---
title: "多类 vs. 多标签BERT在CVE到CWE映射中的应用：分类体系如何塑造错误模式"
source: "arXiv AI/CL/LG（论文）"
source_tier: "t2"
url: "https://arxiv.org/abs/2607.07573v1"
permalink: "https://feed.astralor.com/items/itm_97eaadf565495074a0ad6e19"
published: "2026-07-08T16:01:21.000Z"
score: 76
channel: "ai"
tags: ["BERT","CySecBERT","SecureBERT","多标签分类","多类分类","漏洞分析"]
---

# 多类 vs. 多标签BERT在CVE到CWE映射中的应用：分类体系如何塑造错误模式

## AI 点评

> 这篇论文最值得关注的是它用精心设计的实验证明了分类体系本身比模型选择更能影响错误模式。对于从事安全知识图谱或漏洞自动化分析的研究者，层次松弛评估的提议可能改变现有的基准测试方式。安全从业者则应留意CySecBERT在网络安全文本上的优势。

## 速览

该研究将CVE到CWE映射视为文本分类任务，比较了多类与多标签两种建模方式。在三种BERT变体（BERT Base、SecureBERT、CySecBERT）和三种标签空间（83、47、25类）上进行评估。结果显示多类训练的macro-F1在所有设置下更高，但随着标签空间缩小，差距从21个百分点缩小至2个百分点。错误分析表明，主要分类错误遵循CWE层次结构，且三种编码器间高度相关（Pearson r>0.92），说明错误结构更多源于分类体系设计而非编码器选择。放宽层次结构后，macro-F1从约81%提升至约90%。CySecBERT在多数设置下表现最佳。

## 关键点

- 多类训练在所有标签空间下macro-F1更高，但与多标签的差距随标签减少而缩小。
- 80%以上的错误属于同一CWE父类别内的混淆，而非跨层次错误。
- 三种BERT编码器的错误模式高度相似，表明分类体系设计是主要误差来源。
- CySecBERT在多数设置下表现最优，尤其在多标签场景中统计显著更优。

## 全文

Assigning Common Weakness Enumeration (CWE) categories to Common Vulnerabilities and Exposures (CVE) records remains an important but largely manual step in vulnerability analysis. We study this task as a text classification problem and compare two modelling choices: a \emph{multi-class} formulation that predicts a single CWE per CVE and a \emph{multi-label} formulation that allows multiple assignments. Three transformer encoders (BERT Base, SecureBERT, and CySecBERT) are evaluated on three nested label spaces (83, 47, and 25 classes). Multi-class training achieves higher macro-F1 across all settings, although the gap to multi-label narrows from 21 to 2 percentage points as the label space shrinks. Post-hoc threshold optimisation on the multi-label side closes this gap on the 25-class setting. Confusion analysis shows that the dominant misclassification patterns follow the CWE hierarchy and are shared across all three encoders (Pearson $r > 0.92$), which suggests that the error structure is driven more by taxonomy design than by encoder choice. A hierarchy-relaxed evaluation that forgives within-family confusions raises macro-F1 from ${\sim}$81\% to ${\sim}$90\%, indicating that strict metrics understate branch-level classifier quality. CySecBERT achieves the strongest results overall, with statistically significant gains concentrated in the multi-label setting.

---

引用前请核对原文;本文由星际流动整理:https://feed.astralor.com/items/itm_97eaadf565495074a0ad6e19