对比两种BERT模型在漏洞分类中的表现，发现多标签更准但结构误差难改。
Multi-Class vs. Multi-Label BERT for CVE-to-CWE Mapping: How Taxonomy Structure Shapes the Errors
- 用多分类和多标签两种方式训练BERT模型，比较漏洞分类效果。
- 多分类在83类时宏F1高21个百分点，标签越少差距越小。
- 错误模式受分类层级影响大，放宽层级容忍度可提升准确率90%。
将通用弱点枚举（CWE）类别分配给通用漏洞披露（CVE）记录仍是漏洞分析中重要但主要依赖人工的步骤。本文将该任务视为文本分类问题，比较了两种建模方式：一种是为每个CVE预测单一CWE的多分类法，另一种是允许多个分配的多标签法。在三个嵌套标签空间（83、47、25类）上评估了三种Transformer编码器（BERT Base、SecureBERT、CySecBERT）。多分类训练在所有设置下均取得更高的宏F1值，尽管与多标签的差距从21个百分点缩小至2个百分点，随着标签空间减小而变小。对多标签方案进行事后阈值优化后，25类设置下的差距得以消除。混淆分析显示，主要误分类模式遵循CWE层级结构，且在三种编码器间高度一致（皮尔逊相关系数r > 0.92），表明错误结构更多由分类体系设计决定，而非编码器选择。一种放宽层级约束的评估方式（允许同家族内混淆）将宏F1从~81%提升至~90%，说明严格指标低估了分支级分类器的实际性能。总体而言，CySecBERT表现最佳，在多标签设置中获得显著统计优势。
原文摘要 · Abstract (English)
Assigning Common Weakness Enumeration (CWE) categories to Common Vulnerabilities and Exposures (CVE) records remains an important but largely manual step in vulnerability analysis. We study this task as a text classification problem and compare two modelling choices: a \emph{multi-class} formulation that predicts a single CWE per CVE and a \emph{multi-label} formulation that allows multiple assignments. Three transformer encoders (BERT Base, SecureBERT, and CySecBERT) are evaluated on three nested label spaces (83, 47, and 25 classes). Multi-class training achieves higher macro-F1 across all settings, although the gap to multi-label narrows from 21 to 2 percentage points as the label space shrinks. Post-hoc threshold optimisation on the multi-label side closes this gap on the 25-class setting. Confusion analysis shows that the dominant misclassification patterns follow the CWE hierarchy and are shared across all three encoders (Pearson $r > 0.92$), which suggests that the error structure is driven more by taxonomy design than by encoder choice. A hierarchy-relaxed evaluation that forgives within-family confusions raises macro-F1 from ${\sim}$81\% to ${\sim}$90\%, indicating that strict metrics understate branch-level classifier quality. CySecBERT achieves the strongest results overall, with statistically significant gains concentrated in the multi-label setting.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。