PaperlayerView exact revision on arXiv

Source-linked AI summary

Construction and Natural Language Querying of a Cybersecurity Knowledge Graph

Ines Ben Brahim, Mohamed-Amine El Mortaji, Nada Haddad, Sami Rezig, Sofiane Tadimi, Mohamed-Lamine Messai, Kamal Benzekki

arXiv:2609.07614v1cs.CR

TL;DR

Cybersecurity vulnerability data are dispersed, and graph-based approaches can require Cypher expertise to query. This paper builds an NVD-based Neo4j knowledge graph and evaluates AI-assisted natural-language querying, reporting strong performance on common retrieval and analysis tasks while identifying complexity limits.

  • Problem

    Vulnerability information is dispersed and heterogeneous, while querying knowledge graphs typically requires Cypher expertise.

    Source: §I · p. 1

  • Method

    The paper constructs a Neo4j knowledge graph from NVD records and evaluates an AI-assisted natural-language interface for querying it.

    Source: §I · p. 1, Data Collection · p. 3, Knowledge Graph Design · p. 4

  • Results

    One-hop queries were consistently correct, and filtering or aggregation prompts yielded accurate outputs.

    Source: A. Evaluation of AI-Generated Cypher… · p. 5

  • Takeaways & Limitations

    Natural-language querying makes vulnerability exploration more accessible and supports exploratory, basic retrieval, and educational use cases.

    Source: §IV · p. 6, §V · p. 6

    As queries grow more complex, especially with multi-hop relationships or dense graphs, manual Cypher or programmatic approaches remain more reliable and may require user refinement.

    Source: §IV · p. 6

Abstract

from arXiv · show

Cybersecurity vulnerability information is distributed across numerous platforms and databases, making it difficult for researchers and practitioners to obtain a unified and structured understanding of existing threats. This is a critical issue in cybersecurity, where timely access to accurate vulnerability information directly impacts risk assessment and decision-making. While previous work has shown that knowledge graphs are effective for organizing vulnerability data, a major research gap remains in their accessibility, as querying such graphs typically requires expertise in graph query languages like Cypher. This paper aims to address this gap by proposing an approach that combines the construction of a cybersecurity knowledge graph with natural language-based interrogation. The proposed methodology relies on data collected from the National Vulnerability Database (NVD)(1) through its REST API and models vulnerabilities, products, vendors, severity metrics, weaknesses, and references using the Labeled Property Graph paradigm in Neo4j. The knowledge graph is deployed on Neo4j Aura Cloud and queried through an AI-assisted interface that translates natural language queries into Cypher language. The key contribution of this work is demonstrating that natural language querying significantly lowers the barrier to interacting with cybersecurity knowledge graphs, enabling more intuitive exploration and analysis of vulnerability data, and thereby enhancing their practical usefulness for a broader range of users in the cybersecurity field.

I. INTRODUCTION

Cybersecurity vulnerability information is dispersed and heterogeneous, complicating comprehensive analysis and risk assessment. This paper presents an end-to-end NVD-based knowledge graph with natural-language querying, reporting benefits for exploratory analysis while noting limits on complex, multi-hop queries.

I. INTRODUCTION

  • Vulnerability information is dispersed across platforms and databases, while heterogeneous records make comprehensive analysis time-consuming and error-prone.Records combine descriptions, severity metrics, products, vendors, and external references.Source: §I · p. 1
  • Knowledge graphs represent vulnerabilities and related entities through semantic relationships, but querying them typically requires Cypher expertise.AI-assisted natural-language interfaces can translate user queries into Cypher.Source: §I · p. 1
  • The paper demonstrates an end-to-end natural-language-queryable cybersecurity knowledge graph and evaluates AI-assisted querying for vulnerability exploration.The introduction reports benefits for exploratory analysis but identifies limitations on complex, multi-hop queries.Source: §I · pp. 1–2

A. Related Work

Prior cybersecurity knowledge-graph work emphasizes construction, automation, or data quality, while the reviewed approaches lack natural-language querying. This work combines an NVD-based Neo4j graph with an AI-assisted interface that supports plain-English queries, with limitations on multi-hop and highly compositional patterns.

