LyndHub
Jadwal Sholat

Memuat jadwal sholat…

← All journalsSearch index

Ilmu Komputer & AI editorial

Open AccessOA2026

Evaluating the NIST Bugs Framework Against CWE as a Successor for Automated Vulnerability Classification

An empirical assessment of BF's reproducibility and automation-friendliness for CVE-to-weakness mapping
Md Nazmul Hoque; Shaswata Mitra; Subash Neupane; Sudip Mittal; Shahram Rahimi· 2026· DOI 10.48550/arXiv.2609.16433

The core problem

Vulnerability classification based on root cause weaknesses is essential for numerous cybersecurity activities, where the Common Weakness Enumeration (CWE) serves as a public repository of such flaws. However, its overlapping entries create a non-orthogonal structure. The result is the same vulnerability being mapped to multiple weaknesses, complicating Root Cause Analysis (RCA) and triage. To address this, NIST Special Publication 800-231 introduces the Bugs Framework (BF), which organizes vulnerabilities into

triples and links such triples into a causal chain, so that a vulnerability carries its root cause and its sink together instead of a single terminal label. To date, however, BF has been specified but not evaluated regarding its performance against the challenges to automated classification. The evidence required for adoption has not been investigated empirically. This paper evaluates BF as a classification target and a complement to CWE using a systematically screened corpus of automated Common Vulnerabilities and Exposures (CVEs) linked to CWE research.

Innovation

The inter-rater study revealed strong agreement on the cause and operation axes, with fair agreement on the attribute axis. This indicates that while BF provides a clear structure for cause and operation, the attribute axis requires more precise guidance. The automated framework, tested across two LLM deployments under different budgets, demonstrated reproducibility in mapping CVEs to BF. Despite limitations such as evidence availability and the absence of retrievable fix commits for closed-source software, the findings support the claim that BF is a more structured and automation-friendly framework than CWE. The study also reveals specific gaps in BF, including under-specified guidance on attributes. The results suggest that BF can complement CWE by providing a more orthogonal and causal representation of vulnerabilities.

Vulnerability classification based on root cause weaknesses is essential for numerous cybersecurity activities, where the Common Weakness Enumeration (CWE) serves as a public repository of such flaws. However, its overlapping entries create a non-orthogonal structure. The result is the same vulnerability being mapped to multiple weaknesses, complicating Root Cause Analysis (RCA) and triage. To address this, NIST Special Publication 800-231 introduces the Bugs Framework (BF), which organizes vulnerabilities into

triples and links such triples into a causal chain, so that a vulnerability carries its root cause and its sink together instead of a single terminal label. To date, however, BF has been specified but not evaluated regarding its performance against the challenges to automated classification. The evidence required for adoption has not been investigated empirically. This paper evaluates BF as a classification target and a complement to CWE using a systematically screened corpus of automated Common Vulnerabilities and Exposures (CVEs) linked to CWE research.

The authors assess the reproducibility of CVE-to-BF classification through two evaluations. The first is qualitative: an anonymized inter-rater study in which 2 subject-matter experts (SMEs) independently mapped 13 CVEs onto the four BF axes. Annotators showed strong agreement on the cause and operation axes, while the attribute axis indicated fair agreement. The second evaluation tests an automated framework across two large language model (LLM) deployments under different budgets for reproducibility analysis. The corpus consists of systematically screened automated Common Vulnerabilities and Exposures (CVEs) linked to CWE research. The study acknowledges limitations, such as evidence availability and the absence of retrievable fix commits for closed-source software. The BF structure can be represented as a causal chain:

Why it matters

The evaluation highlights BF's potential as a successor or complement to CWE for automated vulnerability classification. The non-orthogonal structure of CWE leads to overlapping entries and multiple mappings for a single vulnerability, complicating RCA and triage. BF's

triples and causal chains offer a more structured approach, carrying both root cause and sink. The strong agreement on cause and operation axes indicates that these aspects are well-defined, while the fair agreement on attributes points to a need for clearer specifications. The LLM-based automation shows promise but is limited by evidence availability and closed-source software constraints. Future work should address these gaps, particularly in attribute guidance, to enhance BF's adoption. Overall, BF presents a more automation-friendly framework, but further empirical evidence is needed to fully replace CWE.

Who should read this

CS practitioners and researchers

Opening member content…