VulnScopper: Unveiling Hidden Links Between Unseen Security Entities

The Common Vulnerabilities and Exposures (CVE) system is crucial for cybersecurity, providing standardized identification of vulnerabilities. In February 2024, the National Vulnerability Database (NVD) announced it could no longer enrich new CVEs due to increasing volumes, significantly impacting global security efforts. This paper introduces VulnScopper, an innovative approach to automate and enhance vulnerability enrichment using Graph Neural Networks (GNNs). VulnScopper combines Knowledge Graphs (KG) with Natural Language Processing (NLP) by leveraging ULTRA, a GNN-based knowledge graph foundation model, alongside a Large Language Model (LLM). VulnScopper’s inductive approach enables it to handle unseen entities, overcoming a crucial limitation of previous CVE enrichment methods. We evaluate VulnScopper on the NVD dataset in inductive and transductive setups for CVE to Common Platform Enumerations (CPE) linking. Our results show that VulnScopper outperforms state-of-the-art techniques, achieving up to 60% Hits@10 accuracy in linking CVEs to CPE on unseen CVE records. We demonstrate VulnScopper’s effectiveness on unseen 2023 CVEs, showcasing its ability to uncover new vulnerable products and potentially reduce vulnerability remediation time.