Explainable Multi-CVE Family Discovery via CWE/CAPEC Graph Semantics

Explainable Multi-CVE Family Discovery via CWE/CAPEC Graph Semantics presents Nova CAMI, a small-data, air-gap-friendly system that groups related CVEs by what they do—their CWE/CAPEC mechanics—rather than how their text happens to be written. Each CVE becomes a sparse ID-vector over {CWE, CAPEC}; families are formed with cosine similarity and single-link clustering (with a chaining guard for coherence). For every family, Nova produces converging, audit-ready evidence: (1) SHAP-style CAPEC marginals showing which attack patterns drive membership, (2) explicit CVE→CWE→CAPEC path counts, and (3) Random Walk with Restart diffusion to surface second-order patterns. An IDs-only brief (no hallucinated labels) turns these families into operator-ready summaries suitable for restricted environments. We compare against TF-IDF/SBERT text clustering and graph community detection (Louvain/Leiden) using pair/cluster metrics, ablations, and a practitioner study. The result: more coherent, justifiable, and actionable families—exportable as JSON and Neo4j overlays—without model training or external calls. Nova is designed for real workflows: CPU-only, sparse ops, minimal REST facade, and strict provenance.