# A Comprehensive Review and Assessment of Cybersecurity Vulnerability Detection Methodologies
## 3 Motivation, Background, and VDB Assessment
### Terminologies and Theoretical Foundations
#### 3.2.2 Cyber Concepts
\begin{table}
\begin{tabular}{c c c} \hline \hline
**Format** & **Description** & **Representation** \\ \hline \multirow{2}{*}{WFN} & Well-Format Name & CPE = {(part, v1), \(\langle\)vendor, v2\(\rangle\), \(\langle\)product, v3\(\rangle\)...., \(\langle\)other, vn\(\rangle\)} \\  & & wfn:[part = “a”,vendor = “microsoft”, product = “internet_explorer”, version = “8\(\backslash\)0\(\backslash\)6001”, \\  & & update = “beta”] \\ \hline \multirow{2}{*}{URI} & Uniform Resource Identifiers & CPE = cpe:/{part}:{vendor}:{product}:{version}:{update}:{definition}:{language}. \\  & & cpe:/a:microsoftinternet_explorer:8.0.6001:beta \\ \hline \multirow{2}{*}{FSB} & Format String Binding & cpe:2.3:part:vendor:product:version:update:neighbourage:sw_edition:target_sw:target_hw:other \\  & & cpe:2.3:a:microsoft:internet_explorer:8.0.6001:beta:*,*,*,*,*,* \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Diverse representations of CPE. Figure 5: VMS concept. Figure 8: Total of CVE numbers published per year by NVD. Figure 6: CPE extracted from NVD/NIST API related to “3 com” vendor. Figure 7: Total of CVE values published by NVD with and without the CPE value. Figure 11: Comparison between CPEs extracted from NVD. Figure 10: Distribution of CPEs extracted from NVD/CVE API by partition. Figure 9: Distribution of CPEs number extracted from NVD/CPE DICT by partition. Common Vulnerability and Exposure (CVE): It is a program maintained by the MITRE Corporation [34] and sponsored by the U.S. Department of Homeland Security (DHS) and the Cybersecurity and Infrastructure Security Agency (CISA) [35]. It focuses on representing a nomenclature and dictionary of security-related product flaws. Every CVE ID is assigned to the respective product by authorized organizations known as CVE Numbering Authorities (CNAs). The National Vulnerability Database (NVD) manages the analysis process for each CVE ID, incorporating reference tags, the Common Vulnerability Scoring System (CVSS), the Common Weakness Enumeration (CWE), and CPE Applicability Statements [36]. It is worth noting that the number of CVEs published by the NVD increases annually. Figures 9-12 provide statistics on supplemental CPE information between 2016 and 2024. This highlights a notable discrepancy between CPEs released with CVE/metadata and those listed in the dictionary. Additionally, it is important to recognize that not all CPEs affected by disclosed vulnerabilities are covered in every CVE entry. Common Weaknesses Enumeration (CWE): It can be understood as a state within a hardware, software, firmware, or service component that, under specific conditions, can lead to vulnerabilities. CWE incorporates a taxonomy to identify common sources of weaknesses [37]. Scoring system: Each year sees an increase in the number of published vulnerabilities, with a notable peak in 2021, as illustrated in Figure 7, while their severity remains influenced by various factors. In this context, employing a scoring system becomes essential to classify complexity and prioritize assessment processes. In our literature review, we identified four distinct scoring systems. The Common Vulnerability Scoring System (CVSS) is the first method used to address the vulnerability impact using qualitative representation (low, medium, high, and critical) and quantitative measures of severity (a scale from 0 to 10). The last version, CVSS V4.0, was released in November 2023. It adds more information, including significant changes from the previous versions of CVSS V3.x and V2.x, additional scoring guidance, and scoring rubrics [38]. The second system is the Vulnerability Rating and Scoring System (VRSS) [39], which bases its final score on CVSS V2, providing both qualitative ratings and quantitative scores for vulnerabilities. The third system is called the Weighted Impact Vulnerability Scoring System (WIVSS). Based on CVSS V2, it assigns different weights for CIA impact metrics in contrast to CVSS, which uses the same weights for impact metrics [40].