LorenzoNava/cve-cwe-dataset-cleaned

# CVE-CWE Dataset (Cleaned) Cleaned version of the CVE-CWE dataset with only standard CWE classifications. ## Dataset Source **Original Dataset:** [stasvinokur/cve-and-cwe-dataset-1999-2025](https://huggingface.co/datasets/stasvinokur/cve-and-cwe-dataset-1999-2025) This dataset contains CVE (Common Vulnerabilities and Exposures) descriptions paired with their corresponding CWE (Common Weakness Enumeration) classifications from 1999-2025. ## Cleaning Process The original dataset contained **280,694 samples**. We performed the following cleaning: ### 1. Removed Non-Standard Classifications - **Removed:** 55,550 samples (19.79%) labeled as `"NVD-CWE-Other"` - **Reason:** "NVD-CWE-Other" is a catch-all category, not a specific weakness classification ### 2. Removed Missing Values - **Removed:** Samples with null or empty `CWE-ID` values - **Reason:** Cannot train on samples without target labels ### 3. Validated CWE Format - **Kept:** Only samples matching pattern `CWE-XXXX` (where XXXX is numeric) - **Example valid:** `CWE-79`, `CWE-119`, `CWE-89` - **Example removed:** `NVD-CWE-Other`, `null`, `""` ## Dataset Statistics | Metric | Value | |--------|-------| | **Total samples** | 225,144 | | **Unique CWE classes** | 695 | | **Removed samples** | 55,550 (19.79% of original) | | **Time range** | 1999-2025 | | **Language** | English | ## Dataset Structure ```python { "DESCRIPTION": str, # CVE vulnerability description "CWE-ID": str, # CWE classification (e.g., "CWE-79") } ``` ## Usage ```python from datasets import load_dataset # Load cleaned dataset dataset = load_dataset("LorenzoNava/cve-cwe-dataset-cleaned") # Example print(dataset['train'][0]) # { # 'DESCRIPTION': 'A buffer overflow in the web server...', # 'CWE-ID': 'CWE-119' # } ``` ## Top 10 Most Common CWEs (Statistics will be updated) 1. CWE-79 - Cross-site Scripting (XSS) 2. CWE-119 - Buffer Errors 3. CWE-200 - Information Exposure 4. CWE-20 - Improper Input Validation 5. CWE-89 - SQL Injection 6. CWE-264 - Permissions, Privileges, and Access Controls 7. CWE-399 - Resource Management Errors 8. CWE-287 - Improper Authentication 9. CWE-352 - Cross-Site Request Forgery (CSRF) 10. CWE-22 - Path Traversal ## Comparison with Original Dataset | Aspect | Original | Cleaned | |--------|----------|---------| | **Samples** | 280,694 | 225,144 | | **CWE classes** | 696 | 695 | | **Includes "NVD-CWE-Other"** | ✅ Yes | ❌ No | | **Only standard CWEs** | ❌ No | ✅ Yes | | **Best for** | Research, analysis | Training ML models | ## Use Cases ### ✅ Recommended For: - Training CWE classification models - Building automated vulnerability assessment tools - Researching CWE distribution patterns - Developing security ML applications ### ❌ Not Recommended For: - Analyzing "unknown" or uncategorized vulnerabilities - Studies requiring complete historical data - Research on NVD categorization practices For these use cases, use the [original dataset](https://huggingface.co/datasets/stasvinokur/cve-and-cwe-dataset-1999-2025) instead. ## Data Quality - ✅ All samples have valid CWE-ID - ✅ All CWE-IDs follow standard format (CWE-XXXX) - ✅ No duplicate removal (preserves all valid samples) - ✅ No text preprocessing (original CVE descriptions preserved) ## Citation If you use this dataset, please cite: ```bibtex @dataset{cve-cwe-cleaned-2024, author = {Berghem - Smart Information Security}, title = {CVE-CWE Dataset (Cleaned)}, year = {2024}, publisher = {Hugging Face}, url = {https://huggingface.co/datasets/LorenzoNava/cve-cwe-dataset-cleaned}, note = {Cleaned version of stasvinokur/cve-and-cwe-dataset-1999-2025} } ``` **Original dataset citation:** ```bibtex @dataset{cve-cwe-original-2025, author = {Vinokur, Stas}, title = {CVE and CWE Dataset 1999-2025}, year = {2025}, publisher = {Hugging Face}, url = {https://huggingface.co/datasets/stasvinokur/cve-and-cwe-dataset-1999-2025} } ``` ## License Same license as original dataset. ## Developed By **Berghem - Smart Information Security** For questions or issues, visit the [dataset repository](https://huggingface.co/datasets/LorenzoNava/cve-cwe-dataset-cleaned).# CVE-CWE 数据集（清理版） 本数据集为仅包含标准CWE分类的CVE-CWE数据集清理版本。 ## 数据集来源 **原始数据集**：[stasvinokur/cve-and-cwe-dataset-1999-2025](https://huggingface.co/datasets/stasvinokur/cve-and-cwe-dataset-1999-2025) 本数据集收录了1999年至2025年间的CVE（通用漏洞与披露，Common Vulnerabilities and Exposures）描述及其对应的CWE（通用弱点枚举，Common Weakness Enumeration）分类标签。 ## 数据清理流程 ### 1. 移除非标准分类标签 - **移除样本**：55,550条（占原始数据集的19.79%），其标签为`"NVD-CWE-Other"` - **清理原因**：`"NVD-CWE-Other"`为通用兜底类别，并非特定弱点分类。 ### 2. 移除缺失值样本 - **移除样本**：`CWE-ID`字段为空或为null的样本 - **清理原因**：无目标标签的样本无法用于模型训练。 ### 3. 验证CWE格式 - **保留样本**：仅保留符合`CWE-XXXX`格式的样本（其中XXXX为数字） - 有效格式示例：`CWE-79`、`CWE-119`、`CWE-89` - 移除格式示例：`NVD-CWE-Other`、`null`、`""` ## 数据集统计指标 | 指标 | 数值 | |--------|-------| | **总样本量** | 225,144 | | **唯一CWE类别数** | 695 | | **移除样本量** | 55,550（占原始数据集的19.79%） | | **时间范围** | 1999-2025 | | **数据语言** | 英语 | ## 数据集结构 python { "DESCRIPTION": str, # CVE漏洞描述文本 "CWE-ID": str, # CWE分类标签（例如："CWE-79"） } ## 使用示例 python from datasets import load_dataset # 加载清理版CVE-CWE数据集 dataset = load_dataset("LorenzoNava/cve-cwe-dataset-cleaned") # 输出单条样本示例 print(dataset['train'][0]) # { # 'DESCRIPTION': 'Web服务器中存在缓冲区溢出漏洞...', # 'CWE-ID': 'CWE-119' # } ## 十大最常见CWE类别 （统计信息将持续更新） 1. CWE-79 - 跨站脚本（Cross-site Scripting，XSS） 2. CWE-119 - 缓冲区错误（Buffer Errors） 3. CWE-200 - 信息泄露（Information Exposure） 4. CWE-20 - 输入验证不当（Improper Input Validation） 5. CWE-89 - SQL注入（SQL Injection） 6. CWE-264 - 权限、特权与访问控制（Permissions, Privileges, and Access Controls） 7. CWE-399 - 资源管理错误（Resource Management Errors） 8. CWE-287 - 身份验证不当（Improper Authentication） 9. CWE-352 - 跨站请求伪造（Cross-Site Request Forgery，CSRF） 10. CWE-22 - 路径遍历（Path Traversal） ## 与原始数据集对比 | 对比维度 | 原始数据集 | 清理版数据集 | |--------|----------|---------| | **样本量** | 280,694 | 225,144 | | **CWE类别数** | 696 | 695 | | **包含"NVD-CWE-Other"类别** | ✅ 是 | ❌ 否 | | **仅包含标准CWE类别** | ❌ 否 | ✅ 是 | | **适用场景** | 研究、分析 | 机器学习模型训练 | ## 适用场景 ### ✅ 推荐应用场景： - 训练CWE分类模型 - 构建自动化漏洞评估工具 - 研究CWE分布模式 - 开发安全领域机器学习应用 ### ❌ 不推荐应用场景： - 分析“未知”或未分类漏洞 - 需要完整历史数据的研究 - 针对NVD分类实践的研究 对于上述场景，请使用[原始数据集](https://huggingface.co/datasets/stasvinokur/cve-and-cwe-dataset-1999-2025)。 ## 数据质量 - ✅ 所有样本均包含有效CWE-ID - ✅ 所有CWE-ID均符合标准`CWE-XXXX`格式 - ✅ 未执行去重操作，保留所有有效样本 - ✅ 未对原始CVE描述文本进行预处理，完整保留原文内容 ## 引用说明 若您使用本数据集，请引用如下文献： bibtex @dataset{cve-cwe-cleaned-2024, author = {Berghem - Smart Information Security}, title = {CVE-CWE Dataset (Cleaned)}, year = {2024}, publisher = {Hugging Face}, url = {https://huggingface.co/datasets/LorenzoNava/cve-cwe-dataset-cleaned}, note = {Cleaned version of stasvinokur/cve-and-cwe-dataset-1999-2025} } **原始数据集引用：** bibtex @dataset{cve-cwe-original-2025, author = {Vinokur, Stas}, title = {CVE and CWE Dataset 1999-2025}, year = {2025}, publisher = {Hugging Face}, url = {https://huggingface.co/datasets/stasvinokur/cve-and-cwe-dataset-1999-2025} } ## 许可证 与原始数据集保持一致的许可证协议。 ## 开发方 **Berghem - 智能信息安全团队** 如需咨询或反馈问题，请访问[数据集仓库](https://huggingface.co/datasets/LorenzoNava/cve-cwe-dataset-cleaned).