IMPROVING THE APPROACH TO CONSTRUCTING A UNIFIED KNOWLEDGE GRAPH BASED ON KNOWN SOFTWARE AND HARDWARE VULNERABILITY CATALOGS FOR VALIDATION TASKS

Abstract

Four well-known public catalogues describe software and hardware security: the CVE List registers vulnerabilities, CWE generalizes vulnerabilities through typical design and implementation weaknesses of information systems, CAPEC describes attack patterns, and ATT&CK outlines adversary techniques. Constructing a unified knowledge graph that links these catalogues enables tracing a path from a vulnerability record to an attack technique enabled by this vulnerability. However, most existing graph construction approaches fail to account for additional metadata published by the catalogues: the author of a weakness assignment, the record container type, cross-catalogue link directions, the CWE hierarchy, and release versions. The goal of this paper is to build an ontology for a generalized knowledge graph of these catalogues that faithfully represents the available information and relationships between entities. The approach is grounded in a strict semantic lifting principle: every cross-catalogue link is converted into RDF while fully preserving direction, authorship, release version, and accompanying source fields, without generating artificial facts. This principle is implemented through the following rules: a link described by additional metadata in a catalogue is modeled as a node rather than an edge, and automatic generation of inverse or symmetric links in the absence of explicit source statements is prohibited. Technical implementation of these requirements is realized using SHACL tools via four validation checks (Shape validation, Snapshot identity, Round-trip check, and Residue control), which verify the correctness of the lifting process. The improved knowledge graph model enables the detection of various discrepancies: in a portion of records, the record owner (CNA) and Authorized Data Publisher (ADP) assign different weaknesses; CAPEC mappings to ATT&CK and ATT&CK references to CAPEC share no common pairs; and certain weaknesses have different parents across different CWE views, making the graph suitable for validation tasks. At the same time, existing knowledge graph models built on data from the same catalogues only support graph traversal. The code, ontology, shapes, and queries are published in an open repository.