Skip to main navigation Skip to search Skip to main content

Connecting the Dots: An Integrated Vulnerability Knowledge Graph for Security Practitioners

  • Brittany Boles
  • , Clemente Izurieta
  • , Ann Marie Reinhold

Research output: Chapter in Book/Report/Conference proceedingConference contributionpeer-review

Abstract

Vulnerability databases are essential to cybersecurity, providing developers with critical information about software security flaws. However, inconsistencies among vulnerability databases pose challenges for integration. To address this, we created a graph database that consolidates data from the National Vulnerability Database (NVD), GitHub Advisories, the Open Source Vulnerability (OSV) database, the Exploit Prediction Scoring System (EPSS), and the CWE-1000 View. Our graph database revealed inconsistent vulnerability severity vectors across the databases. To illustrate the utility of our graph database, we investigated how the databases reported the "top ten"most routinely exploited vulnerabilities. Our analysis revealed differences in vulnerability identifiers, and the Common Weakness Enumeration (CWE) mappings of the top ten vulnerabilities. By aggregating vulnerability information from disparate sources, this graph database supports cross-validation, increases transparency, and enables efficient complex queries.

Original languageEnglish
Title of host publicationProceedings - 2025 IEEE International Conference on Information Reuse and Integration and Data Science, IRI 2025
PublisherInstitute of Electrical and Electronics Engineers Inc.
Pages228-233
Number of pages6
ISBN (Electronic)9798331599447
DOIs
StatePublished - 2025
Event26th IEEE International Conference on Information Reuse and Integration and Data Science, IRI 2025 - San Jose, United States
Duration: Aug 6 2025Aug 8 2025

Publication series

NameProceedings - 2025 IEEE International Conference on Information Reuse and Integration and Data Science, IRI 2025

Conference

Conference26th IEEE International Conference on Information Reuse and Integration and Data Science, IRI 2025
Country/TerritoryUnited States
CitySan Jose
Period08/6/2508/8/25

Keywords

  • Common Weakness Enumeration
  • Exploit Prediction Scoring System
  • Vulnerability graph database

INL Publication Number

  • NA

Fingerprint

Dive into the research topics of 'Connecting the Dots: An Integrated Vulnerability Knowledge Graph for Security Practitioners'. Together they form a unique fingerprint.

Cite this