":{"id":"doi:10.1145/3779208.3785376","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3779208.3785376","pdf_url":null,"source":null,"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the ACM Asia Conference on Computer and Communications Security","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://doi.org/10.1145/3779208.3785376","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5129249048","display_name":"Stefano; id_orcid 0009-0009-9778-4019 Simonetto","orcid":null},"institutions":[{"id":"https://openalex.org/I94624287","display_name":"University of Twente","ror":"https://ror.org/006hf6230","country_code":"NL","type":"education","lineage":["https://openalex.org/I94624287"]}],"countries":["NL"],"is_corresponding":false,"raw_author_name":"Stefano Simonetto","raw_affiliation_strings":["University of Twente, Enschede, Netherlands"],"raw_orcid":"https://orcid.org/0009-0009-9778-4019","affiliations":[{"raw_affiliation_string":"University of Twente, Enschede, Netherlands","institution_ids":["https://openalex.org/I94624287"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5120530200","display_name":"Ronan Oostveen","orcid":"https://orcid.org/0009-0004-4822-5142"},"institutions":[{"id":"https://openalex.org/I94624287","display_name":"University of Twente","ror":"https://ror.org/006hf6230","country_code":"NL","type":"education","lineage":["https://openalex.org/I94624287"]}],"countries":["NL"],"is_corresponding":false,"raw_author_name":"Ronan Oostveen","raw_affiliation_strings":["University of Twente, Enschede, Netherlands"],"raw_orcid":"https://orcid.org/0009-0004-4822-5142","affiliations":[{"raw_affiliation_string":"University of Twente, Enschede, Netherlands","institution_ids":["https://openalex.org/I94624287"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5133339779","display_name":"Thijs van Ede","orcid":null},"institutions":[{"id":"https://openalex.org/I94624287","display_name":"University of Twente","ror":"https://ror.org/006hf6230","country_code":"NL","type":"education","lineage":["https://openalex.org/I94624287"]}],"countries":["NL"],"is_corresponding":false,"raw_author_name":"Thijs van Ede","raw_affiliation_strings":["University of Twente, Enschede, Netherlands"],"raw_orcid":"https://orcid.org/0000-0003-3865-6390","affiliations":[{"raw_affiliation_string":"University of Twente, Enschede, Netherlands","institution_ids":["https://openalex.org/I94624287"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5133384188","display_name":"Peter Bosch","orcid":null},"institutions":[{"id":"https://openalex.org/I94624287","display_name":"University of Twente","ror":"https://ror.org/006hf6230","country_code":"NL","type":"education","lineage":["https://openalex.org/I94624287"]}],"countries":["NL"],"is_corresponding":false,"raw_author_name":"Peter Bosch","raw_affiliation_strings":["University of Twente, Enschede, Netherlands"],"raw_orcid":"https://orcid.org/0009-0002-4434-5775","affiliations":[{"raw_affiliation_string":"University of Twente, Enschede, Netherlands","institution_ids":["https://openalex.org/I94624287"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5111432433","display_name":"Willem Jonker","orcid":"https://orcid.org/0009-0009-7028-2967"},"institutions":[{"id":"https://openalex.org/I94624287","display_name":"University of Twente","ror":"https://ror.org/006hf6230","country_code":"NL","type":"education","lineage":["https://openalex.org/I94624287"]}],"countries":["NL"],"is_corresponding":false,"raw_author_name":"Willem Jonker","raw_affiliation_strings":["University of Twente, Enschede, Netherlands"],"raw_orcid":"https://orcid.org/0009-0009-7028-2967","affiliations":[{"raw_affiliation_string":"University of Twente, Enschede, Netherlands","institution_ids":["https://openalex.org/I94624287"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":["https://openalex.org/I94624287"],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":true,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":"1339","last_page":"1355"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.4480000138282776,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.4480000138282776,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12479","display_name":"Web