# A Comprehensive Review and Assessment of Cybersecurity Vulnerability Detection Methodologies
## 4 Taxonomy of Vulnerability Detection Approaches and Findings Analysis
### Matching-Based Approach
#### 4.1.1 Matching-Based Approach Methods Description  
Method Based on RE  
The author presented a method related to vulnerability detection techniques based on file logs rather than active mode, which involves intensive system scanning and missing inactive services [46]. Based on collecting and normalizing system logs, Passive Vulnerability Detection (PVD) uses Regular Expression (RE) to parse and normalize existing information (Unix/syslog, DPKG logs, Windows event data, web server logs, proxies, gateways, etc.). Next, it looks for potential vulnerabilities based on CPE (vendor, name, and version). On the other hand, VDBs (such as HPI-VDB, OSVDB, NVD, etc.) publish recent vulnerabilities with their other metadata, aiding PVD in matching CPE IDs (products and VDBs) to discover the concerning products by any CVE ID. Figure 13: Taxonomy of vulnerability detection. Another contribution proposed a new technique to detect vulnerabilities within an information system [9]. This work tries to overcome four main issues that make it difficult for a VMS to discover relevant vulnerabilities: (1) lack of synchronization between CPE dictionary and CVE feeds; (2) CVE entries without CPE metadata in VDBs; (3) missing CPE identifiers for certain software products; and (4) deprecation and typographical errors that generate mismatches and a high rate of false positives and negatives. Based on the Well-Formed Name (WFN) of CPE, the exposed method englobes three steps: (S1) CPE matching, which finds the correct CPE for a software product from a CPE dictionary using the Levenshtein distance algorithm, is less or equal to two. Then, (S2) CPE assignment, which is based on human interaction, proposes candidates CPE to select the most similar CPE to the software target, as shown below in Equation (1). Finally, (S3) CVE matching uses the Levenshtein distance algorithm to compare CPE products and CPE/CVE (dictionary and summary description) to find relevant CVEs for a software product. (CPE.WFN.VENDOR = VENDOR SEARCH TERM) AND (CPE.WFN.PRODUCT = PRODUCT SEARCH TERM). Method Based on Building CPE  
The authors presented another study to automatically generate the correct CPE device by combining the CPE tree generation process and banner text keyword analysis [47]. Subsequently, the generated CPE is then used to identify relevant vulnerabilities from NVD. The method consists first of extracting device information by using specific scanning tools (Nmap and Shodan). Next, based on the tree CPE extracted from the CPE dictionary, it builds the correct CPE for the target device. Finally, it matches device information with CVE feeds. It is worth noting that the study's comparison technique lacked a clear description. A new method introduced a mechanism based on analyzing vulnerability descriptions at the time of disclosure. This method addresses the problem of sparse or inaccurate metadata at the first appearance of a vulnerability [48]. They use a technique based on TF-IDF weighting of keywords (Term Frequency-Inverse Document Frequency), as shown in Equation (2), to automatically extract relevant keywords from the unstructured, human-readable descriptions, and output the most likely affected software. To increase the relevance of the extracted keywords, additional domain-specific heuristics are used, such  
Figure 14: Features of similarity matching-based approach. as handling multi-word keywords, capitalized terms, and words starting with \"lib-.\" Thus, the evaluation is showing a promising result in general. \[\text{TFIDF (t,f,D)}=\text{TF (t,d)}*\text{IDF (t,D)} \tag{2}\]  
where \"t\" is a word and \"d\" is a document belonging to a corpus of documents \"D\". Method Based on Binary X-ray  
Another contribution proposed a novel solution called BinXray. The principal goal of the method is to differentiate a patched function from a vulnerable program by identifying the integrated patch [49].