A. Related Work

  • Earlier work emphasizes cybersecurity knowledge graphs’ richer semantic relationships, but querying them generally requires Cypher expertise.The paper frames natural-language querying as the gap in prior approaches.Source: A. Related Work · p. 2
  • CyberGraph integrates public repositories into Neo4j at scale, but users must write Cypher and its manually designed ontology may hinder rapid evolution.It contains over 735,000 nodes and 1.3 million relationships.Source: A. Related Work · p. 2
  • Host et al. extract entities and relations from NVD text and use embeddings for completion, but relation extraction precision is 0.77 and natural-language querying is absent.Their approach uses a fixed ontology and simple word-order rules.Source: A. Related Work · p. 2
  • Li et al. assess graph quality with a manually annotated dataset and AttTucker, achieving 0.947 accuracy on noisy data, but provide no natural-language interface.Their manual ontology and graph construction may require substantial effort to scale to fast-changing threats.Source: A. Related Work · p. 2
  • Jia et al. introduce a quintuple model and path-ranking deductions, but their semi-automatic graph construction relies heavily on manual ontology engineering and offers no natural-language interface.The best reported NER model has an F1 around 0.83.Source: A. Related Work · p. 2
  • The reviewed approaches lack natural-language querying; this work combines an NVD-based Neo4j graph with an AI-assisted interface for plain-English queries.The evaluation reports support for one-hop traversals, filtering, and basic aggregations, with limits on multi-hop and highly compositional patterns.Source: A. Related Work · pp. 2–3
  • Table I compares approaches by cybersecurity knowledge-graph construction and natural-language querying.The supplied caption establishes the comparison’s scope but does not provide results.Source: Table I · p. 2

II. METHODOLOGY

The methodology has two phases: constructing the cybersecurity knowledge graph and interrogating it through natural-language queries in Neo4j Aura.

II. METHODOLOGY

  • The methodology separates knowledge-graph construction from natural-language interrogation.Construction covers data collection and graph modeling; interrogation uses Neo4j Aura.Source: §II · p. 3
  • The first phase collects data and models the cybersecurity knowledge graph.Source: §II · p. 3
  • The second phase queries the graph using natural language through Neo4j Aura.Source: §II · p. 3

A. Construction of the Knowledge Graph

The paper builds a cybersecurity knowledge graph from NVD vulnerability records, organizing vulnerabilities and related entities as nodes with semantic relationships. Its design combines data collection and update procedures with an LPG model for vulnerability exploration.

Data Collection

  • The initial dataset contains 2,000 CVE records retrieved as JSON through the NVD REST API version 2.0.Records include vulnerability descriptions, affected products, CVSS metrics, CWE weaknesses, external references, and API metadata.Source: Data Collection · p. 3
  • The ingestion process prioritizes CVSS v3.1, then uses v3.0 and v2 as fallbacks when newer metrics are unavailable.Separating data acquisition from graph ingestion allows new CVE batches to be integrated without rebuilding the graph.Source: Data Collection · p. 3

Knowledge Graph Design

  • The graph follows the Labeled Property Graph paradigm, representing cybersecurity entities as nodes and their semantic relationships as edges.Neo4j stores and manages the graph using the LPG model.Source: Knowledge Graph Design · p. 3

Global Knowledge Graph Overview

  • The global graph links vulnerabilities to impacted products and vendors, severity metrics, CWE categories, and external documentation.This representation provides a basis for knowledge exploration and pattern-based querying in Neo4j.Source: Knowledge Graph Design · p. 3, Figure 1 · p. 3

Knowledge Graph Design

  • The graph models CVEs, severity metrics, products, vendors, CWE weaknesses, and external references as connected entities.CVE, Metric, Product, Vendor, CWE, and Reference nodes carry properties suited to their roles; references can be shared across vulnerabilities and support traceability to mitigation guidance.Source: Knowledge Graph Design · pp. 3–4

B. Graph Interrogation Using Natural Language

Neo4j Aura’s AI-assisted search maps natural-language questions to Cypher queries using graph-schema metadata. It supports exploratory querying, but query quality may degrade for complex traversals and constraints.

