V2W-LLM: Automated Vulnerability to Weakness Mapping Based on Large Language Model

To address the rapid growth of software vulnerabilities, the latency of manual expert classification, and the limitations of existing methods restricted to fixed categories, this paper proposes V2W-LLM, an automated vulnerability-to-weakness mapping model based on Large Language Models (LLMs). First, a dataset of CVE-CWE description pairs is constructed based on established expert correlations from MITRE. Subsequently, the LLM is instruction-tuned on this dataset to leverage its reasoning capabilities in generating CWE-style descriptive text for newly disclosed, unmapped vulnerabilities. Finally, using a BAAI-based embedding model, the semantic representations of the generated text and official CWE descriptions are computed to identify the optimal mapping via cosine similarity (Top-1). Experimental results indicate that V2W-LLM achieves an accuracy of 90.18% and a Macro-F1 of 87.64% in common categories. Furthermore, on the public ChatGPT-VDMEval and the latest 2024 NVD datasets, the model attains F1 scores of 86.02% and 94.02% respectively, validating its effectiveness in automating the vulnerability-to-weakness mapping process.