{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,2,1]],"date-time":"2026-02-01T11:07:17Z","timestamp":1769944037131,"version":"3.49.0"},"reference-count":35,"publisher":"Springer Science and Business Media LLC","issue":"S2","license":[{"start":{"date-parts":[[2020,3,2]],"date-time":"2020-03-02T00:00:00Z","timestamp":1583107200000},"content-version":"tdm","delay-in-days":0,"URL":"http:\/\/www.springer.com\/tdm"},{"start":{"date-parts":[[2020,3,2]],"date-time":"2020-03-02T00:00:00Z","timestamp":1583107200000},"content-version":"vor","delay-in-days":0,"URL":"http:\/\/www.springer.com\/tdm"}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":["Int J Syst Assur Eng Manag"],"published-print":{"date-parts":[[2020,7]]},"DOI":"10.1007\/s13198-020-00957-0","type":"journal-article","created":{"date-parts":[[2020,3,2]],"date-time":"2020-03-02T16:03:02Z","timestamp":1583164982000},"page":"289-300","update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":5,"title":["Two-phase methodology for prioritization and utility assessment of software vulnerabilities"],"prefix":"10.1007","volume":"11","author":[{"ORCID":"https:\/\/orcid.org\/0000-0003-4510-376X","authenticated-orcid":false,"given":"Misbah","family":"Anjum","sequence":"first","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Vernika","family":"Agarwal","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"P. K.","family":"Kapur","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Sunil Kumar","family":"Khatri","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"297","published-online":{"date-parts":[[2020,3,2]]},"reference":[{"issue":"5799","key":"957_CR1","doi-asserted-by":"publisher","first-page":"610","DOI":"10.1126\/science.1130992","volume":"314","author":"R Anderson","year":"2006","unstructured":"Anderson R, Moore T (2006) The economics of information security. Science 314(5799):610\u2013613","journal-title":"Science"},{"issue":"2","key":"957_CR2","doi-asserted-by":"publisher","first-page":"228","DOI":"10.1016\/0377-2217(86)90044-5","volume":"24","author":"J-P Brans","year":"1986","unstructured":"Brans J-P, Vincke P, Mareschal B (1986) How to select and how to rank projects: The PROMETHEE method. Eur J Oper Res 24(2):228\u2013238","journal-title":"Eur J Oper Res"},{"key":"957_CR3","doi-asserted-by":"publisher","first-page":"66","DOI":"10.1016\/j.jclepro.2013.06.046","volume":"98","author":"K Govindan","year":"2015","unstructured":"Govindan K, Rajendran S, Sarkis J, Murugesan P (2015) Multi criteria decision making approaches for green supplier evaluation and selection: a literature review. J Clean Prod 98:66\u201383","journal-title":"J Clean Prod"},{"issue":"7","key":"957_CR4","doi-asserted-by":"publisher","first-page":"1037","DOI":"10.1016\/S0898-1221(03)90117-9","volume":"46","author":"S Ho","year":"2003","unstructured":"Ho S, Xie M, Goh T (2003) A study of the connectionist models for software reliability prediction. Comput Math Appl 46(7):1037\u20131045","journal-title":"Comput Math Appl"},{"issue":"11","key":"957_CR5","doi-asserted-by":"publisher","first-page":"2822","DOI":"10.1016\/j.jss.2013.06.040","volume":"86","author":"C-C Huang","year":"2013","unstructured":"Huang C-C, Lin F-Y, Lin FY-S, Sun YS (2013) A novel approach to evaluate software vulnerability prioritization. J Syst Softw 86(11):2822\u20132840","journal-title":"J Syst Softw"},{"key":"957_CR6","doi-asserted-by":"publisher","first-page":"18","DOI":"10.1016\/j.omega.2014.05.001","volume":"49","author":"A Jessop","year":"2014","unstructured":"Jessop A (2014) IMP: a decision aid for multiattribute evaluation using imprecise weight estimates. Omega 49:18\u201329","journal-title":"Omega"},{"key":"957_CR7","unstructured":"Jimenez