125M参数模型实现漏洞分类，性能媲美80亿参数大模型
Fine-tuning RoBERTa for CVE-to-CWE Classification: A 125M Parameter Model Competitive with LLMs
- 用AI标注23万条漏洞描述，构建高质量训练集
- 在205类弱点中达60.7%宏平均F1，稀有类别提升显著
- 仅需8分之1参数就媲美大模型，适合资源受限场景
我们提出一个经过微调的RoBERTa-base分类器（125M参数），用于将通用漏洞披露（CVE）描述映射到通用弱点多枚举（CWE）类别。通过使用Claude Sonnet 4.6对234,770条CVE描述进行AI精炼并筛选出与NVD标签一致的评估集，构建大规模训练数据。在包含27,780样本、205个CWE类别的独立测试集上，该模型达到87.4%的顶1准确率和60.7%的宏平均F1，较已达84.9%顶1准确率的TF-IDF基线提升15.5个百分点，尤其在罕见弱点类别上表现突出。在外部CTI-Bench基准（NeurIPS 2024）上，模型取得75.6%严格准确率（95%置信区间：72.8-78.2%），与拥有80亿参数的Cisco Foundation-Sec-8B-Reasoning模型（75.3%）统计上无差异，但仅需其64倍少的参数。相关数据集、模型及训练代码均已公开。
原文摘要 · Abstract (English)
We present a fine-tuned RoBERTa-base classifier (125M parameters) for mapping Common Vulnerabilities and Exposures (CVE) descriptions to Common Weakness Enumeration (CWE) categories. We construct a large-scale training dataset of 234,770 CVE descriptions with AI-refined CWE labels using Claude Sonnet 4.6, and agreement-filtered evaluation sets where NVD and AI labels agree. On our held-out test set (27,780 samples, 205 CWE classes), the model achieves 87.4% top-1 accuracy and 60.7% Macro F1 -- a +15.5 percentage-point Macro F1 gain over a TF-IDF baseline that already reaches 84.9% top-1, demonstrating the model's advantage on rare weakness categories. On the external CTI-Bench benchmark (NeurIPS 2024), the model achieves 75.6% strict accuracy (95% CI: 72.8-78.2%) -- statistically indistinguishable from Cisco Foundation-Sec-8B-Reasoning (75.3%, 8B parameters) at 64x fewer parameters. We release the dataset, model, and training code.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。