{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,8,24]],"date-time":"2026-08-24T20:22:00Z","timestamp":1787602920920,"version":"build-2736575974"},"reference-count":40,"publisher":"Wiley","issue":"5","license":[{"start":{"date-parts":[[2026,5,18]],"date-time":"2026-05-18T00:00:00Z","timestamp":1779062400000},"content-version":"vor","delay-in-days":0,"URL":"http:\/\/creativecommons.org\/licenses\/by\/4.0\/"},{"start":{"date-parts":[[2026,5,18]],"date-time":"2026-05-18T00:00:00Z","timestamp":1779062400000},"content-version":"tdm","delay-in-days":0,"URL":"http:\/\/doi.wiley.com\/10.1002\/tdm_license_1.1"}],"content-domain":{"domain":["incose.onlinelibrary.wiley.com"],"crossmark-restriction":true},"short-container-title":["Systems Engineering"],"published-print":{"date-parts":[[2026,9]]},"abstract":"<jats:title>ABSTRACT<\/jats:title>\n                  <jats:p>The Common Vulnerabilities and Exposures (CVE) Program's mission is to identify, define, and catalog publicly disclosed cybersecurity vulnerabilities. A cybersecurity practitioner who suspects a software, hardware, or service vulnerability, can initiate a CVE\u2010ID Requesting process, as defined by MITRE. This process is cumbersome, as it is entirely textual and evolvable, making it prone to incomplete description and misinterpretations. To automate and streamline the process, we developed a model of this process using Object\u2010Process Methodology (OPM ISO 19450:2024). The model features computational capabilities, enabling practitioners to feed a textual description of the potential vulnerability they wish to report for CVE\u2010ID Requesting. In response, the system provides all matching CVE Numbering Authority (CNA) instances in a descending relevance order. A survey that evaluates the effectiveness of this model\u2010based approach has shown that it formally explicates the CVE\u2010ID Requesting process and automates it. This greatly alleviates the task of determining what CNA is best suitable for examining the potential CVE for which a number is sought. Beyond streamlining and automating the process, this work demonstrates the benefits of adopting an approach to cybersecurity that standardizes and formulates global cybersecurity processes and systems. The approach facilitates the way professionals navigate their way in the complex, evolving web of hardware and software vulnerabilities.<\/jats:p>","DOI":"10.1002\/sys.70064","type":"journal-article","created":{"date-parts":[[2026,5,19]],"date-time":"2026-05-19T05:48:16Z","timestamp":1779169696000},"page":"936-948","update-policy":"https:\/\/doi.org\/10.1002\/crossmark_policy","source":"Crossref","is-referenced-by-count":0,"title":["Model\u2010Based Cybersecurity: Automating Common Vulnerabilities Reporting"],"prefix":"10.1002","volume":"29","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-6642-6499","authenticated-orcid":false,"given":"Ahmad","family":"Jbara","sequence":"first","affiliation":[{"name":"Faculty of Data and Decision Sciences, Technion Israel Institute of Technology  Hafia Israel"},{"name":"School of Computer Science Netanya Academic College  Netanya Israel"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-2393-3124","authenticated-orcid":false,"given":"Dov","family":"Dori","sequence":"additional","affiliation":[{"name":"Faculty of Data and Decision Sciences, Technion Israel Institute of Technology  Hafia Israel"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"311","published-online":{"date-parts":[[2026,5,18]]},"reference":[{"key":"e_1_2_11_2_1","unstructured":"\u201cMITRE CVE Program \u201d accessed June 30 2022 https:\/\/cve.mitre.org\/."