# A Comprehensive Review and Assessment of Cybersecurity Vulnerability Detection Methodologies
## 3 Motivation, Background, and VDB Assessment
### Terminologies and Theoretical Foundations
#### 3.2.2 Cyber Concepts  
We have focused on the key components of the following cyber concepts to help readers understand the content of this paper. Cyberattack: Malicious activity aimed at collecting, disrupting, denying, degrading, or destroying information system resources or the information itself [18]. Cyber resilience: The ability to continuously deliver the intended outcome despite adverse cyber events, encompassing the identification, evaluation, treatment, and reporting of system and software vulnerabilities [20]. Cyber threat: Any circumstance or event that has the potential to harm organizational operations, assets, individuals, other organizations, or the nation by gaining unauthorized access, causing destruction, disclosure, modification of information, and/or denial of service [28]. Vulnerability Management System (VMS): It represents a capability that identifies CVEs present on devices that attackers may exploit to compromise them, thereby using them as platforms to further compromise other segments of the network [29]. VMSs incorporate multiple hybrid systems to detect potential cyber risk presence across diverse ecosystems and assess their cyber state. As shown in Figure 5, the implementation of VMS in different ecosystems (IoT, IT, cloud-based systems, ICS, and others) depends on the quality and quantity of the data gathered from multiple vulnerability databases (VDBs) and the capability to collect information through scanning operations about products affected by known vulnerabilities. In this context, the primary function of the VMS is to perform a logical mapping between CPE/VDBs and product ID, ensuring accurate results while reducing the occurrence of false positives and false negatives [6]. Figure 4: Risk management process [15]. Figure 3: Interaction between information security cyber items. Common Platform Enumeration (CPE): It represents a structured naming scheme for information technology systems, software, and packages. Based on the generic syntax for Uniform Resource Identifiers (URI), CPE includes a formal naming format, a method for checking names against a system, and a description format for binding text to a name. The CPE dictionary is provided by NIST and is available to the public [30]. The CPE standard was developed to unify product naming; the current version of CPE is 2.3, which is detailed in three representations in Table 1.  
A well-formed CPE name (WFN), an abstract logical construction, refers to this CPE naming method. The CPE naming specification defines procedures for binding WFNs to machine-readable encodings and for reversing these encodings back to WFNs [31]. The CPE standard defines eleven attributes in WFN format. Part (1) may contain \"a\" for applications, \"o\" for operating systems, or \"h\" for hardware devices. The vendor (2) identifies an individual or an organization responsible for producing or developing the item. The official product name is identified by part (3). Version (4), update (5), and sw_edition (6) specify version and update details, with edition (7) typically set to ANY unless backward compatibility requires a specific value related to the product. The user interface language (8) tag follows the RFC 5646 definition [32], while target_sw (9) denotes the product's operating environment. Target_hw (10) specifies the hardware architecture. Finally, other (11) provides additional information supporting specifications referenced in [8, 33]. The public can gain access to CPE information using the NIST API, as shown below in Figures 6-10, which ensures data accuracy, reliability, and accessibility. Figure 6 above presents an example extract from a query. The NIST API is used to preserve and make the CPE data available. CPE can be extracted from CVE/metadata and the NIST/dictionary, as shown below in Figure 11. Figures 9-12 illustrate the annual collection of CPE via Python scripts from 2016 to 2024, highlighting partitions for hardware (h), operating systems (o), and applications (a).