# A Comprehensive Review and Assessment of Cybersecurity Vulnerability Detection Methodologies
## 4 Taxonomy of Vulnerability Detection Approaches and Findings Analysis
### Matching-Based Approach
#### 4.1.1 Matching-Based Approach Methods Description
To accurately identify 1-day vulnerabilities, BinXray uses the three inputs (see Table 3) to match the target function (TF) and vulnerable function (VF) based on syntactic and structural information. Then, the method extracts the patch signature by computing differences between VF and PF at the basic block level. Next, after generation traces from TF, VF, and PF, BinXray computes the similarity between traces and ascertains if TF is more similar to VF or PF. Globally, the results pinpoint a high accuracy rate of 93.31%. The authors highlighted a method based on a string similarity algorithm to map software product names from system logs to product names in VDBs [5]. The proposed techniques involve gathering software product names from several target systems using the Winapps Python library. Then, these software names are mapped to the CPE entries of VDBs using the Ratcliff/Obershelp algorithm. Next, potential vulnerabilities are found in the NVD database based on the associated CPE. Finally, CVSS scores are attributed to the detected vulnerabilities based on published metadata. We note that the proposed technique and tool demonstrated an average accuracy of 79%. Method Based on CTPH  
A new study proposed a method for VULnerability DEtection method based on Function Fingerprints and code differences (VULDEFF) to detect vulnerabilities in software source code by detecting the differences between patched and unpatched software [50]. VULDEFF consists of three modules: (i) data preprocessing, responsible for the collection and processing of vulnerability patches and source code into a dataset. Then, (ii) generating function fingerprints using the Context Triggered Piecewise Hashing (CTPH) algorithm and CRC32 checksums [51]. In the last module, (iii) VULDEFF integrates fuzzy matching (size, character repeat, longest common substring, weighted edit distance and scale edit distance) to compare the syntactic structure of vulnerable function (VF) and target function (TF) to identify potentially vulnerable cloned code. This method revealed that there is a lack of published CPEs for every vulnerability library integrated into VDBs, such as NVD [52]. The majority of the affected products, according to the author, are released in an unstructured manner, which complicates automated analysis. To overcome the previous issues, the study proposes to automate the construction of CPEs for vulnerable products listed in non-NVD security advisories. To this end, the main focus consists of performing a string-matching similarity between unstructured vendor names and structured vendor names in the CPE dictionary. The author evaluates five string similarity metrics (Levenshtein, Discounted Levenshtein, Jaro, Jaro-Winkler, and Ratcliff/Obershelp). Next, this study suggests an alternative Jaro-Winkler algorithm that modifies the weight of each token in the advisory's vendor name based on its frequency in a specialized corpus. By building accurate CPEs of software libraries, the process of detecting vulnerabilities will depend on published security events in VDBs. Although the result is promising, some limits are still raised. Method Based on GPT  
A recent study presented a reflection on the ability of four GPT languages, such as GPT-3, GPT-3.5/ChatGPT, GPT-4, and Bing Chat-Bot, to accurately answer key VMS-related questions, such as the CVSS of detected vulnerabilities, their vectors, how to mitigate them, the affected products, and information about mitigation and exploit [53]. To this end, the author performed an empirical study on retrieving CVSS scores and vector and CPE information by using GPT models. The result is shown to be incomplete and inaccurate and is revealed to be different from NVD data. The study also found significant limitations in the models' ability to gather information about mitigation and exploits, especially for complex data. However, LLMs showed high accuracy and low hallucination rates when summarizing vulnerability information from the full text of advisories.