Sana9/securebert-vuln2atlas-flat

SecureBERT — CVE-LMTune ATLAS Classifier (Flat)

Part of the CVE-LMTune model suite, a collection of language models fine-tuned for multi-taxonomy vulnerability classification across widely used cybersecurity taxonomies, including CWE, CAPEC, MITRE ATT&CK, and MITRE ATLAS (adversarial machine learning).

Overview

This model performs multi-label MITRE ATLAS classification from vulnerability descriptions. Given a CVE-style description, it predicts one or more MITRE ATLAS technique identifiers (AML.T####) associated with the described vulnerability.

Property	Value
Taxonomy	MITRE ATLAS (Adversarial Threat Landscape for AI Systems) — Techniques
Task	Multi-label text classification
Base model	SecureBERT (ehsanaghaei/SecureBERT)
Input	Vulnerability description (e.g., CVE summary)
Output	One or more ATLAS technique identifiers
Number of labels	10
Number of samples	80,604
Split	train (60%), val (20%), test (20%)

Labels

ATLAS ID	Technique
AML.T0006	Active Scanning
AML.T0012	Valid Accounts
AML.T0037	Data from Local System
AML.T0052	Phishing
AML.T0074	Masquerading
AML.T0089	Process Discovery
AML.T0091.000	Application Access Token
AML.T0105	Escape to Host
AML.T0106	Exploitation for Credential Access
AML.T0107	Exploitation for Defense Evasion

Evaluation Results

The model was evaluated on the held-out test set using standard multi-label classification metrics with sigmoid activation and a default threshold of 0.5.

Ranking Metrics

LRAP	MRR	Coverage Error	Label Ranking Loss	P@1	P@3	P@5	R@1	R@3	R@5
0.8965	0.8963	2.2725	0.0538	0.8438	0.5408	0.3469	0.5809	0.9047	0.9670

Threshold = 0.5

Micro P	Micro R	Micro F1	Macro F1	Weighted F1	Hamming Loss	Subset Accuracy
0.8637	0.8115	0.8368	0.8106	0.8369	0.0569	0.7671

Quick Start

from transformers import AutoTokenizer, AutoModelForSequenceClassification
import torch

tokenizer = AutoTokenizer.from_pretrained("Sana9/securebert-vuln2atlas-flat", use_fast=False)
model = AutoModelForSequenceClassification.from_pretrained("Sana9/securebert-vuln2atlas-flat")

text = "An attacker crafts adversarial examples to evade a machine learning malware classifier."

with torch.no_grad():
    probs = torch.sigmoid(
        model(**tokenizer(text, return_tensors="pt", truncation=True)).logits
    )[0]

predictions = {
    model.config.id2label[i]: p.item()
    for i, p in enumerate(probs)
    if p > 0.5
}

print(predictions)

Citation

A paper describing this model is currently in preparation. Citation information will be added here upon publication.

Related Resources

• 🤗 Full model suite on Hugging Face
• 💻 CVE-LMTune — Training code (GitHub)
• 📦 Zenodo — Data repository

Disclaimers

• This product is a result of the use of the NVD API but is not endorsed or certified by the NVD. The same applies to the AVID database and the Hugging Face API.
• This project relies on data publicly available from the MITRE ATLAS and MITRE ATT&CK projects.
• This work has been partially supported by the French National Research Agency under the France 2030 label (Superviz ANR-22-PECY-0008). The views reflected herein do not necessarily reflect the opinion of the French government.