# A Comprehensive Review and Assessment of Cybersecurity Vulnerability Detection Methodologies
Furthermore, the VMS has to be linked to Vulnerability Databases (VDBs) so that it may be fed with the most recent vulnerabilities and complementary metadata. This step remains so crucial in determining a system for patching priority process. In this field, the handling of vulnerability activities and system configuration is a complex process that involve two essential features: CVE (Common Vulnerability and Exposures) feeds and CPE (Common Platform Enumeration). CVE is a part of the SCAP specification [7]; it represents a method for assigning identifiers to the publicly known vulnerabilities and providing information about the vulnerabilities, whereas CPE specifies a naming scheme for applications, hardware devices, and operating systems [8]. In this context, fully automated vulnerability analysis refers to the capability of VMS to assign a CPE identifier to a configuration product and extracted information (CPE entries) from multiple open VDBs (CVE feeds) in order to perform a series of scans related to potential vulnerabilities without human interaction. Unfortunately, this operation follow a complex procedure which outputs globally a significant rate of false positives or negatives and is qualified as impractical and error-prone [9]. Actually, the wide range of configuration systems increases the workload of security analysts, making it both time-consuming and error-prone when handled manually. The aforementioned difficulties in this context refer to CVE feeds without CPE entries, software products without assigned CPE, the CPE dictionary deprecation issues, or VDBs synchronization between the CPE dictionary and CVE feeds [5, 10]. Another issue is the inconsistency challenge of program names across multiple VDBs [11]. It is worth noting that a fully automated CPE assignment is prone to errors owing to CPE and CVE shortcomings (inconsistencies in VDBs and software naming specification difficulties). As a result, the mismatching and inconsistencies might have serious consequences related to dissemination of inaccurate vulnerability information. In this study, we attempt to highlight the existing methods incorporated by various VMSs that enable the matching process between the asset mapping of an Information System (IS) and multiple VDBs since 2016. We also examine the methodology of each approach and provide suggestions for future work. The main contributions of this paper are summarized as follows:  
* Conduct a security vulnerability database study to assess data inconsistency and identify issues;
* Classify and analyze vulnerability detection methods according to multiple approaches;
* Provide details of presentation and comprehensive analysis of the drawbacks and limitations of existing vulnerability detection methods in each approach;
* Categorize existing vulnerability detection methods by approaches based on related papers. The aforementioned contributions will be guided by the following research questions:  
1. What are the main methods used in vulnerability detection? 2. How do these methods accomplish their goals and what are their limits? 3. Is it feasible to combine multiple methods simultaneously to reduce the rate of false positives and negatives in the vulnerability detection process? In this sense, our paper is organized as follows; in Section 2, we present the research methodology. Then, we discuss the motivation and background in Section 3. After that, Section 4 describes the extent of related studies, including further detail on the existing main approaches related to the vulnerability detection field. Section 5 highlights challenges and potential solutions for vulnerability detection methods. Finally, Section 6 concludes with findings and discusses future research.