# A Comprehensive Review and Assessment of Cybersecurity Vulnerability Detection Methodologies
## 3 Motivation, Background, and VDB Assessment
### Security Vulnerability Databases  
Several security databases are responsible for publishing vulnerability information, technical details, and other complementary resources. This paper focuses on seven repositories that handle relevant vulnerability information. We also highlight other indicators related to these databases and how these data are presented to the public. The details are summarized below in Table 2. In summary, a few of the studied vulnerability databases propose their API to share security cyber events, new vulnerabilities, CWE, attack patterns, CPE, and other relevant information. If the data are sufficiently complete and accurate, cyber experts can focus on automating, deeply analyzing, and efficiently managing the vulnerability management process.  
Moreover, the scoring system focuses on capturing the principal technical characteristics of software, hardware, and firmware vulnerabilities. At this end, upgrading the scoring system to calculate a qualitative severity rating scale for detected vulnerabilities would be beneficial. The CVSS V4.0 [38] includes exploitability and impact metrics, exploit maturity, and environmental metrics. This would assess the dependence of the importance of the affected IT asset, measured in terms of confidentiality, integrity, and availability, and then supplemental metrics, which measure additional extrinsic attributes of a vulnerability and other relevant cyber event information.  
Our contribution in this field includes an overview of the NVD data quality assessment concerning published security events from 2016 to 2024. In this context, we designed and developed a Django-based system that maintains a steady connection with the public API and fetching and storing data in a local PostgreSQL database. In addition, the system can execute targeted background updates in our local database in response to NVD changes or updates. Therefore, the fetched data follow a correlation process within the system to prepare a group of data adapted to the context of the ecosystems concerned. Figures 7-12 display the results of the statistical survey conducted based on multiple Python scripts. In this study, we have focused on the quality and quantity of the CVE published to the public, the CPE dictionary, and other security metadata comparisons. The entire statistical analysis presented in this study is based on data provided by ACG Cybersecurity ([[https://acgcybersecurity.fr/](https://acgcybersecurity.fr/)]([https://acgcybersecurity.fr/](https://acgcybersecurity.fr/)), accessed on 2 August 2024). This work will be available on GitHub [44] and will constitute the focus of future research.  
Thus, each of these databases presented above has its own specificities, performance, and accuracy. The analysis of the data published by NVD confirms the existing VDBs' issues and shortcomings, which will be discussed further.  
To conclude this section, we presented several motivations for choosing this topic. We focused on key cybersecurity elements, providing concise explanations to facilitate understanding. We also summarized our findings on various VDBs, with an in-depth focus on NVD. In the following section, we will examine our research and explore multiple findings in vulnerability detection.