Conceptual Mechanism of AI Search

  • The AI-assisted search interprets natural-language input in the context of graph-schema metadata and generates a Cypher query.The schema provides node labels, relationship types, and properties to constrain query generation and reduce ambiguity and invalid queries.Source: Conceptual Mechanism of AI Search · p. 4

Cloud Deployment of an Existing Knowledge Graph

  • Deploying the locally developed graph to Aura requires connection-configuration changes, while the data model, constraints, and Cypher scripts remain unchanged.The application or script is configured with the Aura instance’s URI, username, and password.Source: Cloud Deployment of an Existing… · pp. 4–5

Natural Language Interface for Graph Exploration

  • Users can query the deployed graph in plain English through Aura’s Explore interface, then inspect, refine, or execute the generated Cypher.The AI search option is enabled in the search input field.Source: Natural Language Interface for Graph… · p. 5

Limitations of AI-Assisted Natural Language Queries

  • AI-assisted querying works best for simple retrieval with few node types and relationships; quality can degrade for multi-hop, aggregated, or intricately constrained queries.Generated queries may be incomplete, omit constraints, or misinterpret traversal intent, particularly in dense graphs with many labels and relationships.Source: Limitations of AI-Assisted Natural… · p. 5

C. Code and Reproducibility Resources

The project makes its code and data-preparation resources publicly available. The repository is presented as supporting reproducibility of graph construction, query evaluation, and the reported experiments.

Code and Reproducibility Resources

III. RESULTS

The results describe a graph that represents vulnerability data as interconnected entities and supports relationship traversal. Natural-language querying is reported to improve usability, while Table II is identified as an evaluation of AI-generated Cypher queries.

III. RESULTS

  • The graph represents vulnerability data as interconnected entities, and Neo4j enables relationship traversal for complex queries.The paper contrasts this capability with queries that would be difficult to express using relational databases.Source: §III · p. 5
  • Natural-language querying lets users retrieve information without manually writing Cypher queries.Source: §III · p. 5
  • Table II evaluates AI-generated Cypher queries from natural-language prompts; “Partial” means syntactically valid queries needed minor corrections for full semantic correctness.Source: Table II · p. 5, §III · p. 5

A. Evaluation of AI-Generated Cypher Queries

The AI-generated queries handled one-hop traversals, aggregation, and filtering accurately, while performance declined on more structurally complex prompts. Even then, the queries remained syntactically valid and needed only minimal adjustments.

A. Evaluation of AI-Generated Cypher Queries

IV. DISCUSSION

Natural-language querying improves access to cybersecurity analysis for users not proficient in Cypher and suits exploratory, basic retrieval, and educational use. Its reliability depends on the graph schema and language-model understanding, with manual or programmatic approaches more reliable as query complexity grows.

IV. DISCUSSION

  • Neo4j Aura natural-language querying is suited to exploratory analysis, basic retrieval, and educational use cases.Source: §IV · p. 6
  • Generated-query accuracy and reliability depend strongly on graph-schema quality and the language model’s grasp of domain-specific terminology.Source: §IV · p. 6
  • For multi-hop relationships or dense graph structures, manual Cypher or programmatic approaches remain more reliable and may require user refinement.Source: §IV · p. 6
  • Future work could use external NLP pipelines with LLM APIs for finer prompt engineering, schema grounding, and query validation.The authors suggest this may mitigate some limitations of the built-in AI-assisted search.Source: §IV · p. 6

V. CONCLUSION

CyberGraph combines a Neo4j knowledge graph built from public vulnerability data with large language models that translate natural language into Cypher. The paper concludes that this integration can make vulnerability information more accessible for analysis, while future work targets broader data coverage and stronger query translation.

V. CONCLUSION

  • CyberGraph combines publicly available vulnerability data, Neo4j graph capabilities, and large language models that turn natural-language questions into Cypher.Source: §V · p. 6
  • The authors conclude that this integration provides a more intuitive way to analyze complex cybersecurity information and may improve access to structured vulnerability knowledge.Source: §V · p. 6
  • Future work will add heterogeneous sources such as threat-intelligence feeds, attack-pattern repositories, and remediation knowledge to improve coverage and contextualization.Source: §V · p. 6
  • Future work will also evaluate and enhance natural-language query translation through domain-specific prompting, schema-aware reasoning, and benchmark-based assessment.Source: §V · p. 6
Loading 2609.07614v1…