Construction and Natural Language Querying of a Cybersecurity Knowledge Graph 1st Ines BEN BRAHIM 2nd Mohamed Amine EL MORTAJI 3rd Nada HADDAD 4th Sami REZIG 5th Sofiane TADIMI 6th Mohamed-Lamine MESSAI Université Lumière Lyon 2, Université Claude Bernard Lyon 1, ERIC 69007 Lyon, France (1) ines.ben-brahim, (2) mohamed-amine.el-mortaji, (3) nada.haddad, (4) sami.rezig, (5) s.tadimi, (6) [email protected]
arXiv:2609.07614v1 [cs.CR] 7 Sep 2026
7th Kamal BENZEKKI INSA Lyon, CITI, Inria 69621 Villeurbanne, France [email protected], [email protected]
Abstract—Cybersecurity vulnerability information is distributed across numerous platforms and databases, making it difficult for researchers and practitioners to obtain a unified and structured understanding of existing threats. This is a critical issue in cybersecurity, where timely access to accurate vulnerability information directly impacts risk assessment and decision-making. While previous work has shown that knowledge graphs are effective for organizing vulnerability data, a major research gap remains in their accessibility, as querying such graphs typically requires expertise in graph query languages like Cypher. This paper aims to address this gap by proposing an approach that combines the construction of a cybersecurity knowledge graph with natural language-based interrogation. The proposed methodology relies on data collected from the National Vulnerability Database (NVD) [9] through its REST API and models vulnerabilities, products, vendors, severity metrics, weaknesses, and references using the Labeled Property Graph paradigm in Neo4j. The knowledge graph is deployed on Neo4j Aura Cloud and queried through an AI-assisted interface that translates natural language queries into Cypher language. The key contribution of this work is demonstrating that natural language querying significantly lowers the barrier to interacting with cybersecurity knowledge graphs, enabling more intuitive exploration and analysis of vulnerability data, and thereby enhancing their practical usefulness for a broader range of users in the cybersecurity field. Index Terms—Cybersecurity knowledge graph, vulnerability management, natural language querying, Neo4j, NVD.
I. I NTRODUCTION Cybersecurity has become a critical concern as software systems grow in size, complexity, and interconnectivity. Every year, thousands of new security vulnerabilities are disclosed [9], affecting a wide range of software and hardware products. For researchers and security practitioners, understanding these vulnerabilities is essential for risk assessment, threat analysis, and decision-making. However, vulnerability information is often dispersed across multiple platforms, reports, and
databases, making comprehensive analysis time-consuming and error-prone. Although centralized repositories such as the NVD [9] provide standardized vulnerability data, the volume and complexity of this information remain challenging. Vulnerability records include heterogeneous elements such as textual descriptions, severity metrics, affected products, vendors, and references to external advisories. Traditional tabular or document-based representations struggle to capture the rich relationships that exist between these elements, limiting their analytical value [4], [12]. Cybersecurity Knowledge Graphs (CKG) [13], [1] offer a promising solution by representing cybersecurity data as interconnected entities and relationships, enabling a more explicit and semantically rich view of the vulnerability landscape. By modeling vulnerabilities, products, vendors, and weaknesses as nodes linked through meaningful relationships, knowledge graphs support advanced exploration and reasoning. This expressiveness, however, creates a barrier to adoption. Because querying a knowledge graph typically requires expertise in languages like Cypher, which limits its utility for broader cybersecurity analysis. Recent advances in AI, particularly large language models, have opened new possibilities for lowering this barrier. Natural language interfaces for graph databases allow users to query complex data structures without explicit knowledge of graph query syntax. Neo4j Aura, a managed cloud platform for graph databases, integrates an AI-assisted search mechanism that translates natural language queries into Cypher language [2], making graph-based analysis more accessible. The core contribution of this paper is a complete, end-to-end demonstration of a natural language-queryable cybersecurity knowledge graph. We describe the data collection process, graph modeling choices, and cloud deployment, and we evaluate the use of AI-assisted natural language querying for
