# A Comprehensive Review and Assessment of Cybersecurity Vulnerability Detection Methodologies
## 4 Taxonomy of Vulnerability Detection Approaches and Findings Analysis
### Matching-Based Approach
#### 4.1.2 Finding Analysis
\begin{table}
\begin{tabular}{c c c c c c c c c} \hline \hline
**Authors,** & **Comparison** & **Scope or** & **Limitations** & **Human** & & & & \\
**Year** & **Method** & **Ecosystem** & **and** & **and** & **Interaction** & **Attributes** & **Prioritization** & **Scanning** \\  & & & & **Challenges** & **(HD)** & & & \\ \hline  & & & & BinXray relies on the accurate & No, but manual & & & \\  & Basic bloc & & & function matching, as well as a & & analysis is & & \\  & mapping, & IT & dependence on a binary compiled system; & & & & & \\  & Greedy & and & & & & & & \\  & Algorithm, & software used & & & & & & \\  & & different versions, & & & & & \\  & [PERSON] & in IoT & & Complex and large functions may & & & & \\  & distance & devices & & increase the time & & & & \\  & Algorithm, & & consumption for analysis; & & & & \\  & & & Remain noise to impact the accuracy. & & & & \\ \hline  & & & & Name inconsistency issues during the & & & \\  & & & collection of & & & & \\  & & software products; & & & & & \\  & & & & & & \\ [PERSON] & & & & & & & \\  & [PERSON]/ & & & & & & \\  & & & & to the obtained scope; & & and & \\  & 2021 [5] & [PERSON] & & Manual verification is & & & \\  & & & required in certain steps; & & & & \\  & & & & Common issues related to & & & \\  & & & & the VBs. & & & \\ \hline  & & & & Extracting and analyzing & & No, but in & & \\  & Fuzzy & & & & computational cost in a & case & & \\  & matching, & & complex infrastructure; & & of false & Target & & \\  & Hash & & Patching method differ and could generate & positive & function (TF), patch & & \\  & algorithms & & false positives, & or & function (PF) and & & \\ [PERSON] et al., & & & & & & \\  & (CIPT and & & VULDEF focuses only on syntactic & & ambiguous & vulnerable & \\  & 2023 [50] & CRGX2) & & & and structural & results, & function (VF), & No & Passive \\  & Weighted edit & & features without handling & validation & dataset of & & \\  & distance and & & semantic aspects, & is & vulnerable & & \\  & Cuckoo filter, & & The balance between the three & required to & function & & \\  & and AST. & & thresholds (\(L1\), \(L2\), and \(L3\)) should be well set to & & & & \\  & & & avoid impacting the & accuracy of & & \\  & & & accuracy of VULDEF & & & \\ \hline \hline \end{tabular}
\end{table} 
Table 3: _Cont._  
The Ratcliff/Obershelp algorithm contributed similarly to the regular expression-based method, matching system logs with CPE/NVD data to identify affected software, achieving an average accuracy of 79%. Additionally, several solutions focused on resolving incomplete CPE listings. The modified Jaro-Winkler technique achieved 83.7% accuracy in vendor matching surpassing the Levenshtein edit distance and Ratcliff/Obershelp methods. Recently, the method based on ChatGPT was evaluated for retrieving CVSS scores, identifying affected CPEs, and offering mitigation strategies. However, these techniques struggled with providing accurate results. Lastly, the HermeScan technique, which integrates fuzzy matching strategy to detect vulnerabilities caused by insecure data flows in firmware, achieved a true positive rate (TPR) of 81%. These findings suggest that both the modified Jaro-Winkler and HermeScan methods present promising results in the field. It is worth noting that the quality of published security event data impacts the accuracy of vulnerability detection methods used in this process  
Methods based on matching techniques rely on the performance of the selected algorithm. Various algorithm matching is employed in the previous methods, such as Jaro-Winkler, fuzzy matching, Ratcliff/Obershelp, and Levenshtein edit distance, among others. In the practical case, a new version of Jaro-Winkler was used to match vendor names between the CPE dictionary and security advisories. As a result, it can match \"renewable energy laboratory (nrel)\" to \"nrel\" provided by CPE vendors, while it faces issues in finding compatibility between \"schweitzer engineering laboratories\" and \"selinc\".