Application Security Vulnerabilities","score":0.15569999814033508,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.06589999794960022,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/hierarchy","display_name":"Hierarchy","score":0.6478999853134155},{"id":"https://openalex.org/keywords/leverage","display_name":"Leverage (statistics)","score":0.6061000227928162},{"id":"https://openalex.org/keywords/categorization","display_name":"Categorization","score":0.4921000003814697},{"id":"https://openalex.org/keywords/strengths-and-weaknesses","display_name":"Strengths and weaknesses","score":0.48730000853538513},{"id":"https://openalex.org/keywords/vulnerability","display_name":"Vulnerability (computing)","score":0.3621000051498413},{"id":"https://openalex.org/keywords/software-deployment","display_name":"Software deployment","score":0.32829999923706055}],"concepts":[{"id":"https://openalex.org/C31170391","wikidata":"https://www.wikidata.org/wiki/Q188619","display_name":"Hierarchy","level":2,"score":0.6478999853134155},{"id":"https://openalex.org/C153083717","wikidata":"https://www.wikidata.org/wiki/Q6535263","display_name":"Leverage (statistics)","level":2,"score":0.6061000227928162},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.5565000176429749},{"id":"https://openalex.org/C94124525","wikidata":"https://www.wikidata.org/wiki/Q912550","display_name":"Categorization","level":2,"score":0.4921000003814697},{"id":"https://openalex.org/C63882131","wikidata":"https://www.wikidata.org/wiki/Q17122954","display_name":"Strengths and weaknesses","level":2,"score":0.48730000853538513},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.3700999915599823},{"id":"https://openalex.org/C2522767166","wikidata":"https://www.wikidata.org/wiki/Q2374463","display_name":"Data science","level":1,"score":0.3643999993801117},{"id":"https://openalex.org/C95713431","wikidata":"https://www.wikidata.org/wiki/Q631425","display_name":"Vulnerability (computing)","level":2,"score":0.3621000051498413},{"id":"https://openalex.org/C105339364","wikidata":"https://www.wikidata.org/wiki/Q2297740","display_name":"Software deployment","level":2,"score":0.32829999923706055},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.32820001244544983},{"id":"https://openalex.org/C2779628075","wikidata":"https://www.wikidata.org/wiki/Q1253258","display_name":"Downgrade","level":2,"score":0.3197000026702881},{"id":"https://openalex.org/C15744967","wikidata":"https://www.wikidata.org/wiki/Q9418","display_name":"Psychology","level":0,"score":0.31299999356269836},{"id":"https://openalex.org/C2777615720","wikidata":"https://www.wikidata.org/wiki/Q11888847","display_name":"Prioritization","level":2,"score":0.30799999833106995},{"id":"https://openalex.org/C774472","wikidata":"https://www.wikidata.org/wiki/Q6760393","display_name":"Margin (machine learning)","level":2,"score":0.2896000146865845},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.2766999900341034},{"id":"https://openalex.org/C56739046","wikidata":"https://www.wikidata.org/wiki/Q192060","display_name":"Knowledge management","level":1,"score":0.2678999900817871},{"id":"https://openalex.org/C2779913896","wikidata":"https://www.wikidata.org/wiki/Q7063001","display_name":"Notice","level":2,"score":0.2583000063896179},{"id":"https://openalex.org/C165064840","wikidata":"https://www.wikidata.org/wiki/Q1321061","display_name":"Matching (statistics)","level":2,"score":0.2578999996185303},{"id":"https://openalex.org/C112930515","wikidata":"https://www.wikidata.org/wiki/Q4389547","display_name":"Risk analysis (engineering)","level":1,"score":0.251800000667572}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.1145/3779208.3785376","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3779208.3785376","pdf_url":null,"source":null,"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the