Transforming Vulnerability Management with Advanced Dependency Knowledge Graphs
summary
VDGraph merges CycloneDX SBOMs and OSV scan outputs into a Neo4j knowledge graph that is queryable and complete, built from automation over 100+ Maven projects and other JavaScript/Go repos. Import of the largest graph (≈2,800 nodes, 5,100 relationships) completes in under 2 seconds, queries run <1s, and analyses reveal surprising counts like 15 million distinct dependency paths to a Commons‑IO vulnerability and that most vulnerabilities sit at depth ≥3. The tool also generates optimized direct‑dependency upgrades and flags when no fix exists using the CycloneDX Maven plugin and OSV-Scanner.
AI-written summary · about
chapters (7)
- 0:00Vulnerability dependency graphs
- 2:29Software supply chain layers
- 10:14Dependency and vulnerability data
- 14:03Querying dependency graph
- 17:56Vulnerability remediation strategies
- 22:52Graph queries and future support
- 25:20Q&A
related talks
20mEfficient Static Vulnerability Analysis for JavaScript with Multiversion Dependency Graphs
39mUsing GraphDB Technology to Resolve Transitive Vulnerabilities at Scale
54mSupply Chain Sec /w Dependency Track
26mKnow Your Dependencies: A Guide to Automating Dependency Assurance
47mI Can’t Cope! How OWASP Is Helping To Manage Vulnerability Overload
24mDependency Track Fortifying The Supply Chain
40mDependency Management: The Cause of—and Solution to—All Supply...
31mSix Degrees of Infiltration