How does V2W-BERT map CVEs to CWEs, and what role does the Reconstruction Decoder play?

V2W-BERT maps CVEs to CWEs by using a Siamese pair of BERT encoders to embed CVE and CWE descriptions into a shared space and treating the mapping as a link prediction problem. The Reconstruction Decoder takes the encoder's last hidden state, feeds it into a masked language model, and reconstructs masked tokens. By jointly optimizing link classification loss and reconstruction loss, it keeps link prediction from degrading the model's ability to preserve original textual context.

V2W-BERT is a transformer-based framework that formulates CVE-to-CWE mapping as link prediction. Its Siamese architecture uses two BERT encoders to embed CVE descriptions and CWE descriptions into a common semantic space. The link prediction component then establishes connections between a CVE and candidate CWEs, and this design works even when training examples are scarce or absent, making it effective for rare CWE classes. The Reconstruction Decoder receives the last hidden state from each BERT encoder after processing a CVE or CWE description. That hidden state is fed into a masked language head, which predicts masked tokens, and cross-entropy loss is used to minimize the gap between the original input and the reconstructed tokens. The LP and RD layers are trained concurrently by combining link classification loss with reconstruction loss, which lets V2W-BERT optimize link classification while preserving contextual integrity. V2W-BERT achieved up to 97% prediction accuracy for randomly partitioned data and up to 94% for temporally partitioned data in tests using vulnerability and weakness reports from MITRE and NVD.