},{"key":"e_1_2_11_3_1","doi-asserted-by":"publisher","DOI":"10.1109\/TSMC.2015.2406753"},{"key":"e_1_2_11_4_1","doi-asserted-by":"publisher","DOI":"10.1111\/j.1467\u20109280.1992.tb00034.x"},{"key":"e_1_2_11_5_1","doi-asserted-by":"crossref","unstructured":"D.Waltermire S.Quinn H.Booth K.Scarfone andD.Prisaca The Technical Specification for the Security Content Automation Protocol (SCAP)(NIST 2018) accessed June 30 2022 https:\/\/csrc.nist.gov\/pubs\/sp\/800\/126\/r3\/final.","DOI":"10.6028\/NIST.SP.800-126r3"},{"key":"e_1_2_11_6_1","unstructured":"NIST \u201cInformation Security Automation Program (ISAP) Automating Vulnerability Management Security Measurement and Compliance\u201d (2007) accessed June 30 2022 https:\/\/nvd.nist.gov\/scap\/docs\/ISAP.doc."},{"key":"e_1_2_11_7_1","unstructured":"\u201cNew CVE Program Website \u201d accessed June 30 2022 https:\/\/www.cve.org\/Media\/News\/item\/news\/2021\/09\/29\/Welcome\u2010to\u2010the\u2010New\u2010CVE."},{"key":"e_1_2_11_8_1","unstructured":"D.Dori ISO\/PAS 19450:2015 Automation Systems and Integration\u2014Object\u2010Process Methodology(2015) accessed June 30 2022 iso.org\/standard\/62274.html."},{"key":"e_1_2_11_9_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-56209-9"},{"key":"e_1_2_11_10_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-1-4939-3295-5"},{"key":"e_1_2_11_11_1","doi-asserted-by":"publisher","DOI":"10.1109\/TSE.2025.3537537"},{"key":"e_1_2_11_12_1","unstructured":"\u201cUnified Modeling Language\u201d (2017) accessed June 30 2022 https:\/\/www.omg.org\/spec\/UML\/2.5.1\/PDF."},{"key":"e_1_2_11_13_1","unstructured":"Object Management Group OMG Systems Modeling Language (OMG SysML) Version 1.6. Novermber2019 https:\/\/www.omg.org\/spec\/SysML\/1.6."},{"key":"e_1_2_11_14_1","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2019.2915917"},{"key":"e_1_2_11_15_1","doi-asserted-by":"publisher","DOI":"10.1002\/sat.1123"},{"key":"e_1_2_11_16_1","doi-asserted-by":"publisher","DOI":"10.1002\/sys.20185"},{"key":"e_1_2_11_17_1","doi-asserted-by":"publisher","DOI":"10.20935\/AL1918"},{"key":"e_1_2_11_18_1","first-page":"30","article-title":"Object\u2010Process Methodology, OPM ISO 19450 \u2013 OPCloud and the Evolution of OPM Modeling Tools","volume":"61","author":"Dori D.","year":"2018","journal-title":"System Engineering Letters, Project Performance International (PPI) SyEN"},{"key":"e_1_2_11_19_1","doi-asserted-by":"publisher","DOI":"10.1002\/j.2334\u20105837.2014.tb03161.x"},{"key":"e_1_2_11_20_1","doi-asserted-by":"crossref","unstructured":"D.Dori I.Reinhartz\u2010Berger andA.Sturm \u201cDeveloping Complex Systems With Object\u2010Process Methodology Using OPCAT \u201d inInternational Conference on Conceptual Modeling(2003) 570\u2013572. Lecture Notes in Computer Science vol 2813. Springer Berlin Heidelberg https:\/\/doi.org\/10.1007\/978\u20103\u2010540\u201039648\u20102_46.","DOI":"10.1007\/978-3-540-39648-2_46"},{"key":"e_1_2_11_21_1","unstructured":"D.Dori C.Linchevski andR.Manor \u201cOPCAT\u2013A Software Environment for Object\u2010Process Methodology Based Conceptual Modelling of Complex Systems \u201d inProceedings of the 1st International Conference on Modelling and Management of Engineering Processes(2010) 147\u2013151. Cambridge UK: University of Cambridge."},{"key":"e_1_2_11_22_1","doi-asserted-by":"publisher","DOI":"10.1002\/sys.21499"},{"key":"e_1_2_11_23_1","unstructured":"N.Levi\u2010Soskin R.Shaoul H.Kohen A.Jbara andD.Dori Model\u2010Based Diagnosis With FTTell: Assessing the Potential for Pediatric Failure to Thrive (FTT) During the Perinatal Stage (2019). Lecture Notes in Business Information Processing vol 359. Springer Cham https:\/\/doi.org\/10.1007\/978\u20103\u2010030\u201029608\u20107_4."},{"key":"e_1_2_11_24_1","doi-asserted-by":"publisher","DOI":"10.1177\/00187208211048384"},{"issue":"8","key":"e_1_2_11_25_1","first-page":"53","article-title":"Extending the Object\u2010Process Methodology to Handle Real\u2010Time Systems","volume":"11","author":"Peleg M.","year":"1999","journal-title":"Journal of Object\u2010Oriented Programming"},{"key":"e_1_2_11_26_1","doi-asserted-by":"publisher","DOI":"10.1016\/S0306\u20104379(02)00078\u20109"},{"key":"e_1_2_11_27_1","doi-asserted-by":"crossref","unstructured":"A.Sturm D.Dori andO.Shehory \u201cSingle\u2010Model Method for Specifying Multi\u2010Agent Systems \u201d inProceedings