An Empirical Study of Fine-Grained Entity Relationships for Tracing Natural Language and Code Vulnerability Artifacts

Understanding software vulnerabilities requires analyzing fine-grained entities and their complex relationships across natural language (NL) artifacts and source code. Vulnerability descriptions often interweave vulnerability triggers (VT), crash phenomena (CP), and after-fix (AF) actions within the same sentence, making it challenging to distinguish root causes, failure symptoms, and remediation strategies. Additionally, missing key NL entities further hinders traceability, limiting an analyst’s ability to determine why and how a vulnerability was introduced and resolved. To address these challenges, we conduct an empirical study on fine-grained entity relationships using a manually curated dataset of 1,000 vulnerabilities. We extract phrase-level VT, CP, and AF entities, categorize them into structured taxonomies, and analyze cross-entity relationships within NL artifacts and source code, uncovering recurring patterns in vulnerability evolution and remediation strategies. Furthermore, we investigate the automation of vulnerability entity extraction using different approaches, showing that ELECTRA [7], a state-of-the-art pre-trained language model, along with other LLM-based approaches, outperforms other methods.