{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,5,27]],"date-time":"2026-05-27T14:41:08Z","timestamp":1779892868590,"version":"3.53.1"},"publisher-location":"New York, NY, USA","reference-count":56,"publisher":"ACM","license":[{"start":{"date-parts":[[2022,5,16]],"date-time":"2022-05-16T00:00:00Z","timestamp":1652659200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2022,5,16]]},"DOI":"10.1145\/3524489.3527298","type":"proceedings-article","created":{"date-parts":[[2022,11,30]],"date-time":"2022-11-30T17:05:01Z","timestamp":1669827901000},"page":"1-8","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":12,"title":["Predicting the severity and exploitability of vulnerability reports using convolutional neural nets"],"prefix":"10.1145","author":[{"given":"Ahmet","family":"Okutan","sequence":"first","affiliation":[{"name":"Rochester Institute of Technology"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Mehdi","family":"Mirakhorli","sequence":"additional","affiliation":[{"name":"Rochester Institute of Technology"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"320","published-online":{"date-parts":[[2022,11,30]]},"reference":[{"key":"e_1_3_2_1_1_1","doi-asserted-by":"publisher","DOI":"10.1145\/3176258.3176340"},{"key":"e_1_3_2_1_2_1","doi-asserted-by":"publisher","DOI":"10.1145\/1835804.1835821"},{"key":"e_1_3_2_1_3_1","doi-asserted-by":"publisher","DOI":"10.1109\/SRDS.2012.4"},{"key":"e_1_3_2_1_4_1","volume-title":"Top CVE Threats of","author":"Cognyte CTI Research Group","year":"2021","unstructured":"Cognyte CTI Research Group. 2021. Top CVE Threats of 2021. https:\/\/www.cognyte.com\/blog\/cve_report_vulnerability_management\/. (Accessed on 1\/10\/2022)."},{"key":"e_1_3_2_1_5_1","volume-title":"Very Deep Convolutional Networks for Natural Language Processing. CoRR abs\/1606.01781","author":"Conneau Alexis","year":"2016","unstructured":"Alexis Conneau, Holger Schwenk, Lo\u00efc Barrault, and Yann LeCun. 2016. Very Deep Convolutional Networks for Natural Language Processing. CoRR abs\/1606.01781 (2016). arXiv:1606.01781 http:\/\/arxiv.org\/abs\/1606.01781"},{"key":"e_1_3_2_1_6_1","unstructured":"CVE Automation Working Group. 2022. CVE Automation Working Group Git Pilot. https:\/\/github.com\/CVEProject\/cvelist. (Accessed on 09\/03\/2020)."},{"key":"e_1_3_2_1_7_1","unstructured":"CveDetails.com. 2022. CVE Details The Ultimate Security Vulnerability Datasource. https:\/\/www.cvedetails.com\/vulnerabilities-by-types.php. (Accessed on 10\/26\/2020)."},{"key":"e_1_3_2_1_8_1","volume-title":"Towards the Detection of Inconsistencies in Public Security Vulnerability Reports. In 28th USENIX Security Symposium (USENIX Security 19)","author":"Dong Ying","year":"2019","unstructured":"Ying Dong, Wenbo Guo, Yueqi Chen, Xinyu Xing, Yuqing Zhang, and Gang Wang. 2019. Towards the Detection of Inconsistencies in Public Security Vulnerability Reports. In 28th USENIX Security Symposium (USENIX Security 19). USENIX Association, Santa Clara, CA, 869--885. https:\/\/www.usenix.org\/conference\/usenixsecurity19\/presentation\/dong"},{"key":"e_1_3_2_1_9_1","doi-asserted-by":"publisher","unstructured":"E. Doynikova and I. Kotenko. 2017. CVSS-based Probabilistic Risk Assessment for Cyber Situational Awareness and Countermeasure Selection. In 2017 25th Euromicro International Conference on Parallel Distributed and Network-based Processing (PDP). 346--353. 10.1109\/PDP.2017.44","DOI":"10.1109\/PDP.2017.44"},{"key":"e_1_3_2_1_10_1","unstructured":"exploit db.com. 2022. Exploit Database - Exploits for Penetration Testers Researchers and Ethical Hackers. https:\/\/www.exploit-db.com\/. (Accessed on 09\/01\/2021)."