Identification of Abstraction Levels
The CWE team labeled each weakness according to different levels of abstraction: Class, Base, and Variant. These levels have not been formally defined, so there are some inconsistencies in the definitions. In general, however, a Class describes a weakness in a very abstract fashion, typically independent of any specific language or technology. At the lowest level, a Variant describes a weakness at a very low level of detail, typically limited to a specific language, technology, programming idiom, or resource type. Between the Class and Variant levels, the Base describes a weakness in an abstract fashion, but with sufficient details that the reader could infer specific methods for detection and prevention based solely on the description.
For CWE-1000 (Research View), the team then identified and resolved logical inconsistencies in weakness relationships, such as a Variant that was a parent of a Class, or a Base that had no Class parents. This focused efforts in undeveloped areas of the hierarchy.
Performing Abstraction