exploring vulnerability information. The results highlight the benefits of combining knowledge graphs with natural language interfaces for exploratory cybersecurity analysis, while also identifying current limitations when addressing complex and multi-hop queries. The remainder of this paper is structured as follows. Section 2 reviews the related works and section 3 details our methodology for constructing and deploying the knowledge graph. Then, section 4 presents our evaluation results. Next, section 5 discusses the findings and limitations. Finally, section 6 concludes and suggests future research directions. A. Related Work The growing volume and complexity of cybersecurity data have led several researchers to adopt knowledge graphs as a way to structure vulnerability information. These graphs enable richer semantic relationships and more flexible querying than traditional databases. However, most existing solutions still require users to write queries in languages like Cypher, which limits their accessibility. This section reviews representative approaches to cybersecurity knowledge graph construction and compares them with our work, focusing on whether they support natural language interfaces. A notable effort in this direction comes from Falcarin and Dainese [3], who propose CyberGraph, a tool that automatically builds a cybersecurity knowledge graph by integrating public repositories such as CVE, CWE, CAPEC, CPE, and CVSS. The graph is stored in Neo4j and follows a manually designed schema that preserves the original data structures. A clear strength of CyberGraph is its scale. It contains over 735,000 nodes and 1.3 million relationships, besides it supports rich cross-domain queries across vulnerabilities, weaknesses, and attack patterns. The authors also provide utility scripts for incremental updates. On the other hand, the system requires users to write Cypher queries explicitly; there is no natural language interface. This means that security analysts without graph query training cannot easily explore the data. Moreover, the manual ontology design, while precise, may become a bottleneck when the schema needs to evolve rapidly. A different strategy is taken by Host et al. [5], who present an automatic method to build a vulnerability knowledge graph directly from textual descriptions in the NVD. Their pipeline uses SecBERT and Averaged Perceptron for named entity recognition, rule-based relation extraction, and TuckER embeddings for entity prediction (to recover missing software or weakness types). One advantage of this work is that it reduces manual effort by extracting entities and relations directly from unstructured text. The use of knowledge graph embeddings for completion is also a valuable contribution, and the evaluation covers about 175,000 CVEs. However, the fully automatic extraction introduces noise where the precision for relation extraction is only 0.77. More importantly, the authors do not address natural language querying at all. So, users must work directly with the graph structure. The relation extraction is
based on a fixed ontology and simple word-order rules, which may miss more complex or implicit relationships. While Host et al. focus on automation, Li et al. [7] place greater emphasis on data quality and graph assessment. They develop a framework for constructing cybersecurity knowledge graphs and assessing their quality, manually creating the CS13K dataset (13,027 triples, 4,494 entities, 12 relations) and extending the UCO ontology to 16 classes. They also propose AttTucker, a Transformer-based model that evaluates triple confidence, and show that incorporating path-level information improves quality assessment. A major strength is the high quality of the manually annotated dataset, which serves as a reliable benchmark. The quality assessment model is novel and effective, achieving 0.947 accuracy on noisy data. Nevertheless, the work does not provide any natural language querying capability. Even with high-quality triples, users still need Cypher expertise to interact with the graph. Furthermore, the ontology and graph construction are manual, which ensures correctness but may not scale to fast-changing threat landscapes without significant human effort. An earlier and more foundational contribution comes from Jia et al. [6], who propose a practical approach based on a quintuple model (concept, instance, relation, properties, rule). They use machine learning (Stanford NER) to extract entities from structured and unstructured data and apply path-ranking algorithms for knowledge deduction, inferring new attributes and relationships. The main contribution is a clear framework for ontology construction and rule-based reasoning. The use of CRF-based NER is well-justified, and the deduction rules add some reasoning capability. On the downside, the graph construction is semi-automatic and still heavily relies on manual ontology engineering. The NER performance (F1 around 0.83 for the best model) leaves room for improvement. Crucially, there is no natural language interface, thus, querying the graph requires knowledge of the schema and Cypher. This work predates the widespread availability of large language models and does not leverage modern NLU techniques. As the above review shows, all previous approaches focus primarily on knowledge graph construction—whether manual, automatic, or semi-automatic and none integrates a natural language querying interface. Table I summarises this gap. Cybersecurity practitioners, who often lack Cypher skills, are therefore unable to fully exploit these graphs. TABLE I C OMPARISON OF APPROACHES ON CYBERSECURITY KNOWLEDGE GRAPH CONSTRUCTION AND NATURAL LANGUAGE QUERYING . Article Falcarin and Dainese (CyberGraph, 2024) [3] Host et al. (2023) [5] Li et al. (2024) [7] Jia et al. (2018) [6] Our work