of the Second International Joint Conference on Autonomous Agents and Multiagent Systems(2003) 121\u2013128 https:\/\/doi.org\/10.1145\/860575.860595.","DOI":"10.1145\/860575.860595"},{"key":"e_1_2_11_28_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.is.2008.02.002"},{"key":"e_1_2_11_29_1","doi-asserted-by":"publisher","DOI":"10.1371\/journal.pone.0051430"},{"key":"e_1_2_11_30_1","doi-asserted-by":"publisher","DOI":"10.1023\/A:1016597410642"},{"key":"e_1_2_11_31_1","doi-asserted-by":"crossref","unstructured":"Y.Grobshtein V.Perelman E.Safra andD.Dori \u201cSystems Modeling Languages: OPM Versus SysML \u201d in2007 International Conference on Systems Engineering and Modeling(2007) 102\u2013109 https:\/\/doi.org\/10.1109\/ICSEM.2007.373339.","DOI":"10.1109\/ICSEM.2007.373339"},{"key":"e_1_2_11_32_1","unstructured":"R.SyedandH.Zhong \u201cCybersecurity Vulnerability Management: An Ontology\u2010Based Conceptual Model\u201d (Americas Conference on Information Systems 2018)."},{"key":"e_1_2_11_33_1","doi-asserted-by":"publisher","DOI":"10.1109\/TKDE.2024.3474792"},{"key":"e_1_2_11_34_1","doi-asserted-by":"publisher","DOI":"10.1109\/JSYST.2022.3230097"},{"key":"e_1_2_11_35_1","doi-asserted-by":"crossref","unstructured":"M. M.Thwe Z. M.Belay E.Jee andD.\u2010H.Bae \u201cCybersecurity Vulnerability Identification in System\u2010of\u2010Systems Using Model\u2010Based Testing \u201d in2022 17th Annual System of Systems Engineering Conference (SOSE)(2022) 317\u2013322 https:\/\/doi.org\/10.1109\/SOSE55472.2022.9812676.","DOI":"10.1109\/SOSE55472.2022.9812676"},{"key":"e_1_2_11_36_1","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2024.3372771"},{"key":"e_1_2_11_37_1","unstructured":"M.GuoandJ. A.Wang \u201cAn Ontology\u2010Based Approach to Model Common Vulnerabilities and Exposures in Information Security \u201d inASEE Southest Section Conference p. 28 2009."},{"key":"e_1_2_11_38_1","doi-asserted-by":"crossref","unstructured":"L.Zhu Z.Zhang G.Xia andC.Jiang \u201cResearch on Vulnerability Ontology Model \u201d in2019 IEEE 8th Joint International Information Technology and Artificial Intelligence Conference (ITAIC)(2019) 657\u2013661 https:\/\/doi.org\/10.1109\/ITAIC.2019.8785783.","DOI":"10.1109\/ITAIC.2019.8785783"},{"key":"e_1_2_11_39_1","doi-asserted-by":"publisher","DOI":"10.1109\/JSYST.2020.3008857"},{"key":"e_1_2_11_40_1","volume-title":"Usability Engineering","author":"Nielsen J.","year":"1994"},{"key":"e_1_2_11_41_1","doi-asserted-by":"publisher","DOI":"10.1177\/1525822X05279903"}],"container-title":["Systems Engineering"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/incose.onlinelibrary.wiley.com\/doi\/pdf\/10.1002\/sys.70064","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/incose.onlinelibrary.wiley.com\/doi\/full-xml\/10.1002\/sys.70064","content-type":"application\/xml","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/incose.onlinelibrary.wiley.com\/doi\/pdf\/10.1002\/sys.70064","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,8,24]],"date-time":"2026-08-24T19:39:34Z","timestamp":1787600374000},"score":1,"resource":{"primary":{"URL":"https:\/\/incose.onlinelibrary.wiley.com\/doi\/10.1002\/sys.70064"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,5,18]]},"references-count":40,"journal-issue":{"issue":"5","published-print":{"date-parts":[[2026,9]]}},"alternative-id":["10.1002\/sys.70064"],"URL":"https:\/\/doi.org\/10.1002\/sys.70064","archive":["Portico"],"relation":{},"ISSN":["1098-1241","1520-6858"],"issn-type":[{"value":"1098-1241","type":"print"},{"value":"1520-6858","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026,5,18]]},"assertion":[{"value":"2025-07-29","order":0,"name":"received","label":"Received","group":{"name":"publication_history","label":"Publication History"}},{"value":"2026-05-11","order":2,"name":"accepted","label":"Accepted","group":{"name":"publication_history","label":"Publication History"}},{"value":"2026-05-18","order":3,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}