LLM-Based CVE Mapping to MITRE ATT&CK Tactics
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Mapping CVEs to MITRE ATT&CK Framework tactics is challenging, time-consuming, and requires manual effort, leaving systems vulnerable until relevant tactics and techniques are identified, delaying remediation measures.
Innovation Solution
A system utilizing fine-tuned large language models (LLMs) to automate the mapping of CVEs to MITRE ATT&CK Framework tactics through data augmentation and resampling, enabling efficient and accurate identification of threat stages.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If manual mapping of CVEs to MITRE ATT&CK Framework tactics is performed, then mapping accuracy can be maintained, but time consumption and effort increase significantly
Solution Approach 1:
The patent replaces manual mechanical mapping processes with an automated LLM-based system. The LLM processes CVE descriptions and automatically identifies corresponding MITRE ATT&CK tactics, eliminating the need for manual analysis while maintaining high accuracy through the model's trained understanding of both frameworks.
Solution Approach 2:
The system enables self-service mapping where the LLM autonomously performs the mapping task without human intervention. The model independently analyzes CVE data, retrieves relevant MITRE ATT&CK tactics, and generates mappings automatically, allowing the system to serve itself rather than requiring continuous manual input.
2Reliability
If manual mapping of CVEs to MITRE ATT&CK Framework tactics is performed, then mapping reliability can be ensured, but productivity decreases
Solution Approach 1:
The patent replaces slow manual mapping with high-speed automated LLM processing. The model can analyze multiple CVEs and generate mappings instantly, dramatically increasing productivity while maintaining reliability through the model's consistent application of framework knowledge and cross-validation mechanisms.
Solution Approach 2:
The system enables continuous automated mapping operation where the LLM can process CVEs as they are introduced, without interruption or manual intervention. This continuous operation maintains high productivity while reliability is sustained through ongoing validation and updates of the mapping logic.
3Reliability
If manual mapping processes are used, then control over mapping quality can be maintained, but the system remains vulnerable until mapping is completed
Solution Approach 1:
The patent implements preliminary automated mapping as soon as CVE data becomes available, before manual review can be performed. The LLM immediately processes new CVEs and generates initial mappings, reducing the vulnerability window. Quality control is then applied through validation mechanisms that review the automated mappings.
Solution Approach 2:
The system incorporates feedback loops where automated mappings are validated and corrected based on quality checks, and these corrections feed back into the mapping process. This feedback mechanism ensures both speed and quality control, reducing vulnerability by maintaining continuous, reliable mapping operations.
Data Source
AI summary
A plurality of Common Vulnerabilities and Exposures (CVEs) is obtained. The CVEs are pre-processed in part by extracting information from the plurality of CVEs to generate a training dataset. One or more pre-trained large language models (LLMS) are fine-tuned using a balanced version of the training dataset. A mapping of the plurality of CVEs to one or more attack tactics is automatically generated utilizing the one or more fine-tuned LLMs by inputting into the one or more fine-tuned LLMS vulnerability descriptions associated with the plurality of CVEs