Graph construction Manual Automatic Manual Semi-automatic Manual
LLM for NL querying No No No No Yes
In contrast, our work directly addresses this gap by combining a cybersecurity knowledge graph (built from NVD data and modeled in Neo4j) with an AI-assisted natural language interface. By leveraging Neo4j Aura’s built-in LLM-based
translation, users can express their information needs in plain English without writing any Cypher. Our evaluation shows that natural language queries successfully handle simple to moderately complex tasks such as one-hop traversals, filtering, and basic aggregations, thus lowering the barrier to exploratory vulnerability analysis. While we acknowledge current limitations for multi-hop queries and highly compositional patterns, our approach demonstrates the first end-to-end, natural language queryable cybersecurity knowledge graph that is both practical and accessible to a broad range of security researchers and professionals. II. M ETHODOLOGY This methodology is divided into two main phases. The first phase focuses on the construction of the cybersecurity knowledge graph, including data collection and graph modeling. The second phase addresses the interrogation of the graph using natural language queries through Neo4j Aura. A. Construction of the Knowledge Graph The construction of a cybersecurity knowledge graph involves transforming structured vulnerability data into interconnected semantic entities. This makes it easier to analyze and make decisions by providing an explicit and exploitable representation of the connections between security vulnerabilities, affected products, and their characteristics. Data Collection: A reliable and comprehensive dataset was required to construct the graph. We chose the NVD [9] which offers standardized information on security vulnerabilities identified using the CVE [8] standard, which is widely recognized in cybersecurity research and practice. Data were retrieved via the public NVD REST API (version 2.0) in JSON format. For this project, an initial dataset of 2,000 CVE records was saved locally. Each record in the dataset includes a unique CVE identifier, a textual description of the vulnerability, the affected products (software or hardware impacted by the vulnerability), severity metrics (including CVSS scores), weaknesses (the underlying root causes categorized by the Common Weakness Enumeration (CWE) taxonomy, such as buffer overflow, injection, or improper input validation), references to external advisories, patches, or documentation, and metadata such as resultsPerPage, startIndex, totalResults, and the API version. The collection process was automated by building a pipeline, that extracted, formatted, and stored the data for later ingestion into the knowledge graph. This pipeline guarantees reproducibility and allows simple updates when new CVEs are published. Since CVE records can contain multiple versions of CVSS metrics, the ingestion process prioritizes CVSS v3.1 if available, followed by CVSS v3.0 and CVSS v2 as fallback options. This hierarchical selection strategy ensures the use of the most recent and expressive severity metrics. Furthermore, separation between data acquisition and graph ingestion enables the system to scale naturally. New CVE batches may be retrieved and integrated without the need to rebuild the entire graph,
making this approach suitable for continuous vulnerability monitoring scenarios. Knowledge Graph Design: Important cybersecurity entities were modeled as nodes in the knowledge graph, with their semantic relationships represented as edges. The design follows the Labeled Property Graph (LPG) paradigm [11], which is supported by graph database systems like Neo4j. Each node type contains specific properties, while edges specify how nodes relate to one another. Global Knowledge Graph Overview: To provide a comprehensive understanding of the overall structure, Figure 1 presents a global view of the cybersecurity knowledge graph. The graph illustrates the main entities involved in vulnerability management, including CVEs, affected products, vendors, severity metrics, weakness categories (CWE), and external references, along with the relationships that connect them. This global representation highlights how vulnerabilities are linked to impacted products and vendors, how their severity is characterized through standardized metrics, and how they are associated with underlying weakness categories and external documentation. The holistic view serves as a foundation for efficient knowledge exploration and pattern-based querying using Neo4j.
