OWASP/CWE-rooted Taxonomy

• OWASP/CWE-rooted Taxonomy is a formal, extensible system that integrates OWASP vulnerability categories with CWE standards to precisely classify software weaknesses.
• It utilizes a robust mapping methodology by aligning OWASP Top 10 and CWE/SANS Top 25 entries to improve static analysis triage and remediation strategies.
• The taxonomy extends to emerging domains like multi-agent systems, enabling scalable, explainable security assessments across diverse threat environments.

An OWASP/CWE-rooted taxonomy is a formal and extensible security taxonomy grounded in both the Open Web Application Security Project (OWASP) vulnerability categories and the Common Weakness Enumeration (CWE) standard. Such taxonomies provide ontological rigor for organizing, relating, and reasoning about software weaknesses, their attack methodologies, technological vectors, and their impact on software quality. Several recent works have demonstrated the application of such taxonomies to web applications as well as modern, complex threat environments such as multi-agent systems, integrating static analysis and practical security tooling (Ezenwoye et al., 2022, Krawiecka et al., 13 Aug 2025, Li, 2020).

1. Theoretical Foundation and Ontological Design

A core OWASP/CWE-rooted taxonomy constructs a hierarchy of abstractions linking application-level vulnerabilities—typically structured around OWASP's Top Ten or analogous lists—to the atomic patterns described in CWE. Ezenwoye and Liu specify this as an ontology, comprising abstract and concrete classes such as Weakness (e.g., XSS, SQLInjection), AttackMethod, AttackVector, Technology, and QualityAttribute. Each Weakness instance is characterized by its CWE identifier (e.g., CWE-79 for XSS), OWASP mapping (e.g., A7 for Cross-Site Scripting), and formalized object/data properties that encode attack method, vector, affected technology, and quality attribute impact (Ezenwoye et al., 2022).

Formally, the ontology is made explicit with Description Logic (DL) axioms. For example, XSS is defined as: $$\mathit{XSS} \;\equiv\; \mathit{Weakness} \;\sqcap\; \exists\,\mathit{hasCWEID}.\{\text{"CWE-79"}\} \;\sqcap\; \exists\,\mathit{hasOWASPCategory}.\{\mathit{A7\_XSS}\} \;\sqcap\; \exists\,\mathit{hasAttackMethod}.\mathit{Injection} \;\sqcap\; \exists\,\mathit{hasAttackVector}.\mathit{FormData} \;\sqcap\; \exists\,\mathit{affectsTechnology}.\mathit{JavaScript} \;\sqcap\; \exists\,\mathit{impactsQualityAttribute}.\mathit{Confidentiality}$$

All top-level “attribute” classes (AttackMethod, AttackVector, Technology, QualityAttribute) are defined as pairwise disjoint, with Weakness required to have at least one linkage in each attribute dimension (Ezenwoye et al., 2022).

2. Taxonomy Construction and CWE/OWASP Mapping Methodology

Taxonomy construction proceeds via manual curation, with initial categories sourced from industry-recognized lists such as the OWASP Top 10 and the CWE/SANS Top 25. The cross-mapping methodology, presented by Li (Li, 2020), involves reviewing each CWE/SANS entry to align it with the OWASP risk category most representative of the described weakness. This yields a co-occurrence matrix facilitating one-to-many relationships, e.g., the OWASP “Injection” category maps to CWE-78 (OS Command Injection), CWE-89 (SQL Injection), and CWE-94 (Code Injection).

The mapping is anchored in the semantic definitions provided by each framework: OWASP categories define vulnerability classes in terms of attacker leverage and system impact, while CWE entries enumerate low-level implementation errors. This approach enables direct aggregation of static analysis findings, as demonstrated with Checkmarx queries, which can be correctly triaged and remediated according to their mapped position in the taxonomy.

OWASP Category	CWE/SANS Top 25 Mappings
Injection	CWE-78, CWE-89, CWE-94
Broken Authentication	CWE-306, CWE-307, CWE-798
Sensitive Data Exposure	CWE-311, CWE-319
Broken Access Control	CWE-807, CWE-862, CWE-863
Security Misconfiguration	CWE-250, CWE-285, CWE-73
Cross-Site Scripting (XSS)	CWE-79, CWE-676, CWE-732
Insecure Deserialization	CWE-134, CWE-190, CWE-327
Using Components w/ Known Vulns	CWE-759

This methodology is qualitative for mapping, but OWASP’s official risk model introduces a quantitative scoring: $$L = \frac{P + D + E}{3}, \quad \mathit{R} = L \times I$$ where $P$ is Prevalence, $D$ is Detectability, $E$ is Exploitability, and $I$ is Impact, each scored 1–3 (Li, 2020).

