Vulnerability Root Cause Mapping with CWE
summary
Claims that grounded LLM workflows can scale CVE→CWE mapping are backed by a prototype that combines sparse/dense/graph retrievers to cut ~1,000 CWEs to a retriever shortlists ~10 and feeds a grounded LLM that outputs candidates with confidence and rationale. Bulk tests on ~7K CVEs take ~27 hours and cost about ~$15 for 7K CVEs, yielding ~81% exact matches and ~90% within graph distance 1–2. Failures trace to missing reference content, access‑control subtleties, and link rot; a CWE chatbot prototype is built and usable.
AI-written summary · about
chapters (16)
- 0:00Introduction to RCM
- 2:35Value of root cause mapping
- 3:57RCM challenges and LLM potential
- 12:31Measuring vulnerability quality
- 13:20Grounded LLM capabilities
- 15:48Methodology for CWE assignment
- 17:42Data layers in mapping
- 18:52Input data sources
- 19:11Retrieval techniques
- 20:57Case study examples
- 26:04Comparing manual and AI approaches
- 32:56Common error analysis
- 34:22Defining success metrics
- 35:53Evaluation of model results
- 38:21Future vision and community
- 54:37Q&A and closing
related talks
53mPanel Discussion: Enabling Accurate, Decentralized Root Cause Mapping at Scale
57mThe CWE Program: Current State and Road Ahead
01h 01mFrom Roadmap to Results: Measuring CWE Adoption to Enable Prevention
30mBoosting Vulnerability Intelligence: How Accurate CWE Mappings Transform ML Model Performance
15mCVE vs CWE: From Patch Fixes to Eradicating Root Causes
56mCVE Is The Worst Vulnerability Framework (Except For All The Others)
29mWorms, Tokens, and Trust The Industrialization of Supply Chain Attacks
01mEvolution of CVEs and Vulnerability Management