ACM Asia Conference on Computer and Communications Security","raw_type":"proceedings-article"},{"id":"pmh:oai:ris.utwente.nl:publications/f6a774fb-9d09-4c1a-8b29-cb7377fb3411","is_oa":true,"landing_page_url":"https://research.utwente.nl/en/publications/f6a774fb-9d09-4c1a-8b29-cb7377fb3411","pdf_url":"https://ris.utwente.nl/ws/files/527526035/asiaccs_knowing_weakness.pdf","source":{"id":"https://openalex.org/S4406922991","display_name":"University of Twente Research Information","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"Simonetto, S, Oostveen, R, van Ede, T, Bosch, P & Jonker, W 2026, Knowing your weaknesses is your greatest strength : Mapping CVE to CWE by leveraging CWE Hierarchy and fine-tuned LLMs. in ACM Asia Conference on Computer and Communications Security (ASIA CCS \u201926). ACM Press, New York, NY, pp. 1339-1355, 21st ACM ASIA Conference on Computer and Communications Security, ACM ASIACCS 2026, Bangalore, India, 1/06/26. https://doi.org/10.1145/3779208.3785376","raw_type":"info:eu-repo/semantics/conferenceObject"}],"best_oa_location":{"id":"doi:10.1145/3779208.3785376","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3779208.3785376","pdf_url":null,"source":null,"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the ACM Asia Conference on Computer and Communications Security","raw_type":"proceedings-article"},"sustainable_development_goals":[{"display_name":"Peace, Justice and strong institutions","score":0.54700767993927,"id":"https://metadata.un.org/sdg/16"}],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"Effective":[0],"defense":[1],"against":[2],"threat":[3],"actors":[4],"requires":[5],"that":[6],"security":[7],"professionals":[8],"accurately":[9],"identify":[10],"the":[11,50,63,72,86,104,114,168,174],"underlying":[12],"weaknesses":[13],"associated":[14,157],"with":[15,158,180],"common":[16,40],"vulnerabilities":[17,123],"and":[18,31,76,136],"exposures":[19],"(CVEs).":[20],"This":[21],"under":[22],"standing":[23],"is":[24],"crucial":[25],"for":[26],"deploying":[27],"appropriate":[28],"defensive":[29],"mechanisms":[30],"prioritizing":[32],"remediation":[33],"efforts.":[34],"However,":[35],"manually":[36],"mapping":[37,73,101],"CVEs":[38,55,66,75,156],"to":[39,49,80,98,142],"weakness":[41],"enumerations":[42],"(CWEs)":[43],"has":[44],"become":[45],"increasingly":[46],"impractical":[47],"due":[48],"rapid":[51],"increase":[52],"of":[53,65,88,117,154,176],"new":[54],"and<br/>the":[56],"extensive,":[57],"complex":[58],"CWE":[59,125],"taxonomy.":[60],"In":[61],"2025,":[62],"number":[64],"awaiting":[67],"analysis":[68],"exceeded":[69],"25,000.<br/><br/>To":[70],"automate":[71],"between":[74],"CWEs,":[77,118],"we":[78,92,108,120],"propose":[79,109],"leverage":[81],"two":[82],"insights.":[83],"To":[84],"harness":[85],"power":[87],"large":[89],"language":[90,96],"models,":[91],"first":[93,121],"fine-tune":[94],"different":[95],"models":[97],"perform":[99],"this":[100],"based":[102],"on":[103,149],"vulnerability-to-weakness":[105],"relation.":[106],"Second,":[107],"a":[110,150,159],"supervised":[111,171],"framework":[112],"leveraging":[113],"hierarchical":[115],"structure":[116],"where":[119],"categorize":[122],"into<br/>broad":[124],"classes":[126],"(e.g.,":[127],"Injection,":[128],"Buffer":[129],"Overflow),":[130],"which":[131],"helps":[132],"capture":[133],"high-level":[134],"patterns,":[135],"then":[137],"utilizes":[138],"specialized":[139],"subnet":[140],"works":[141],"distinguish":[143],"fine-grained":[144],"differences":[145],"within":[146],"each":[147],"class.<br/><br/>Evaluated":[148],"benchmarkthat":[151],"covers":[152],"95%":[153],"all":[155],"CWE,":[160],"our":[161],"approach":[162],"improves":[163],"F1-score":[164],"by":[165],"5%":[166],"over":[167],"best":[169],"prior":[170],"method,":[172],"demonstrating":[173],"value":[175],"combining":[177],"model":[178],"fine-tuning":[179],"hierarchy-aware":[181],"classification.":[182]},"counts_by_year":[],"updated_date":"2026-07-14T23:27:15.235271","created_date":"2026-04-11T00:00:00"}