},{"key":"e_1_3_2_1_11_1","doi-asserted-by":"publisher","DOI":"10.1145\/948005.948050"},{"key":"e_1_3_2_1_12_1","doi-asserted-by":"crossref","unstructured":"Henning Femmer D. Fern\u00e1ndez S. Wagner and S. Eder. 2017. Rapid quality assurance with Requirements Smells. ArXiv abs\/1611.08847 (2017).","DOI":"10.1016\/j.jss.2016.02.047"},{"key":"e_1_3_2_1_13_1","unstructured":"First.org. 2015. Common Vulnerability Scoring System v3.0: Example Document. https:\/\/www.first.org\/cvss\/v3.0\/examples. (Accessed on 12\/03\/2020)."},{"key":"e_1_3_2_1_14_1","volume-title":"QoP '08","author":"Frigault M.","unstructured":"M. Frigault, Lingyu Wang, A. Singhal, and S. Jajodia. 2008. Measuring network security using dynamic bayesian network. In QoP '08."},{"key":"e_1_3_2_1_15_1","unstructured":"Ruslan Habalov and Timo Schmid. [n. d.]. Vulncode-DB. https:\/\/www.vulncode-db.com\/. (Accessed on 09\/02\/2020)."},{"key":"e_1_3_2_1_16_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICASSP.2017.7952132"},{"key":"e_1_3_2_1_17_1","volume-title":"Talos: Neutralizing Vulnerabilities with Security Workarounds for Rapid Response. In 2016 IEEE Symposium on Security and Privacy (SP). 618--635","author":"Huang Z.","unstructured":"Z. Huang, M. DAngelo, D. Miyani, and D. Lie. 2016. Talos: Neutralizing Vulnerabilities with Security Workarounds for Rapid Response. In 2016 IEEE Symposium on Security and Privacy (SP). 618--635."},{"key":"e_1_3_2_1_18_1","doi-asserted-by":"publisher","unstructured":"Robert Keeling Rishi Chhatwal Nathaniel Huber-Fliflet Jianping Zhang Fusheng Wei Haozhen Zhao Ye Shi and Han Qin. 2019. Empirical Comparisons of CNN with Other Learning Algorithms for Text Classification in Legal Document Review. 2038--2042. 10.1109\/BigData47090.2019.9006248","DOI":"10.1109\/BigData47090.2019.9006248"},{"key":"e_1_3_2_1_19_1","doi-asserted-by":"publisher","DOI":"10.3233\/IFS-151733"},{"key":"e_1_3_2_1_20_1","volume-title":"Convolutional Neural Networks for Sentence Classification. CoRR abs\/1408.5882","author":"Kim Yoon","year":"2014","unstructured":"Yoon Kim. 2014. Convolutional Neural Networks for Sentence Classification. CoRR abs\/1408.5882 (2014). arXiv:1408.5882 http:\/\/arxiv.org\/abs\/1408.5882"},{"key":"e_1_3_2_1_21_1","volume-title":"Proceedings of the 25th International Conference on Neural Information Processing Systems -","volume":"1","author":"Krizhevsky Alex","unstructured":"Alex Krizhevsky, Ilya Sutskever, and Geoffrey E. Hinton. 2012. ImageNet Classification with Deep Convolutional Neural Networks. In Proceedings of the 25th International Conference on Neural Information Processing Systems - Volume 1 (Lake Tahoe, Nevada) (NIPS'12). Curran Associates Inc., Red Hook, NY, USA, 1097--1105."},{"key":"e_1_3_2_1_22_1","unstructured":"Bill Ladd. 2017. The Race Between Security Professionals and Adversaries. https:\/\/www.recordedfuture.com\/vulnerability-disclosure-delay\/. (Accessed on 09\/02\/2020)."},{"key":"e_1_3_2_1_23_1","unstructured":"Bill Ladd. 2020. The Dragon Is Winning - U.S. Lags Behind Chinese Vulnerability Reporting. https:\/\/go.recordedfuture.com\/hubfs\/reports\/cta-2017-1019.pdf. (Accessed on 06\/30\/2020)."},{"key":"e_1_3_2_1_24_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.knosys.2019.04.013"},{"key":"e_1_3_2_1_25_1","volume-title":"25th USENIX Security Symposium (USENIX Security 16)","author":"Li Frank","year":"2016","unstructured":"Frank Li, Zakir Durumeric, Jakub Czyz, Mohammad Karami, Michael Bailey, Damon McCoy, Stefan Savage, and Vern Paxson. 2016. You've got vulnerability: Exploring effective vulnerability notifications. In 25th USENIX Security Symposium (USENIX Security 16). 1033--1050."},{"key":"e_1_3_2_1_26_1","doi-asserted-by":"publisher","DOI":"10.1145\/2872427.2883039"},{"key":"e_1_3_2_1_27_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP40000.2020.00038"},{"key":"e_1_3_2_1_28_1","volume-title":"In Proceedings of MetriSec'10","author":"Massacci Fabio","year":"2010","unstructured":"Fabio Massacci. 