vulnerability-attack-techniques

This dataset maps 1,207 CVEs to MITRE ATT&CK (Enterprise) techniques, joining hand-curated mappings from the MITRE Center for Threat-Informed Defense (CTID) with vulnerability descriptions from CIRCL/vulnerability-scores. It is intended for training and evaluating models that suggest candidate ATT&CK techniques from a vulnerability description: CVSS tells you how bad a vulnerability is, CWE what kind of flaw it is — ATT&CK tells defenders what adversary behavior to expect and detect.

Every label in the techniques column was written by an analyst following the CTID "Mapping ATT&CK to CVE for Impact" methodology, which assigns each CVE up to three kinds of techniques: an exploitation technique (how it is exploited), a primary impact (what exploitation directly yields), and a secondary impact (what the attacker can do next).

Label sources

label_sources	CVEs	Origin
ctid_cve	788	attack_to_cve (2021), ATT&CK v9 era
ctid_kev	392	Mappings Explorer KEV mappings, ATT&CK 16.1
both	27

All technique IDs are normalized to enterprise ATT&CK v19.1: techniques revoked since the original mappings are remapped to their successor via the STIX revoked-by relationships (e.g. T1562 Impair Defenses → T1685 Disable or Modify Tools), and Mobile/ICS techniques are dropped (enterprise domain only).

⚠️ techniques vs techniques_derived

The techniques_derived column contains labels from the automatically derived CVE → CWE → CAPEC → ATT&CK chain maintained by CVE2CAPEC. Do not train on this column. Analysis of the chain shows a median fan-out of 4–20 techniques per CVE and top-frequency techniques (e.g. T1574.007 on 53% of 2024 CVEs) that are artifacts of the cross-framework table expansion, not descriptions of real adversary behavior. The column is included as:

1. a candidate prior at inference time (restrict suggestions to techniques compatible with the CWE chain);
2. a baseline that a trained model must beat;
3. a comparison column for studying where the deterministic chain diverges from analyst judgment.

The full source analysis is documented in the VulnTrain documentation.

Fields

Field	Type	Description
id	string	CVE identifier
title	string	Vulnerability title
description	string	Vulnerability description in English (model input)
exploitation_techniques	list[string]	CTID exploitation technique(s)
primary_impact	list[string]	CTID primary impact technique(s)
secondary_impact	list[string]	CTID secondary impact technique(s)
techniques	list[string]	Union of all curated techniques — the training target
techniques_derived	list[string]	CVE2CAPEC weak labels — not for training
label_sources	list[string]	ctid_cve and/or ctid_kev
attack_version	string	Enterprise ATT&CK version the IDs are normalized to

Label statistics

192 distinct techniques; 66 with at least 5 examples. Most CVEs carry 1–3 techniques. Top techniques: T1190 Exploit Public-Facing Application (348), T1059 Command and Scripting Interpreter (262), T1203 Exploitation for Client Execution (213), T1068 Exploitation for Privilege Escalation (189).

Known limitations

• Size: ~1,200 CVEs supports a proof-of-concept, not a production model.
• Selection bias: both label sources over-represent exploited-in-the-wild vulnerabilities (the KEV set by construction).
• Inherent task ceiling: a CVE description describes a flaw, while ATT&CK describes attacker behavior around it — even human annotators disagree on such mappings. Models trained on this data should suggest candidate techniques for analyst review, not produce authoritative mappings.

Usage

from datasets import load_dataset

dataset = load_dataset("CIRCL/vulnerability-attack-techniques")

for entry in dataset["train"].select(range(3)):
    print(entry["id"], entry["techniques"], "-", entry["description"][:80])

Licensing of upstream sources

The CTID mappings are Apache-2.0. Descriptions come from CIRCL/vulnerability-scores (CC BY 4.0). The techniques_derived column is derived from the GPLv3 CVE2CAPEC project. MITRE ATT&CK® is a registered trademark of The MITRE Corporation; ATT&CK content is used in accordance with the MITRE ATT&CK terms of use.

References

• Vulnerability-Lookup — the vulnerability data source
• VulnTrain — generation pipeline (vulntrain-dataset-attack-generation)
• Methodology documentation
• MITRE CTID attack_to_cve and Mappings Explorer
• CVE2CAPEC by Galeax