A Real-Time IoT Vulnerability Detection Framework with Hybrid Discovery and CVE Correlation

The rapid growth of the Internet of Things (IoT) has expanded connectivity across smart homes, companies, and industries. However, these networks have become increasingly vulnerable to cyber threats. Due to the variety of protocols used, proprietary firmware, and unpredictable device behavior, vulnerability scanners such as Nmap, Nessus, and OpenVAS are often less effective at detecting IoT-specific vulnerabilities. To address these issues, this paper proposes a Real-Time IoT Vulnerability Scanner Framework that connects to the Common Vulnerabilities and Exposures (CVE) database to standardize threat correlation, perform hybrid vulnerability verification, and automatically identify connected devices. Once devices across various protocols are discovered through a hybrid approach that combines active probing and passive packet sniffing, the framework matches firmware and service banners with known vulnerabilities in the National Vulnerability Database (NVD) using a fuzzy CVE matching algorithm. An interactive dashboard displays vulnerability timelines, Common Vulnerability Scoring System (CVSS)-based severity ratings, and current device inventories. The system was tested and demonstrated to outperform existing tools in an experimental setup comprising more than 600 IoT and non-IoT devices. It achieved a precision of 0.94, a recall of 0.91, an F1-score of 0.92, and covered approximately 88% of vulnerabilities, with an average scan time of 1.4 s per device. These results demonstrate that the system offers high accuracy, low latency, and scalability for real-time IoT vulnerability monitoring.