W, Mammar A, Cavalli A (2009) Software vulnerabilities, prevention and detection methods: a review 1. In: Security in model-driven architecture, pp 6\u201313"},{"issue":"1","key":"957_CR8","doi-asserted-by":"publisher","first-page":"23","DOI":"10.1007\/s41872-017-0003-y","volume":"6","author":"Y Kansal","year":"2017","unstructured":"Kansal Y, Kapur P, Kumar U, Kumar D (2017) User-dependent vulnerability discovery model and its interdisciplinary nature. Life Cycle Reliab Saf Eng 6(1):23\u201329","journal-title":"Life Cycle Reliab Saf Eng"},{"key":"957_CR9","doi-asserted-by":"publisher","DOI":"10.1007\/978-0-85729-204-9","volume-title":"Software reliability assessment with OR applications","author":"P Kapur","year":"2011","unstructured":"Kapur P, Pham H, Gupta A, Jha P (2011) Software reliability assessment with OR applications. Springer, Berlin"},{"issue":"2","key":"957_CR10","doi-asserted-by":"publisher","first-page":"133","DOI":"10.1007\/s13198-014-0223-8","volume":"5","author":"P Kapur","year":"2014","unstructured":"Kapur P, Nagpal S, Khatri SK, Yadavalli VS (2014a) Critical Success Factor utility based tool for ERP health assessment: a general framework. Int J Syst Assur Eng Manag 5(2):133\u2013148","journal-title":"Int J Syst Assur Eng Manag"},{"key":"957_CR11","doi-asserted-by":"crossref","unstructured":"Kapur P, Singh G, Sachdeva N, Tickoo A (2014b) Measuring software testing efficiency using two-way assessment technique. In: Proceedings of 3rd international conference on reliability, Infocom technologies and optimization, IEEE","DOI":"10.1109\/ICRITO.2014.7014679"},{"issue":"4","key":"957_CR12","doi-asserted-by":"publisher","first-page":"645","DOI":"10.3846\/20294913.2011.635718","volume":"17","author":"V Ker\u0161ulien\u0117","year":"2011","unstructured":"Ker\u0161ulien\u0117 V, Turskis Z (2011) Integrated fuzzy multiple criteria decision making model for architect selection. Technol Econ Dev Econ 17(4):645\u2013666","journal-title":"Technol Econ Dev Econ"},{"issue":"1","key":"957_CR13","doi-asserted-by":"publisher","first-page":"21","DOI":"10.1016\/S0378-3758(97)00131-6","volume":"69","author":"WW Koczkodaj","year":"1998","unstructured":"Koczkodaj WW (1998) Testing the accuracy enhancement of pairwise comparisons by a Monte Carlo experiment. J Stat Plan Inference 69(1):21\u201331","journal-title":"J Stat Plan Inference"},{"issue":"3","key":"957_CR14","doi-asserted-by":"publisher","first-page":"264","DOI":"10.1016\/j.comcom.2010.04.006","volume":"34","author":"Q Liu","year":"2011","unstructured":"Liu Q, Zhang Y (2011) VRSS: a new system for rating and scoring vulnerabilities. Comput Commun 34(3):264\u2013273","journal-title":"Comput Commun"},{"issue":"8","key":"957_CR15","doi-asserted-by":"publisher","first-page":"1699","DOI":"10.1016\/j.jss.2012.03.057","volume":"85","author":"Q Liu","year":"2012","unstructured":"Liu Q, Zhang Y, Kong Y, Wu Q (2012) Improving VRSS-based vulnerability prioritization using analytic hierarchy process. J Syst Softw 85(8):1699\u20131708","journal-title":"J Syst Softw"},{"key":"957_CR16","doi-asserted-by":"crossref","unstructured":"Narang S, Kapur P, Damodaran D (2017) Severity measure of issues creating vulnerabilities in websites using two way assessment technique. In: 2017 International conference on Infocom technologies and unmanned systems (trends and future directions) (ICTUS), IEEE","DOI":"10.1109\/ICTUS.2017.8286024"},{"issue":"7\u20138","key":"957_CR17","doi-asserted-by":"publisher","first-page":"721","DOI":"10.1016\/j.mcm.2004.10.003","volume":"40","author":"DL Olson","year":"2004","unstructured":"Olson DL (2004) Comparison of weights in TOPSIS models. Math Comput