# A Comprehensive Review and Assessment of Cybersecurity Vulnerability Detection Methodologies
## 6 Discussion and Synthesis
\begin{table}
\begin{tabular}{c c} \hline \hline
**Vulnerability** & \\
**Detection** & **Summary of Limits and Drawbacks Related to the Four Aforementioned Approaches.** \\ \hline  & - & VDBs, which store and publish all multiform security events, contain multiple issues related to inconsistent software products, missing metadata, especially CPE, lack of synchronization between CPE dictionary and CPE/CVE; \\  & - & String-similarity algorithms generate errors during the process matching, which increases false positives and negatives; \\ A matching-based approach & - & Assets inventory do not incorporate a complete CPE list product; \\  & - & Configuration variability and instable product naming over the time impact the accuracy of results; \\  & - & Vulnerability zero day is still a rising crucial issue; \\  & - & Difficulty to perform a similarity matching between product having the same semantic and different syntax; \\  & - & The string-matching process is labor-intensive and significantly computational; \\  & - & Inaccurate results when using GPT models. \\ \hline  & - & Building an accurate graph to represent all slices of source code represents a challenge, specifically in a large complex ecosystem; \\  & - & Both the quality of data for the training model and building graph is so important to avoid errors and under-exploitation; \\  & - & Certain techniques center their study on identifying weaknesses in a particular programming language; \\ A & - & The graph-based approach could include an excessive amount of duplicate data unrelated \\ graph-based approach & - & The graph-based approach, which seeks to improve the brute-force method, is resource-intensive and has to be optimized in order to perform better; \\  & - & Some techniques do not employ steps to isolate the compromised network segment in order to prevent the spread of threats; \\  & - & The white-box analysis makes it more difficult to produce a precise model representation, particularly in ICS. \\ \hline  & - & Mapping cartography or assets discovered as a feature model input is labor-intensive and prone to errors; \\ A feature model-based approach & - & Errors occur during generating global FM when assessing huge system configurations, extreme complexity \\  & - & and variability of system components; \\  & - & The relevancy of security events released by VDBs is essential to FM’s accuracy; \\  & - & The accuracy of the FMs may be impacted by discrepancies and a lack of pertinent data; \\  & - & To keep the FM up to date, maintainability and real-time upgrades are necessary; \\  & - & Human intervention is necessary for asset scanning, process analysis, FM update, and results exploitation. \\ \hline  & - & The quality of the datasets continues to be a factor in how well AI models operate; \\  & - & There are challenges with the training process as it is time-consuming and labor-intensive; \\  & - & Choosing the appropriate model for the context’s method still poses a challenge in order to lower the rate of false positives and negatives; \\ An & - & Research elucidating the cause of false positives and negative outcomes is lacking; \\ Al-based approach & - & Incorrect predictions occur when some models deal with lexical features; \\  & - & The discrepancies and inconsistencies of published VDBs have an effect on the dataset quality; \\  & - & Using Large Language Models (LLMs) to accurately identify software vulnerabilities without generating false positives is still challenging; \\  & - & Not all the vulnerabilities can be discovered by employing the methods that have been suggested. \\ \hline \hline \end{tabular}
\end{table} 
Table 8: Summary of observed limits related to four studied approaches. Regarding the similarity matching approach, we examined multiple methods from 2016 to 2024, as demonstrated in Section 4. This approach integrates several string-matching algorithms. They evaluate the similarity between the asset source (CPE) and target (CPE dictionary or CVE/CPE) to identify potential vulnerabilities.