3. Ontology Classes, Properties, and Constraints

The Ezenwoye & Liu ontology explicitly identifies the following classes (Ezenwoye et al., 2022):

• Weakness (abstract): XSS, SQLInjection, ExposureOfSensitiveInfo, CSRF, ImproperAccessControl, ImproperAuthentication, ImproperInputValidation, PathTraversal, BufferOverflow, CodeInjection, UnrestrictedFileUpload
• AttackMethod (abstract): Injection, Inspection, Interception
• AttackVector (abstract): Script (FormData, FileData, SourceCode, CookieData), Messaging (E-mailMessage, HTTPRequest, STUNRequest, DNSRequest, AJAXRequest, RPCRequest)
• Technology (abstract): LanguageFramework, Protocol, DataFormat, ConfigTemplate, Multimedia
• QualityAttribute (abstract): Confidentiality, Integrity, Availability, Reliability, Maintainability

Each Weakness must be linked to:

• at least one AttackMethod, AttackVector, Technology, and QualityAttribute,
• a concrete CWE identifier (e.g., “CWE-89”),
• and, when available, a mapped OWASP category (e.g., “A1_Injection”).

The ontology model ensures formal reasoning, supporting queries such as: retrieve all weaknesses with hasAttackMethod = Injection, hasAttackVector = HTTPRequest, and affectsTechnology = PHP.

4. Extensions: Multi-Agentic Systems and Emergent Threats

Reinforcing the extensibility of an OWASP/CWE-rooted taxonomy, Bains et al. introduce a dedicated multi-agent security taxonomy. This structure incorporates not only classical OWASP attack patterns but also emergent, LLM-centered MAS threats (Krawiecka et al., 13 Aug 2025). The taxonomy introduces seven categories encompassing planning failures, delegation/privilege abuses, evaluation attacks, covert coordination, context corruption, backdoors/insiders, and supply-chain social engineering, each mapped to new or extended OWASP-MAS and CWE identifiers.

Selected categories:

Threat Class	OWASP-MAS	CWE Mapping
Reasoning Collapse	A01	CWE-MAS-001
Benign Goal Drift	A01.2	CWE-MAS-002
Unsafe Delegation Escalation	B02	CWE-269
Emergent Covert Coordination	D01	CWE-MAS-009
Multi-Agent Backdoors	F01	CWE-MAS-014
Supply-Chain Social Eng.	G01	CWE-502,154

Each threat is rigorously defined by its attack vector, risk, and suggested evaluation strategies—for example, emergence monitoring for reasoning collapse, and cross-policy stress-testing for heterogeneous collusion.

5. Practical Application: Tool Integration and Remediation Guidance

An OWASP/CWE-rooted taxonomy is directly useful for automated static analysis and incident response workflows. Li demonstrates the operational pipeline: (i) static application security testing (via Checkmarx) generates findings, (ii) each finding is mapped to its place in the taxonomy using the OWASP–CWE matrix, (iii) appropriate remediation patterns are selected according to the mapped category, resulting in significant reduction of false positives and focused developer effort (Li, 2020).

Efficient triage is realized when out-of-scope findings (e.g., third-party library vulnerabilities) are filtered via the taxonomy, yielding improved scan performance and concentrated remediation on internal, high-priority weaknesses. The utility of formalizing technology, attack vector, and quality attribute also supports granular analysis across heterogeneous codebases (Ezenwoye et al., 2022).

6. Evaluation Strategies and Coverage Mapping

For taxonomy-driven security validation, recent frameworks prescribe aligning assessment strategies with taxonomy dimensions. For multi-agent systems, Bains et al. provide an explicit evaluation matrix mapping robustness testing, coordination assessment, safety enforcement, and emergent behavior monitoring to specific threat categories (Krawiecka et al., 13 Aug 2025). This integration strengthens risk-management workflows and ensures that novel or systemically distributed threats are not neglected in security assurance.

Threat Category	Robustness	Coordination	Safety	Emergent Monitoring
Logic & Planning (A)	✔️		✔️	✔️
Delegation & Privilege (B)	✔️	✔️	✔️
Evaluation & Feedback (C)	✔️		✔️
Covert Coordination (D)		✔️		✔️
Context/Communication Corruption (E)	✔️	✔️		✔️
Backdoors & Insider (F)	✔️	✔️	✔️	✔️
Supply-Chain (G)	✔️		✔️

This formal mapping enables security teams to tailor mitigation and validation to the specific landscape of threats in both web and agentic domains.

7. Significance and Implications

An OWASP/CWE-rooted taxonomy underpins principled software security analysis by unifying surface-level vulnerability classification (OWASP) with the granularity of code-centric weaknesses (CWE). Its ontological construction supports direct reasoning, advanced query capabilities, integration with industry scanners, and extensibility to emergent domains such as LLM-driven multi-agent threats. Practical implementations demonstrate reduction in triage time, filter efficacy on high-volume findings, and systematic remediation pathway discovery (Ezenwoye et al., 2022, Li, 2020, Krawiecka et al., 13 Aug 2025).

A plausible implication is that such taxonomies act as a foundation for automated, scalable, and explainable security assurance across rapidly evolving software and agentic environments. This structure is now not just limited to classic web and mobile paradigms, but is extensible to AI-native, adversarial, and context-shifting operational landscapes.