Model 40(7\u20138):721\u2013727","journal-title":"Math Comput Model"},{"issue":"2","key":"957_CR18","doi-asserted-by":"publisher","first-page":"445","DOI":"10.1016\/S0377-2217(03)00020-1","volume":"156","author":"S Opricovic","year":"2004","unstructured":"Opricovic S, Tzeng G-H (2004) Compromise solution by MCDM methods: a comparative analysis of VIKOR and TOPSIS. Eur J Oper Res 156(2):445\u2013455","journal-title":"Eur J Oper Res"},{"key":"957_CR19","unstructured":"Ozkan S (1999) CVE details: the ultimate security vulnerability datasource, Technical report, Serkan Ozkan"},{"key":"957_CR20","unstructured":"\u00d6zkan S (2011) CVE details: the ultimate security vulnerability datasource\u2014vulnerabilities by type"},{"key":"957_CR21","doi-asserted-by":"publisher","first-page":"49","DOI":"10.1016\/j.omega.2014.11.009","volume":"53","author":"J Rezaei","year":"2015","unstructured":"Rezaei J (2015) Best-worst multi-criteria decision-making method. Omega 53:49\u201357","journal-title":"Omega"},{"key":"957_CR22","doi-asserted-by":"publisher","first-page":"49","DOI":"10.1007\/BF00134132","volume":"31","author":"B Roy","year":"1991","unstructured":"Roy B (1991) The outranking approach and the foundations of the ELECTRE methods. Theory Decis 31:49\u201373","journal-title":"Theory Decis"},{"key":"957_CR100","volume-title":"The analytic hierarchy process","author":"TL Saaty","year":"1980","unstructured":"Saaty TL (1980) The analytic hierarchy process. Mcgraw Hill, New York"},{"issue":"1","key":"957_CR23","doi-asserted-by":"publisher","first-page":"9","DOI":"10.1016\/0377-2217(90)90057-I","volume":"48","author":"TL Saaty","year":"1990","unstructured":"Saaty TL (1990) How to make a decision: the analytic hierarchy process. Eur J Oper Res 48(1):9\u201326","journal-title":"Eur J Oper Res"},{"key":"957_CR24","volume-title":"Decision making with dependence and feedback: the analytic network process","author":"TL Saaty","year":"1996","unstructured":"Saaty TL (1996) Decision making with dependence and feedback: the analytic network process. RWS Publ, Pittsburgh"},{"key":"957_CR25","volume-title":"Responding to computer security incidents","author":"E Schultz","year":"1990","unstructured":"Schultz E, Brown D, Longstaff T (1990) Responding to computer security incidents. Lawrence Livermore National Laboratory, Livermore"},{"key":"957_CR26","first-page":"405","volume-title":"Software vulnerability prioritization: a comparative study using TOPSIS and VIKOR techniques. System performance and management analytics","author":"R Sharma","year":"2019","unstructured":"Sharma R, Sibal R, Sabharwal S (2019) Software vulnerability prioritization: a comparative study using TOPSIS and VIKOR techniques. System performance and management analytics. Springer, Berlin, pp 405\u2013418"},{"issue":"1","key":"957_CR27","doi-asserted-by":"publisher","first-page":"57","DOI":"10.1007\/s41872-017-0006-8","volume":"6","author":"R Sibal","year":"2017","unstructured":"Sibal R, Sharma R, Sabharwal S (2017) Prioritizing software vulnerability types using multi-criteria decision-making techniques. Life Cycle Reliab Saf Eng 6(1):57\u201367","journal-title":"Life Cycle Reliab Saf Eng"},{"issue":"1\u20133","key":"957_CR28","doi-asserted-by":"publisher","first-page":"57","DOI":"10.1080\/19393555.2015.1051675","volume":"24","author":"G Spanos","year":"2015","unstructured":"Spanos G, Angelis L (2015) Impact metrics of security vulnerabilities: analysis and weighing. Inf Secur J A Glob Perspect 24(1\u20133):57\u201371","journal-title":"Inf Secur J A Glob Perspect"},{"key":"957_CR29","doi-asserted-by":"crossref","unstructured":"Spanos G, Sioziou A, Angelis L (2013) WIVSS: a new methodology for