Fig. 1. Global structure of the cybersecurity knowledge graph
a) Graph Database and Storage Technology (Neo4j): The constructed knowledge graph is stored and managed using Neo4j, a native graph database management system that supports the Labeled Property Graph (LPG) model, in which nodes and relationships can carry labels and properties [10]. Neo4j is suited for cybersecurity applications since it efficiently represents complex relationships between vulnerabilities, affected products, vendors, and weakness categories. Its declarative query language, Cypher, handles expressive pattern-based queries, facilitating vulnerability analysis and scalable integration of recently released CVE records from the National Vulnerability Database (NVD). b) Nodes (Entities): The primary entities represented as nodes in the graph include CVE, Metric, Product, Vendor, CWE, and Reference. A CVE node represents a unique security vulnerability, with properties
including id, description, publishedDate, and lastModifiedDate. A Metric node contains severity metrics based on the CVSS scoring system, storing properties such as baseScore and vector. Product nodes denote the software or hardware impacted by a given CVE, with a property for the product name, while Vendor nodes represent the entity responsible for a product, storing the vendor name. CWE nodes model vulnerability root causes using the Common Weakness Enumeration (CWE) taxonomy; each CVE is linked to one or more CWE nodes representing its underlying weakness type. This allows vulnerabilities to be grouped and analyzed based on common design or implementation flaws rather than isolated identifiers. Finally, Reference nodes capture external references associated with CVEs, such as vendor advisories, security bulletins, and documentation links, modeling them as first-class entities. This design choice enables multiple vulnerabilities to reference the same external source and supports traceability between vulnerabilities and mitigation guidance. CVE (Vulnerability)
HAS METRIC
Metric (Severity Scores)
Aura, the managed cloud offering of Neo4j, introduces an AIassisted search mechanism to translate natural language into Cypher queries, bridging the gap for users not proficient in graph-specific syntax. This paper examines this feature, focusing on its conceptual mechanism, capabilities, and inherent limitations, particularly when dealing with complex or dense knowledge graphs. The feature is well suited for exploratory analysis and educational use but reveals limitations when faced with complex, multi-hop relationship reasoning. NL Query (Input)
LLM / Semantic Parser
Graph Schema Metadata
Cypher Query (Generated)
Fig. 2. CVE connected to its severity metrics. Neo4j Engine (Execution) CVE (Vulnerability)
Graph Result (Nodes / Relations)
AFFECTS
Fig. 6. Conceptual Pipeline of Neo4j Aura’s AI-Assisted Search Product (Software/Hardware)
OWN
Vendor (Owner)
Fig. 3. CVE affecting products and their corresponding vendors.
CVE (Vulnerability)
HAS WEAKNESS
CWE (Weakness Category)
Fig. 4. CVE associated with its weakness category (CWE).
CVE (Vulnerability)
HAS LINK TO
Reference (External Docs)
Fig. 5. CVE connected to external documentation or advisories.
c) Relationships (Edges): B. Graph Interrogation Using Natural Language The increasing adoption of knowledge graphs has highlighted the need for more accessible querying tools. Neo4j
Conceptual Mechanism of AI Search: The Large Language Model (LLM) interprets the Natural Language (NL) input, using the Graph Schema Metadata to constrain the output and generate a valid Cypher query (Semantic Parsing). Before discussing natural language querying, it is useful to briefly outline how Neo4j Aura enables AI-assisted search at a conceptual level . Although the internal implementation details are not publicly disclosed, the AI search feature can be understood as a pipeline that combines schema awareness with large language model–based query generation . The system has access to metadata about node labels, relationship types, and properties defined in the graph schema . When a user provides a natural language query, this input is interpreted in the context of the schema and mapped to an equivalent Cypher query that aims to retrieve the requested information . This process resembles semantic parsing, where unstructured text is transformed into a structured query language, with constraints imposed by the graph model to reduce ambiguity and invalid queries . Cloud Deployment of an Existing Knowledge Graph: Once the knowledge graph has been developed and validated locally, deploying it to Neo4j Aura Cloud requires only minimal modifications. The data model, constraints, and Cypher scripts remain unchanged. The main difference lies in the connection configuration. Instead of connecting to a local Neo4j instance,
the application or script must be configured to use the URI, username, and password associated with the Neo4j Aura instance. To obtain these credentials, a new Aura database instance must first be created through the Neo4j Aura console. After creation, selecting the Connect option and navigating to the Developer Hub, then choosing Python, provides the exact connection details required. By replacing the local connection parameters with these cloud credentials and executing the same ingestion script described in the previous document, the database is populated in the Aura environment without further changes.
