# A Comprehensive Review and Assessment of Cybersecurity Vulnerability Detection Methodologies
## 4 Taxonomy of Vulnerability Detection Approaches and Findings Analysis
### Graph-Based Approach
#### 4.2.1 Graph-Based Approach Methods Description
Finally, the obtained subgraph and SPG are concatenated into a classifier network for vulnerability detection. Method Based on Methods and Gremlin Graph  
In the same year, the current study proposed a method based on three broad blocs [67]. The first bloc is based on the graph model to store CVE information (JSON format from NVD feeds) and the related applicability statement Conjunctive Normal Form (CNF), along with a hierarchy of asset configurations [31, 36]. Then, there is an insertion procedure step that pre-processes CVE and CNF (as vertices: CveVertex into the graph) while performing attribute-value pair comparison. Finally, the graph search query block finds all vulnerable pairs of CVEs, using a Gremlin-based graph, in a single traversal. This method highlighted a new technique based on the Extended Dependency Graph (EDG) model for vulnerability analysis in space (asset) and time (recurrence) within the Industrial Automation and Control System (IACS) environment [68]. This method involves various crucial processes to alleviate cyber risk, as shown in Figure 18. The first process constructs a direct graph to represent, map, and understand the dependence between assets, CVE and CVSS, CWE, and attack pattern (CAPEC) [69]. By integrating quantitative metrics, the proposed approach prioritizes updating and upgrading activities and ensures continuous monitoring of the configuration system. Vulnerability management identifies the global CWE in the target system and brings out insights related to the root causes of the detected vulnerabilities. The EDG model dynamically adapts by covering the entire device lifespan within a complex environment and under System Under Test (SUT) as an industrial component, following the denomination in the ISA/IEC 62443 standard [70]. By the end, the method provides visual outputs representing the system's security posture and produces detailed reports. Despite positive results from evaluating and experimenting with the OpenPLC project (open-source Programmable Logic Controller (PLC), both in software and hardware) [71, 72, 73, 74], the approach could be strengthened by integrating a mathematical model to combine each asset's CVSS metric values, enhancing patch prioritization, and using other techniques to predict future vulnerabilities. Method Based on Analytic Graph  
This contribution introduced a Graph-Based Analytic method to improve Cyber Situational Awareness (CSA) across complex computer networks [75, 76]. The CSA operates on three levels: perception, comprehension, and projection of situations in a cyber environment. The authors introduce graph-based intelligence, which leverages the second level of CSA. This method starts by identifying hosts near compromised devices using Depth First Search (DFS). Next, this method discovers vulnerable assets using breadth-first searching (BFS) to identify and manage network vulnerabilities. Likewise, community detection and frequent subgraph mining (FSM) algorithms segment the network as part of the proactive  
Figure 18: Steps to build EDG for SUT. (Adapted from [68]). security measures in Incident Response IR [77]. Ultimately, graph centrality measures (Degree--Betweenness--PageRank--Closeness) prioritize nodes based on their influence, impact, critical subnet, and other relevant parameters to assess network security [78, 79]. Method Based on Threat Knowledge Graph  
In this contribution, the method is proposed to aggregate extracted security information like CVE, CPE, and CWE to predict the associations between these elements [80]. When gathering data from external sources, the approach proceeds to graph construction, where nodes represent the entities (products, vulnerabilities, and weaknesses) and edges represent the relationships between them. Then, the knowledge graph is optimized through data preprocessing and enhancement before applying the TransE model to predict new or missing associations between entities [81].