2010. Which is the right source for vulnerabilities studies? an empirical analysis on mozilla firefox. In In Proceedings of MetriSec'10. Citeseer, 1--8."},{"key":"e_1_3_2_1_29_1","unstructured":"Peter M. Mell K. Scarfone and Sasha Romanosky. 2007. A Complete Guide to the Common Vulnerability Scoring System Version 2.0 | NIST."},{"key":"e_1_3_2_1_30_1","unstructured":"MITRE. 2022. MITRE CVE Homepage. https:\/\/cve.mitre.org\/#. (Accessed on 12\/01\/2020)."},{"key":"e_1_3_2_1_31_1","unstructured":"MITRE Common Vulnerabilities and Exposures (CVE). 2022. CVE Working Group. https:\/\/cve.mitre.org\/working_groups.html. (Accessed on 09\/03\/2020)."},{"key":"e_1_3_2_1_32_1","volume-title":"Understanding the Reproducibility of Crowd-reported Security Vulnerabilities. In 27th USENIX Security Symposium (USENIX Security 18)","author":"Mu Dongliang","year":"2018","unstructured":"Dongliang Mu, Alejandro Cuevas, Limin Yang, Hang Hu, Xinyu Xing, Bing Mao, and Gang Wang. 2018. Understanding the Reproducibility of Crowd-reported Security Vulnerabilities. In 27th USENIX Security Symposium (USENIX Security 18). USENIX Association, Baltimore, MD, 919--936. https:\/\/www.usenix.org\/conference\/usenixsecurity18\/presentation\/mu"},{"key":"e_1_3_2_1_33_1","unstructured":"National Institute of Standards and Technology. 2022. Common Vulnerability Scoring System Calculator. https:\/\/nvd.nist.gov\/vuln-metrics\/cvss\/v3-calculator. (Accessed on 10\/26\/2020)."},{"key":"e_1_3_2_1_34_1","unstructured":"National Institute of Standards and Technology (NIST). 2022. Official Common Platform Enumeration (CPE) Dictionary. https:\/\/nvd.nist.gov\/products\/cpe. (Accessed on 10\/26\/2020)."},{"key":"e_1_3_2_1_35_1","unstructured":"National Vulnerability Database. 2020. NVD Dashboard. https:\/\/nvd.nist.gov\/general\/nvd-dashboard#. (Accessed on 10\/01\/2020)."},{"key":"e_1_3_2_1_36_1","unstructured":"National Vulnerability Database. 2020. NVD Data Feeds. https:\/\/nvd.nist.gov\/vuln\/data-feeds. (Accessed on 11\/15\/2020)."},{"key":"e_1_3_2_1_37_1","unstructured":"National Vulnerability Database. 2020. Product Integration with NVD CVSS Calculators. https:\/\/nvd.nist.gov\/vuln-metrics\/cvss. (Accessed on 11\/15\/2020)."},{"key":"e_1_3_2_1_38_1","doi-asserted-by":"publisher","DOI":"10.1145\/2484313.2484377"},{"key":"e_1_3_2_1_39_1","unstructured":"Ahmet Okutan and Mehdi Mirakhorli. 2022. Exploitability Analysis Datasets and Models. https:\/\/github.com\/SoftwareDesignLab\/exploitability_analysis."},{"key":"e_1_3_2_1_40_1","doi-asserted-by":"publisher","DOI":"10.1145\/1179494.1179502"},{"key":"e_1_3_2_1_41_1","unstructured":"riskbasedsecurity.com. 2022. VulnDB. https:\/\/vulndb.cyberriskanalytics.com\/. (Accessed on 09\/01\/2021)."},{"key":"e_1_3_2_1_42_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.aci.2017.12.002"},{"key":"e_1_3_2_1_43_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.aci.2017.12.002"},{"key":"e_1_3_2_1_44_1","volume-title":"Vulnerability Disclosure in the Age of Social Media: Exploiting Twitter for Predicting Real-World Exploits. In 24th USENIX Security Symposium (USENIX Security 15)","author":"Sabottke Carl","year":"2015","unstructured":"Carl Sabottke, Octavian Suciu, and Tudor Dumitras. 2015. Vulnerability Disclosure in the Age of Social Media: Exploiting Twitter for Predicting Real-World Exploits. In 24th USENIX Security Symposium (USENIX Security 15). USENIX Association, Washington, D.C., 1041--1056. https:\/\/www.usenix.org\/conference\/usenixsecurity15\/technical-sessions\/presentation\/sabottke"},{"key":"e_1_3_2_1_45_1","unstructured":"securityfocus.com. 2022. SecurityFocus. https:\/\/www.securityfocus.com\/. (Accessed on 09\/01\/2020)."