Towards AI-Based Identification of Publicly Known Vulnerabilities

The increasing volume of publicly disclosed vulnerabilities presents a significant challenge for organizations striving to secure their information systems and data. Traditional vulnerability scanners, reliant on manually coded vulnerability tests, struggle to keep pace with the growing number of vulnerabilities, resulting in delays and inefficiencies. In this work, we propose a novel architecture that leverages Artificial Intelligence (AI) to create modular and scalable vulnerability scanners. Our architecture decouples vulnerability tests from the vulnerability database (VDB), enabling the use of well-known fingerprinting tools and an AI-driven VDB that is regularly updated from Common Vulnerabilities and Exposures records. We evaluate the feasibility and effectiveness of our approach through a series of experiments. Using both heuristic and GPT-based methods, we assess the performance of our approach to automatically create the VDB and to identify known vulnerabilities in arbitrary software using it. The GPT-based methods demonstrate superior accuracy, achieving a perfect precision, recall, and F1 score creating the VDB, albeit with increased execution time compared to heuristic methods. On the vulnerability identification task, the GPT-based approach also shows significant improvement in accuracy over heuristic methods. Our findings indicate that AI models, particularly large language models, can significantly enhance vulnerability scanners to keep up with the latest vulnerabilities. Despite the higher computational costs, the improved accuracy and reduced false positives and false negatives make AI-driven approaches a promising direction for future research and development in cybersecurity.