NLP Model for Automated CVE to CPE Linking

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing methods for linking Common Vulnerabilities and Exposures (CVEs) with Common Platform Enumerations (CPEs) are inefficient, often resulting in a time-lag of up to 35 days for correct assignment of CPE metadata, which can leave software vulnerable to attacks during this period.

Innovation Solution

A method using a trained Natural Language Processing (NLP) model to receive the summary of a CVE from a vulnerability database, extract relevant information, build synthetic CPEs, and link them to the CVE, thereby automating the process and reducing the time required for vulnerability assessment.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Measurement precision

If manual linking of CPEs to CVEs is performed by security professionals, then accuracy of CPE assignment is improved, but time consumption increases significantly (median time of 35 days)

Engineering Contradiction:

Improveaccuracy of CPE assignmentVSAvoidtime consumption for CPE linking

Core Design Contradiction:

Measurement precisionVSLoss of time

Solution Approach 1:

The patent introduces an intermediary NLP-based system that processes CVE summaries to automatically generate and link CPEs. This intermediary system bridges the gap between manual processing (high accuracy) and automated processing (fast but inaccurate), achieving both speed and reasonable accuracy by using machine learning models to predict CPEs from unstructured CVE text.

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The system enables self-service by allowing the NLP model to autonomously extract product information from CVE summaries and generate CPEs without human intervention. The model processes CVE data independently, performs entity recognition, and produces CPE links automatically, reducing reliance on manual security professional involvement while maintaining acceptable accuracy levels.

Inventive Principle:

Principle #25Self-service

2Productivity

If automated tools are used for vulnerability management, then productivity is improved, but the quality of vulnerability data may deteriorate due to incorrect CPE linking

Engineering Contradiction:

Improvespeed of vulnerability assessmentVSAvoidquality of vulnerability data

Core Design Contradiction:

ProductivityVSReliability

Solution Approach 1:

The patent replaces manual mechanical processes (security professionals manually linking CPEs) with an automated NLP-based system. This substitution uses machine learning models to perform entity recognition and CPE generation, achieving high productivity while maintaining data quality through trained algorithms that understand CVE summary structures and product naming conventions.

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

Solution Approach 2:

The system changes the parameter of processing speed from slow (manual) to fast (automated) while managing quality through model training and validation. By adjusting parameters such as model architecture, training data composition, and evaluation metrics, the system optimizes both productivity and reliability, achieving a balance where automated processing delivers sufficient accuracy for practical vulnerability management.

Inventive Principle:

Principle #35Parameter changes

3Difficulty of detecting and measuring

If more CPE metadata is assigned to CVEs, then vulnerability identification capability is improved, but the complexity of the data management process increases

Engineering Contradiction:

Improvevulnerability identification capabilityVSAvoiddata management process complexity

Core Design Contradiction:

Difficulty of detecting and measuringVSDevice complexity

Solution Approach 1:

The system performs preliminary action by pre-processing CVE summaries to extract product information and generate CPEs before vulnerability assessment begins. This advance preparation ensures that CPE metadata is already available when needed for vulnerability matching, improving identification capability without adding complexity during the actual assessment process. The heavy lifting is done upfront by the NLP model.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The patent extracts essential CPE metadata from unstructured CVE summaries using NLP techniques. By taking out only the necessary information (product names, versions, vendors) from the full CVE text and formatting it into standardized CPE strings, the system improves vulnerability identification capability while avoiding the complexity of managing complete unstructured CVE data. Only the extracted essential elements are retained for matching.

Inventive Principle:

Principle #2Taking out (Extraction)

Data Source

PatentUS12339972B2Method for linking a CVE with at least one synthetic CPE

Publication Date: 2025.06.24 DEBRICKED AB

AI summary

A method (300) for linking a common vulnerability and exposure, CVE, (106) with at least one synthetic common platform enumeration, CPE, (112) wherein the CVE (106) comprises a summary of a vulnerability, is disclosed. The method (300) comprising: receiving (S302) the summary of the CVE (106) from a vulnerability database, VD, (104); extracting (S304) information from the summary of the CVE (106) using a Natural Language Processing, NLP, model; building (S306) at least one synthetic CPE (112) based on the extracted information; and linking (S308) the CVE (106) with the at least one synthetic CPE (112).