},{"key":"e_1_3_2_1_46_1","volume-title":"The Top 10 Most Severe Vulnerabilities In","author":"Prime SOC","year":"2021","unstructured":"SOC Prime. 2022. The Top 10 Most Severe Vulnerabilities In 2021. https:\/\/www.cybersecurityintelligence.com\/blog\/top-10-most-severe-vulnerabilities-in-2021-6046.html. (Accessed on 1\/10\/2022)."},{"key":"e_1_3_2_1_47_1","volume-title":"Art Manion, and Deana Shick","author":"Spring Jonathan","year":"2018","unstructured":"Jonathan Spring, Eric Hatleback, Allen D. Householder, Art Manion, and Deana Shick. 2018. Towards Improving CVSS. https:\/\/resources.sei.cmu.edu\/library\/asset-view.cfm?assetid=538368. (Accessed on 12\/03\/2020)."},{"key":"e_1_3_2_1_48_1","unstructured":"The MathWorks Inc. 2020. Mamdani and Sugeno Fuzzy Inference Systems. https:\/\/www.mathworks.com\/help\/fuzzy\/types-of-fuzzy-inference-systems.html. (Accessed on 12\/09\/2020)."},{"key":"e_1_3_2_1_49_1","unstructured":"US National Vulnerability Dataabse. 2022. CVE-2011-1027 Detail. https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2011-1027. (Accessed on 1\/10\/2022)."},{"key":"e_1_3_2_1_50_1","unstructured":"US National Vulnerability Dataabse. 2022. CVE-2011-3696 Detail. https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2011-3696. (Accessed on 1\/10\/2022)."},{"key":"e_1_3_2_1_51_1","unstructured":"US National Vulnerability Dataabse. 2022. CVE-2011-3697 Detail. https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2011-3697. (Accessed on 1\/10\/2022)."},{"key":"e_1_3_2_1_52_1","unstructured":"US National Vulnerability Dataabse. 2022. CVE-2020-0796 Detail. https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2020-0796. (Accessed on 1\/10\/2022)."},{"key":"e_1_3_2_1_53_1","unstructured":"US National Vulnerability Dataabse. 2022. CVE-2021-22893 Detail. https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2021-22893. (Accessed on 1\/10\/2022)."},{"key":"e_1_3_2_1_54_1","unstructured":"US National Vulnerability Dataabse. 2022. CVE-2021-44228 Detail. https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2021-44228. (Accessed on 1\/10\/2022)."},{"key":"e_1_3_2_1_55_1","volume-title":"5th Workshop on Cyber Security Experimentation and Test (CSET 12)","author":"Vasek Marie","year":"2012","unstructured":"Marie Vasek and Tyler Moore. 2012. Do Malware Reports Expedite Cleanup? An Experimental Study.. In 5th Workshop on Cyber Security Experimentation and Test (CSET 12). USENIX Association, Bellevue, WA. https:\/\/www.usenix.org\/conference\/cset12\/workshop-program\/presentation\/Vasek"},{"key":"e_1_3_2_1_56_1","doi-asserted-by":"publisher","DOI":"10.5555\/2035368.2035388"}],"event":{"name":"ICSE '22: 44th International Conference on Software Engineering","location":"Pittsburgh Pennsylvania","acronym":"ICSE '22","sponsor":["SIGSOFT ACM Special Interest Group on Software Engineering","IEEE CS"]},"container-title":["Proceedings of the 3rd International Workshop on Engineering and Cybersecurity of Critical Systems"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3524489.3527298","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3524489.3527298","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,17]],"date-time":"2025-06-17T18:09:51Z","timestamp":1750183791000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3524489.3527298"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2022,5,16]]},"references-count":56,"alternative-id":["10.1145\/3524489.3527298","10.1145\/3524489"],"URL":"https:\/\/doi.org\/10.1145\/3524489.3527298","relation":{},"subject":[],"published":{"date-parts":[[2022,5,16]]},"assertion":[{"value":"2022-11-30","order":3,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}