Daniel Alfasi

The proliferation of software vulnerabilities poses a significant challenge for security databases and analysts tasked with their timely identification, classification, and remediation. With the National Vulnerability Database (NVD) reporting an ever-increasing number of vulnerabilities, the traditional manual analysis becomes untenably time-consuming and prone to errors. This paper introduces \VulnScopper, an innovative approach that utilizes multi-modal representation learning, combining Knowledge Graphs (KG) and Natural Language Processing (NLP), to automate and enhance the analysis of software vulnerabilities. Leveraging ULTRA, a knowledge graph foundation model, combined with a Large Language Model (LLM),  VulnScopper effectively handles unseen entities, overcoming the limitations of previous KG approaches.

We evaluate VulnScopper on two major security datasets, the NVD and the Red Hat CVE database. Our method significantly improves the link prediction accuracy between Common Vulnerabilities and Exposures (CVEs), Common Weakness Enumeration (CWEs), and Common Platform Enumerations (CPEs). Our results show that VulnScopper outperforms existing methods, achieving up to 78% Hits@10 accuracy in linking CVEs to CPEs and CWEs and presenting an 11.7% improvement over large language models in predicting CWE labels based on the Red Hat database.
Based on the NVD, only 6.37% of the linked CPEs are being published during the first 30 days; many of them are related to critical and high-risk vulnerabilities which, according to multiple compliance frameworks (such as CISA and PCI), should be remediated within 15-30 days. We provide an analysis of several CVEs published during 2023, showcasing the ability of our model to uncover new products previously unlinked to vulnerabilities. As such, our approach dramatically reduces the vulnerability remediation time and improves the vulnerability management process.

The Common Vulnerabilities and Exposures (CVE) system is crucial
for cybersecurity, providing standardized identification of vulnerabilities. In February 2024, the National Vulnerability Database
(NVD) announced it could no longer enrich new CVEs due to increasing volumes, significantly impacting global security efforts.
This paper introduces VulnScopper, an innovative approach to
automate and enhance vulnerability enrichment using Graph Neural Networks (GNNs). VulnScopper combines Knowledge Graphs
(KG) with Natural Language Processing (NLP) by leveraging ULTRA, a GNN-based knowledge graph foundation model, alongside
a Large Language Model (LLM). VulnScopper’s inductive approach
enables it to handle unseen entities, overcoming a crucial limitation
of previous CVE enrichment methods.
We evaluate VulnScopper on the NVD dataset in inductive and transductive setups for CVE to Common Platform Enumerations
(CPE) linking. Our results show that VulnScopper outperforms state-of-the-art techniques, achieving up to 60% Hits@10 accuracy
in linking CVEs to CPE on unseen CVE records. We demonstrate VulnScopper’s effectiveness on unseen 2023 CVEs, showcasing its
ability to uncover new vulnerable products and potentially reduce
vulnerability remediation time.

With the continuous increase in reported Common Vulnerabilities and Exposures (CVEs), security teams are overwhelmed by vast amounts of data, which are often analyzed manually, leading to a slow and inefficient process. To address cybersecurity threats effectively, it is essential to establish connections across multiple security entity databases, including CVEs, Common Weakness Enumeration (CWEs), and Common Attack Pattern Enumeration and Classification (CAPECs). In this study, we introduce a new approach that leverages the RotatE [4] knowledge graph embedding model, initialized with embeddings from Ada language model developed by OpenAI [3]. Additionally, we extend this approach by initializing the embeddings for the relations.