Automated Vulnerability Scanner with CVE Lookup: A Survey of Network Discovery, Vulnerability Correlation, Web Assessment and Risk Prioritization

The components of the automated vulnerability scanner that performs CVE lookup include network discovery, service enumeration, web testing, CPE and CVE association, NVD data quality, machine learning, HTTP/TLS inspection, and risk ranking. Vulnerability scanning involves several steps and, hence, each step should be correctly identified in order for CVE association to make sense. Correct service detection, software normalization, CPE association, version range check, and data base accuracy is needed. Network scanners provide good visibility but poor identities. The visible issues can be detected via web scanners; however, they cannot detect dynamic and stateful issues. ML helps with predicting exploits and enriching them; however, explainability and verification are required. The backlog in the NVD enrichment [42] has complicated the problem and requires the use of vulnerability intelligence from multiple sources including NVD, OSV.dev [41] and CISA KEV [38]. The benchmark validation confirms that the error propagation between pipeline stages is measurable and considerable: the F1 metric decreases from 1.00 to 0.80 while moving from host discovery to CVE lookup in our constructed testbed, and banner suppression and version range semantics are identified as the primary failure points. The correlation of the composite risk score with the expert rankings by Spearman ρ = 0.89 confirms the practical significance of the suggested formula. What we are missing is combining all these steps into one system producing results with uncertainty information. Hybrid scanner producing deterministic detection and correlation with confidence, NVD enrichment and threat-informed prioritization appears to be a good idea for a college cybersecurity project.

[1]      L. A. B. Sanguino and R. Uetz, “Software Vulnerability Analysis Using CPE and CVE,” arXiv:1705.05347, 2017. [Online]. Available: https: //arxiv.org/abs/1705.05347 [2]     R. Ushakov, E. Doynikova, E. Novikova, and I. Kotenko, “CPE and CVE based Technique for Software Security Risk Assessment,” in Proc. IEEE Int. Conf. on Intelligent Data Acquisition and Advanced Computing Systems, 2021, doi: 10.1109/IDAACS53288.2021.9660968. [3]     D. Sawant, M. K. Hanawal, and A. Kabra, “Improving Discov ery of Known Software Vulnerability for Enhanced Cybersecurity,” arXiv:2412.16607, 2024. [Online]. Available: https://arxiv.org/abs/ 2412.16607 [4]     K. McClanahan, Q. Li, et al., “Towards Automatically Matching Security Advisories to CPEs: String Similarity Approaches,” 2025. [Online]. Available: https://www.osti.gov/servlets/purl/2584215 [5]     A. Singh, S. Sharma, B. G. V. R. Krishna Reddy, P. Soni, S. S. Ghuman, and U. S. Gill, “Automated Network Vulnerability Assessment with Nmap: A Comprehensive Approach,” in Proc. Second Int. Conf. on Advanced Computing and Communication Technologies, 2024, doi: 10.1109/ICACCTech65084.2024.00043. [6]     M. Laˇstoviˇcka et al., “Passive Operating System Fingerprinting Revisited,” Computer Networks, Elsevier, 2023. [7]     “A Machine-Learning-Based Tool for Passive OS Fingerprinting With TCP Variant as a Novel Feature,” IEEE Internet of Things Journal, 2021, doi: 10.1109/JIOT.2020.3024293. [8]     “Applying Artificial Intelligence for Operating System Fingerprinting,” Engineering Proceedings, vol. 7, no. 1, MDPI, 2021. [9]     B. Eriksson, G. Pellegrino, and A. Sabelfeld, “Black Widow: Blackbox Data-driven Web Scanning,” in Proc. IEEE Symp. on Security and Privacy, 2021, pp. 1125–1142.   [10]   M. N. Khalid, M. Iqbal, K. Rasheed, and M. M. Abid, “Web Vulnerability Finder (WVF): Automated Black-Box Web Vulnerability Scanner,” International Journal of Information Technology and Computer Science, vol. 12, no. 4, pp. 38–46, 2020, doi: 10.5815/ijitcs.2020.04.05.