C. Code and Reproducibility Resources All source code, data preprocessing scripts, Cypher queries, and the final version of this article are publicly available in the project repository: https://github.com/NadaHaddad/graph security
This repository provides full reproducibility for data ingestion, graph construction, AI versus expert query evaluation, and all experiments presented in this work. III. R ESULTS The resulting knowledge graph successfully represents vulnerability data as interconnected entities. Neo4j enables efficient traversal of relationships, allowing complex queries that would be difficult to express using relational databases. Natural language querying further improves usability by allowing users to retrieve information without writing Cypher queries manually. Table II summarizes the results. TABLE II E VALUATION OF AI- GENERATED C YPHER QUERIES USING NATURAL LANGUAGE PROMPTS . ID 1 2
Fig. 7. Query through Neo4j built in natural language processor
3 4 5 6 7 8 9 10
Natural Language Interface for Graph Exploration: After the database has been successfully deployed, Neo4j Aura provides an interface for querying the graph using natural language. This functionality is accessible through the Explore tab of the Aura console. Within the search input field, users can enable the AI search option, which allows them to express queries in plain English rather than Cypher. The user simply describes the information they wish to retrieve, and the system automatically generates the corresponding Cypher query. For example, a query requesting all entities related to a given node type or a specific relationship pattern can be expressed in natural language, and the generated Cypher can be inspected, refined, or executed directly. Limitations of AI-Assisted Natural Language Queries: Despite its convenience, the AI-assisted natural language querying feature has notable limitations. In practice, it performs best for relatively simple retrieval tasks involving a small number of node types and relationships. The quality of the generated Cypher may degrade as queries grow more complex, particularly when multiple hops, aggregations, or intricate relationship constraints are involved. The system may produce incomplete queries, omit necessary constraints, or misinterpret the intended traversal 1 of the graph. This limitation is particularly evident in dense knowledge graphs where many node labels and relationships coexist, increasing semantic ambiguity in natural language descriptions.
Natural Language Prompt Show the top 10 vendors with the most CVEs. List the CVEs with a base score of 9.0 or higher and show the affected products. Find CVEs that affect products from more than one vendor. Show the number of CVEs published each year. List the top 5 most frequent CWE weakness categories in the database. Find all CVEs that have a reference link containing the word “github”. List CVEs that do not have an associated severity metric. List all products affected by the CVE “CVE-1999-0002”. Show all CVEs published in 1999 that mention the word “buffer” in the description. For each vendor, show how many products they own and how many CVEs affect those products.
Result Partial Partial Success Partial Partial Success Success Success Success Partial
Note: “Partial” indicates that the generated Cypher query was syntactically valid but required minor corrections to achieve full semantic correctness. A. Evaluation of AI-Generated Cypher Queries To assess the reliability of Neo4j Aura’s AI-assisted natural language querying, we designed an experiment consisting of ten representative prompts covering simple retrieval tasks, multi-hop traversals, aggregations, and filtering operations. For each prompt, the Cypher query generated by the AI was compared against a hand-crafted expert query and evaluated based on correctness, completeness, and schema alignment. Overall, the system performed remarkably well on direct one-hop traversals (e.g., retrieving affected products or listing CVEs with specific attributes), consistently producing correct Cypher queries without requiring manual refinement. Prompts involving aggregation or filtering also yielded accurate outputs, demonstrating that the model handles common analytical patterns such as COUNT, ORDER BY, and substring extraction. Performance decreased slightly for structurally complex prompts requiring multi-hop reasoning or multi-level grouping, where the AI occasionally omitted distinguishing constraints (e.g., unique vendor counts). Nevertheless, even in these cases, the generated queries remained syntactically valid and required