scoring information systems vulnerabilities. In: Proceedings of the 17th Panhellenic conference on informatics, ACM","DOI":"10.1145\/2491845.2491871"},{"issue":"4","key":"957_CR30","doi-asserted-by":"publisher","first-page":"273","DOI":"10.1037\/h0070288","volume":"34","author":"LL Thurstone","year":"1927","unstructured":"Thurstone LL (1927) A law of comparative judgment. Psychol Rev 34(4):273","journal-title":"Psychol Rev"},{"issue":"12","key":"957_CR31","first-page":"2034","volume":"5","author":"A Toloie-Eshlaghy","year":"2011","unstructured":"Toloie-Eshlaghy A, Homayonfar M, Aghaziarati M, Arbabiun P (2011) A subjective weighting method based on group decision making for ranking and measuring criteria values. Aust J Basic Appl Sci 5(12):2034\u20132040","journal-title":"Aust J Basic Appl Sci"},{"issue":"5","key":"957_CR32","doi-asserted-by":"publisher","first-page":"471","DOI":"10.1109\/TSE.2003.1199075","volume":"29","author":"M Xie","year":"2003","unstructured":"Xie M, Yang B (2003) A study of the effect of imperfect debugging on software development cost. IEEE Trans Softw Eng 29(5):471\u2013473","journal-title":"IEEE Trans Softw Eng"},{"issue":"3","key":"957_CR33","doi-asserted-by":"publisher","first-page":"587","DOI":"10.1016\/S0377-2217(00)00101-6","volume":"131","author":"X Xu","year":"2001","unstructured":"Xu X (2001) The SIR method: a superiority and inferiority ranking method for multiple criteria decision making. Eur J Oper Res 131(3):587\u2013602","journal-title":"Eur J Oper Res"},{"issue":"2","key":"957_CR34","doi-asserted-by":"publisher","first-page":"71","DOI":"10.1007\/s40595-016-0058-0","volume":"3","author":"M Zhu","year":"2016","unstructured":"Zhu M, Pham H (2016) A software reliability model with time-dependent fault detection and fault removal. Vietnam J Comput Sci 3(2):71\u201379","journal-title":"Vietnam J Comput Sci"}],"container-title":["International Journal of System Assurance Engineering and Management"],"original-title":[],"language":"en","link":[{"URL":"http:\/\/link.springer.com\/content\/pdf\/10.1007\/s13198-020-00957-0.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"http:\/\/link.springer.com\/article\/10.1007\/s13198-020-00957-0\/fulltext.html","content-type":"text\/html","content-version":"vor","intended-application":"text-mining"},{"URL":"http:\/\/link.springer.com\/content\/pdf\/10.1007\/s13198-020-00957-0.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2021,3,2]],"date-time":"2021-03-02T01:28:43Z","timestamp":1614648523000},"score":1,"resource":{"primary":{"URL":"http:\/\/link.springer.com\/10.1007\/s13198-020-00957-0"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2020,3,2]]},"references-count":35,"journal-issue":{"issue":"S2","published-print":{"date-parts":[[2020,7]]}},"alternative-id":["957"],"URL":"https:\/\/doi.org\/10.1007\/s13198-020-00957-0","relation":{},"ISSN":["0975-6809","0976-4348"],"issn-type":[{"value":"0975-6809","type":"print"},{"value":"0976-4348","type":"electronic"}],"subject":[],"published":{"date-parts":[[2020,3,2]]},"assertion":[{"value":"6 September 2019","order":1,"name":"received","label":"Received","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"31 January 2020","order":2,"name":"revised","label":"Revised","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"2 March 2020","order":3,"name":"first_online","label":"First Online","group":{"name":"ArticleHistory","label":"Article History"}},{"order":1,"name":"Ethics","group":{"name":"EthicsHeading","label":"Compliance with ethical standards"}},{"value":"The authors declare that they have no conflict of interest.","order":2,"name":"Ethics","group":{"name":"EthicsHeading","label":"Conflict of interest"}}]}}