Cybersecurity knowledge graph made easy with natural language queries
Construction and Natural Language Querying of a Cybersecurity Knowledge Graph
Cryptography and Security
Summary
Vulnerability information in cybersecurity is stored in many places, making it hard for people to get a clear picture of threats. The authors built a structured knowledge graph using data from the National Vulnerability Database to organize this information. They also created an AI-assisted tool that lets users ask questions in everyday language instead of learning complex query coding. This approach helps more people explore and understand cybersecurity risks without needing specialized skills.
What this means in practice
- •For cybersecurity analysts: Use natural language queries to quickly explore vulnerability data without needing query language expertise.
- •For software asset managers: Integrate vulnerability risk data into toolchains by fetching structured information from a cloud-hosted cybersecurity knowledge graph.
Authors
Ines Ben Brahim, Mohamed-Amine El Mortaji, Nada Haddad, Sami Rezig, Sofiane Tadimi, Mohamed-Lamine Messai, Kamal Benzekki
Abstract
Cybersecurity vulnerability information is distributed across numerous platforms and databases, making it difficult for researchers and practitioners to obtain a unified and structured understanding of existing threats. This is a critical issue in cybersecurity, where timely access to accurate vulnerability information directly impacts risk assessment and decision-making. While previous work has shown that knowledge graphs are effective for organizing vulnerability data, a major research gap remains in their accessibility, as querying such graphs typically requires expertise in graph query languages like Cypher. This paper aims to address this gap by proposing an approach that combines the construction of a cybersecurity knowledge graph with natural language-based interrogation. The proposed methodology relies on data collected from the National Vulnerability Database (NVD)(1) through its REST API and models vulnerabilities, products, vendors, severity metrics, weaknesses, and references using the Labeled Property Graph paradigm in Neo4j. The knowledge graph is deployed on Neo4j Aura Cloud and queried through an AI-assisted interface that translates natural language queries into Cypher language. The key contribution of this work is demonstrating that natural language querying significantly lowers the barrier to interacting with cybersecurity knowledge graphs, enabling more intuitive exploration and analysis of vulnerability data, and thereby enhancing their practical usefulness for a broader range of users in the cybersecurity field.