only minimal adjustments. These observations confirm that natural language interfaces significantly improve the accessibility of knowledge graph querying, while highlighting their current limitations for deeply compositional graph patterns. These observations provide a concrete foundation for the broader implications and limitations discussed in the following section. IV. D ISCUSSION The proposed approach demonstrates the advantages of combining knowledge graphs with natural language interfaces for cybersecurity analysis, improving accessibility for users who are not yet proficient in Cypher. In practice, the natural language querying capabilities provided by Neo4j Aura are well suited for exploratory analysis, basic retrieval tasks, and educational use cases. However, the accuracy and reliability of the generated queries depend strongly on the quality of the underlying graph schema and the language model’s understanding of domain-specific terminology. As query complexity increases, particularly in the presence of multi-hop relationships or dense graph structures, manual Cypher queries or programmatic approaches remain more reliable and may require user refinement. A promising direction for future work would involve integrating external natural language processing pipelines, such as Python-based scripts interacting with large language model APIs, to enable finer control over prompt engineering, schema grounding, and query validation, potentially mitigating some of the limitations observed in the built-in AIassisted search. V. C ONCLUSION This paper presented CyberGraph, a cybersecurity knowledge graph constructed from publicly available vulnerability data and queried through natural language. By combining the graph-based capabilities of Neo4j with the use of large language models to make a Cypher query from natural language, the proposed approach facilitates vulnerability exploration and provides a more intuitive means of analyzing complex cybersecurity information. The results highlight the potential of this integration to improve access to structured vulnerability knowledge and support analytical tasks in a more user-friendly manner. Future work will investigate the enrichment of CyberGraph with heterogeneous cybersecurity sources, including threat intelligence feeds, attack pattern repositories, and remediation knowledge, in order to improve both coverage and contextualization. Another important direction concerns the evaluation and enhancement of natural language query translation, particularly through the design of domain-specific prompting strategies, schema-aware reasoning, and benchmark-based performance assessment. R EFERENCES [1] Kamal Benzekki and Mohamed-Lamine Messai. Empowering cybersecurity analysis: Unifying cve, cwe, and cpe through knowledge graphs. Computers & Security, 160:104726, 2026.
[2] Tomaž Bratanic. Graph Algorithms for Data Science: With Examples in Neo4j. Simon and Schuster, 2024. [3] Paolo Falcarin and Fabio Dainese. Building a cybersecurity knowledge graph with cybergraph. In Proceedings of the 2024 ACM/IEEE 4th International Workshop on Engineering and Cybersecurity of Critical Systems (EnCyCriS) and 2024 IEEE/ACM Second International Workshop on Software Vulnerability, pages 29–36. IEEE, 2024. [4] Aidan Hogan, Eva Blomqvist, Michael Cochez, et al. Knowledge graphs. ACM Computing Surveys (CSUR), 54(4):1–37, 2021. [5] Anders Høst, Pierre Lison, and Leon Moonen. Constructing a knowledge graph from textual descriptions of software vulnerabilities in the national vulnerability database. In Proceedings of the 24th Nordic Conference on Computational Linguistics (NoDaLiDa), pages 386–391, 2023. [6] Yan Jia, Yulu Qi, Huaijun Shang, et al. A practical approach to constructing a knowledge graph for cybersecurity. Engineering, 4(1):53– 60, 2018. [7] Hongyi Li, Ze Shi, Chengwei Pan, et al. Cybersecurity knowledge graphs construction and quality assessment. Complex & Intelligent Systems, 10(1):1201–1217, 2024. [8] MITRE Corporation. Common Vulnerabilities and Exposures (CVE). https://cve.mitre.org/, 2024. Accessed: 2024. [9] National Institute of Standards and Technology. National Vulnerability Database. https://nvd.nist.gov/, 2024. [10] Neo4j, Inc. Neo4j Documentation. https://neo4j.com/docs/, 2024. [11] Neo4j, Inc. Neo4j Graph Database Platform. https://neo4j.com/ developer/graph-database/, 2024. [12] Ian Robinson, Jim Webber, and Emil Eifrem. Graph Databases: New Opportunities for Connected Data. O’Reilly Media, Inc., 2015. [13] Xiaojuan Zhao, Rong Jiang, Yue Han, Aiping Li, and Zhichao Peng. A survey on cybersecurity knowledge graph construction. Computers & Security, page 103524, 2023.