Zhenpeng Shi, Nikolay Matyunin, Kalman Graffi, David Starobinski, "Uncovering CWE-CVE-CPE Relations with Threat Knowledge Graphs", ACM Transactions on Privacy and Security (TOPS), 2024.

Security assessment relies on public information on products, vulnerabilities and weaknesses. So far, databases in these categories have rarely been analyzed in combination. Yet, doing so could help predict unreported vulnerabilities and identify common threat patterns. In this paper, we propose a methodology for producing and optimizing a knowledge graph that aggregates knowledge from common threat databases (CPE, CVE, and CWE). We apply the threat knowledge graph to predict associations between threat databases, specifically between products, vulnerabilities, and weaknesses. We evaluate the prediction performance both in closed world with associations from the knowledge graph, and in open world with associations revealed afterward. Using standard rank-based metrics (i.e., Mean Rank, Mean Reciprocal Rank, and Hits@N scores), we demonstrate the ability of the threat knowledge graph to uncover many associations that are currently unknown but will be revealed in the future, which is consistent over time. We also investigate approaches to further optimize the knowledge graph, and show that they indeed help uncover more associations.