Abstract
Modern infrastructures and services rely heavily on software systems, which remain persistently vulnerable to cyberattacks. These attacks frequently exploit vulnerabilities documented in public repositories such as MITRE’s CommonVulnerabilities and Exposures (CVE). To achieve timely and proactive defense, it is essential to anticipate which vulnerabilities might be exploited as soon as new attack information becomes available. However, current Cyber Threat Intelligence (CTI) resources, such as MITRE’s Adversarial
Tactics, Techniques, and Common Knowledge (ATT&CK) and CVE repositories, provide only partial and disconnected coverage of the attack–vulnerability relationships. They often describe adversarial behaviors and vulnerabilities independently, leaving many of the relationships between them undocumented. This thesis addresses the problem of forecasting and recommending likely vulnerabilities from textual descriptions of cyberattacks. The motivation stems from the fact that attack information usually appears first, often before the corresponding vulnerability is officially disclosed. Thus, being able to infer vulnerabilities directly from attack descriptions would enable countermeasures to prevent and mitigate
cyberattacks. The key challenge lies in automatically linking natural-language attacks to known vulnerability descriptions, a task that is infeasible to perform manually at scale. Additional challenges include the heterogeneous abstraction levels of attack information, the selection of appropriate text representation models, inconsistencies in existing repositories, and the generalization of models trained on curated data to unseen, real-world reports. To overcome these challenges, this research develops automated methods grounded in advanced Natural Language Processing (NLP), specifically transformer-based sentence embedding models that transform attack and vulnerability descriptions into vector representations
capturing their semantic similarity. These semantic representations enable the system to infer and prioritize vulnerabilities that are most likely associated with attacks. Our methodology follows a systematic and iterative process: First, annotated datasets were constructed using existing links within MITRE repositories to map attacks to vulnerabilities. Second, fourteen state-of-the-art (SOTA) transformer models were compared across four types of attack descriptions (Tactic, Technique, Procedure, and Attack Pattern) to determine which type provides the most informative signal for vulnerability prediction. The results
show that Technique descriptions in the MITRE ATT&CK repository, which describe attack methods and tools, are the most informative for predicting vulnerabilities. Among all evaluated models, the multi-qa-mpnet-base-dot-v1 (MMPNet) transformer achieved the highest performance, because its hybrid pre-training strategy integrates masked and permuted language modeling, enabling it to capture long-range contextual dependencies and nuanced semantic relationships between attack and vulnerability descriptions. Additionally, its fine-tuning on large-scale question–answer datasets optimizes it for semantic similarity tasks, enabling it to capture nuanced contextual dependencies and semantic relations
within short, technical texts that are particularly beneficial for vulnerability inference. The proposed methodology was implemented in the VULDAT tool, which automates the process of linking attack descriptions to known vulnerabilities. Manual validation of its predictions revealed numerous previously undocumented relationships in MITRE, confirming the incompleteness of existing repositories and highlighting the value of automation for knowledge enrichment. Finally, the approach was applied to unseen, real-world cyberattack reports, demonstrating that the proposed models can generalize beyond curated datasets and forecast relevant vulnerabilities from unstructured narratives and provide timely, automated support for vulnerability awareness and mitigation. In conclusion, this thesis advances
the state of vulnerability detection by introducing a data-driven, scalable framework that bridges structured and unstructured sources of cybersecurity knowledge. It reduces reliance on manual curation, accelerates the identification of vulnerabilities, and enhances the completeness of existing threat intelligence repositories. By combining methodological rigor with practical validation, the thesis provides both researchers and practitioners with scalable, automated strategies to strengthen the security of systems in the face of evolving cyberthreats.