POSTER: Toward Realistic CVE-to-CWE Mapping: Temporal Evaluation over the Full CWE Space

Abstract:Automated mapping from CVE records to CWE classes supports vulnerability triage, but many reported results rely on closed label sets, random splits, or CVE-level “any-hit” scoring. We evaluate six representative method families under a single deployment-oriented protocol: all 944 active CWE candidates, a chronological 2016–2023/2024/2025 split, and strict label-level recall@5 by frequency bin. Aggregate ranking quality and open-label coverage order the methods in opposite directions: the two highest aggregate scores (mAP@5 0.746 and 0.630) belong to fixed-head classifiers that recover no rare or unseen CWE, whereas the method with the best unseen-label recall (0.301) ranks last on aggregate. A single summary score therefore does not identify the system one would deploy. A preliminary error analysis further indicates that many residual errors are selection rather than generation failures: a better candidate, and often the exact one, is already present but ranked too low. These results argue for open-set, temporal, per-bin evaluation and for better selection among reachable candidates. Accepted to ACM CCS 2026 as a poster; camera-ready revision in progress.