AI-powered network vulnerability scanning with semantic CVE retrieval.
Recall@5: 87.5% · 105,210 CVEs · Hybrid Retrieval · OpenVINO XPU
CVEye is an AI-powered semantic CVE scanner that maps network service fingerprints to likely vulnerabilities using modern information retrieval instead of static signature matching.
It combines:
- nmap for service discovery
- SecureBERT 2.0 for semantic embedding
- BM25 for lexical filtering
- FAISS HNSW for fast vector search
- Intel OpenVINO for accelerated inference on Intel hardware
The result is a practical vulnerability intelligence pipeline for home labs, enterprise services, VPN appliances, and container infrastructure.
Traditional scanners depend heavily on exact signatures and version rules. CVEye explores a different direction: semantic vulnerability retrieval, where a discovered service is transformed into a security-focused query and matched against a large CVE corpus.
That makes this project useful for:
- AI-powered vulnerability research
- semantic search over NVD data
- cyber security engineering portfolios
- retrieval system benchmarking in security domains
- nmap-based service discovery for hosts, ports, and versions
- Semantic CVE retrieval over the NVD vulnerability corpus
- Two-stage hybrid search using BM25 candidate filtering and dense reranking
- FAISS HNSW index for scalable similarity search
- Intel OpenVINO XPU acceleration for fast inference
- Evaluation pipeline with Recall@1, Recall@3, and Recall@5
- Temporal sanity filtering to reduce obviously invalid matches
- Fallback emergency CVE database when a full local index is unavailable
nmap recon
-> service fingerprint extraction
-> semantic query building
-> SecureBERT embedding
-> BM25 candidate filtering
-> dense cosine reranking with FAISS
-> top-k CVE reporting
- Discover services on the target host or subnet.
- Convert service banners into security-oriented semantic queries.
- Retrieve BM25 candidates from the CVE corpus.
- Rerank them with dense embeddings.
- Produce a scored CVE report with confidence signals.
Evaluation was run on 48 ground-truth service-to-CVE pairs across 8 categories.
| Metric | Score |
|---|---|
| Recall@1 | 41.7% |
| Recall@3 | 66.7% |
| Recall@5 | 87.5% |
- Kubernetes & Containers: 100% Recall@3
- Home / Lab Network: 80% Recall@3
- VPN & Network Infrastructure: 80% Recall@3
- Industrial / SCADA: weakest current area, good candidate for future tuning
Semantic retrieval achieves 87.5% Recall@5 across a corpus of 105,210 CVEs, dramatically outperforming random retrieval.
| Layer | Technology |
|---|---|
| Recon | nmap |
| Embedding | SecureBERT 2.0 |
| Inference | Intel OpenVINO |
| Lexical Retrieval | BM25 |
| Vector Search | FAISS HNSW |
| Data Source | NVD API v2.0 |
| Language | Python |
semantic-cve-scanner/
├── main.py
├── retriever.py
├── model_loader.py
├── build_nvd_db.py
├── eval.py
├── patch_index.py
├── similarity_probe.py
├── requirements.txt
├── .env.example
├── SECURITY.md
├── LICENSE
├── logo.jpg
└── data/
git clone https://github.com/parastak/NeuralRecon-Semantic-Cve-Scanner.git
cd semantic-cve-scanner
python -m venv venv
source venv/bin/activate
pip install -r requirements.txtexport NVD_API_KEY="your-key-here"python build_nvd_db.pypython main.pypython main.py 127.0.0.1sudo env PATH="$PATH" python main.py 10.0.0.1 --top-k 5sudo env PATH="$PATH" python main.py 10.0.0.0/24 --top-k 5python eval.py --verboseUse this tool only on systems you own or for which you have explicit written authorization. Unauthorized network scanning may be illegal and unethical.
Do not upload scan reports, local datasets, API keys, or generated network intelligence files to public repositories.
MIT
Paras Tak
If this project is useful, give it a star and share it with the security and ML community.