TY - GEN
T1 - Connecting the Dots
T2 - 26th IEEE International Conference on Information Reuse and Integration and Data Science, IRI 2025
AU - Boles, Brittany
AU - Izurieta, Clemente
AU - Reinhold, Ann Marie
N1 - Publisher Copyright:
© 2025 IEEE.
PY - 2025
Y1 - 2025
N2 - Vulnerability databases are essential to cybersecurity, providing developers with critical information about software security flaws. However, inconsistencies among vulnerability databases pose challenges for integration. To address this, we created a graph database that consolidates data from the National Vulnerability Database (NVD), GitHub Advisories, the Open Source Vulnerability (OSV) database, the Exploit Prediction Scoring System (EPSS), and the CWE-1000 View. Our graph database revealed inconsistent vulnerability severity vectors across the databases. To illustrate the utility of our graph database, we investigated how the databases reported the "top ten"most routinely exploited vulnerabilities. Our analysis revealed differences in vulnerability identifiers, and the Common Weakness Enumeration (CWE) mappings of the top ten vulnerabilities. By aggregating vulnerability information from disparate sources, this graph database supports cross-validation, increases transparency, and enables efficient complex queries.
AB - Vulnerability databases are essential to cybersecurity, providing developers with critical information about software security flaws. However, inconsistencies among vulnerability databases pose challenges for integration. To address this, we created a graph database that consolidates data from the National Vulnerability Database (NVD), GitHub Advisories, the Open Source Vulnerability (OSV) database, the Exploit Prediction Scoring System (EPSS), and the CWE-1000 View. Our graph database revealed inconsistent vulnerability severity vectors across the databases. To illustrate the utility of our graph database, we investigated how the databases reported the "top ten"most routinely exploited vulnerabilities. Our analysis revealed differences in vulnerability identifiers, and the Common Weakness Enumeration (CWE) mappings of the top ten vulnerabilities. By aggregating vulnerability information from disparate sources, this graph database supports cross-validation, increases transparency, and enables efficient complex queries.
KW - Common Weakness Enumeration
KW - Exploit Prediction Scoring System
KW - Vulnerability graph database
UR - https://www.scopus.com/pages/publications/105017847977
U2 - 10.1109/IRI66576.2025.00050
DO - 10.1109/IRI66576.2025.00050
M3 - Conference contribution
AN - SCOPUS:105017847977
T3 - Proceedings - 2025 IEEE International Conference on Information Reuse and Integration and Data Science, IRI 2025
SP - 228
EP - 233
BT - Proceedings - 2025 IEEE International Conference on Information Reuse and Integration and Data Science, IRI 2025
PB - Institute of Electrical and Electronics Engineers Inc.
Y2 - 6 August 2025 through 8 August 2025
ER -