VULNERABILITY INTELLIGENCE

VulZoo

One CVE
A connected view

A vulnerability record is a starting point. VulZoo connects databases, community assessments, mail, PoCs, and patches across 17 sources, giving researchers a reusable view of vulnerability intelligence.

Explore the connections Read the paper

17 SOURCES / 5 DATA CATEGORIES / 11 RELATIONSHIP TYPES

INTELLIGENCE ASSEMBLYDATASET CONCEPT

ASE 2024 · TOOL DEMOMulti-source intelligence, reusable data

Data sources / Table 1

Data categories / §3.1

Relationship types / Table 3

01 / WHY CONNECT INTELLIGENCE

One vulnerability
Many separate sources

Descriptions, severity, exploitation evidence, and remediation context live in different sources. Repeatedly collecting a narrow subset limits the view and adds preparation work.

I / FRAGMENTATION

A record needs context

CVE identifiers name the vulnerability; mail captures disclosure; patches capture code changes. Each artifact contributes a different part of the profile.

II / HETEROGENEITY

Different formats, repeated work

Structured catalogs, mail text, and code diffs need different handling. VulZoo unifies the structured interface while retaining unstructured artifacts.

III / INCOMPLETENESS

Profiles have uneven coverage

Real vulnerabilities have different amounts of evidence. Missing PoCs or catalog links remain gaps; relationship mining must preserve what the sources actually contain.

02 / START WITH ONE CVE

Bring evidence together
Explore a richer profile

Follow collection, normalization, and linking using the paper’s OpenSMTPD case. Choose a research lens, then inspect the evidence and missing links at each node.

CVE-2020-7247 / OpenSMTPDPAPER CASE / OFFLINE DEMO

Scroll within the graph to inspect every node

Case evidence in this lensOther intelligenceNo link in this case

Connect CVE to assessments, mail, patches, and PoCs, then follow CWE to CAPEC. This case does not cover ATT&CK or D3FEND.

10 / 12 node types have case evidence

The browser presents a fixed paper case and illustrates data processing; it does not crawl sources, execute PoCs, or query live data. Lenses organize the view without generating priority scores or new relationships.

03 / FROM HETEROGENEOUS SOURCES TO USABLE DATA

Preserve the evidence
Then mine the connections

Source-specific collection strategies feed a repeatable process for cleaning, format unification, relationship mining, and statistics.

I / COLLECTION & CLEANING

A shared interface for different artifacts

Validate links before incremental fetching. Git sources use submodules; file links are downloaded; mail is fetched individually; NVD tags locate patches. Irrelevant files are filtered, SHA256 comparisons remove duplicates, and structured data is converted to JSON.

STRUCTUREDRecords & assessments → JSON

UNSTRUCTUREDMail / patches / PoCs

RELATIONSHIPSIdentifier & catalog links

Source fields and coverage still differ; a unified format does not eliminate assessment disagreements. Source: §2.2, §3.1.

II / SYNCHRONIZATION & REUSE

Make data preparation reusable

Raw and processed data are stored separately. Utility scripts synchronize sources, rebuild connections, and generate statistics, supporting task-specific reuse for severity and type assessment, intelligence alignment, and information augmentation.

sync-raw-data.shIncrementally synchronize raw sourcessync-processed.shClean, convert, and update processed dataprint-statistics.pyInspect dataset statistics

These are local repository tools. Page playback illustrates the process; application scenarios are research uses proposed in the paper. Sources: §4 and the repository README.

04 / DATA EVIDENCE FROM THE PAPER

Explore the scale
and variety of intelligence

The paper describes VulZoo through five data categories. Select a category to inspect its sources and reported counts; different sources may describe the same CVE.

17Data sources
Table 1

5DATA CATEGORIES

11RELATIONSHIP TYPES

Historical snapshot: 2024-06-13
Sources: §3.1, Tables 1–3
These are descriptive dataset statistics, rather than model accuracy or current repository totals.

File counts and linked CVE counts differ: 46,540 PoCs link to 24,587 CVEs; 12,626 patch files link to 10,548 CVEs. Source: Tables 2–3.

CVE records

Four databases provide records. The same CVE may appear in multiple sources; these counts cannot be added to obtain a unique CVE total.

MITRE CVENVDZDI AdvisoryGitHub Advisory

Dataset counts in the paper as of 2024-06-13
MEASUREMENT	COUNT
MITRE CVE	320,861
NVD	253,722
ZDI Advisory	13,291
GitHub Advisory	17,069

Inspect the original counts and relationship definitions ↗

05 / GO TO THE SOURCE

VulZoo: A Comprehensive Vulnerability Intelligence Dataset

39th IEEE/ACM International Conference on Automated Software Engineering · ASE 2024 · Tool Demonstrations · pp. 2334–2337

Bonan Ruan · Jiahao Liu · Weibo Zhao · Zhenkai Liang
National University of Singapore

Diagrams are newly designed from the paper and ASE 2024 slides. Consult the repository for current data and operating instructions.

Read the paper PDF / 4 PAGES ↗ Code & datasets GITHUB / OPEN SOURCE ↗ Presentation slides ASE 2024 ↗ Publication page ACM / DOI ↗

@inproceedings{ruan2024vulzoo,
  title = {VulZoo: A Comprehensive Vulnerability Intelligence Dataset},
  author = {Ruan, Bonan and Liu, Jiahao and Zhao, Weibo and Liang, Zhenkai},
  booktitle = {Proceedings of the 39th IEEE/ACM International Conference on Automated Software Engineering},
  pages = {2334--2337},
  year = {2024},
  doi = {10.1145/3691620.3695345}
}