{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,5,19]],"date-time":"2026-05-19T15:09:29Z","timestamp":1779203369464,"version":"3.51.4"},"reference-count":144,"publisher":"Association for Computing Machinery (ACM)","issue":"8","license":[{"start":{"date-parts":[[2024,4,26]],"date-time":"2024-04-26T00:00:00Z","timestamp":1714089600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"funder":[{"name":"National Science Foundation","award":["1909516"],"award-info":[{"award-number":["1909516"]}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":["ACM Comput. Surv."],"published-print":{"date-parts":[[2024,8,31]]},"abstract":"<jats:p>Knowing the exploitability and severity of software vulnerabilities helps practitioners prioritize vulnerability mitigation efforts. Researchers have proposed and evaluated many different exploitability assessment methods. The goal of this research is to assist practitioners and researchers in understanding existing methods for assessing vulnerability exploitability through a survey of exploitability assessment literature. We identify three exploitability assessment approaches: assessments based on original, manual Common Vulnerability Scoring System, automated Deterministic assessments, and automated Probabilistic assessments. Other than the original Common Vulnerability Scoring System, the two most common sub-categories are Deterministic, Program State based, and Probabilistic learning model assessments.<\/jats:p>","DOI":"10.1145\/3648610","type":"journal-article","created":{"date-parts":[[2024,3,20]],"date-time":"2024-03-20T12:10:00Z","timestamp":1710936600000},"page":"1-41","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":25,"title":["A Survey on Software Vulnerability Exploitability Assessment"],"prefix":"10.1145","volume":"56","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-5881-4619","authenticated-orcid":false,"given":"Sarah","family":"Elder","sequence":"first","affiliation":[{"name":"North Carolina State University, Raleigh, USA"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-4980-7350","authenticated-orcid":false,"given":"Md Rayhanur","family":"Rahman","sequence":"additional","affiliation":[{"name":"North Carolina State University, Raleigh, USA"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Gage","family":"Fringer","sequence":"additional","affiliation":[{"name":"North Carolina State University, Raleigh, USA"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0009-0008-8369-4293","authenticated-orcid":false,"given":"Kunal","family":"Kapoor","sequence":"additional","affiliation":[{"name":"North Carolina State University, Raleigh, USA"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-3300-6540","authenticated-orcid":false,"given":"Laurie","family":"Williams","sequence":"additional","affiliation":[{"name":"North Carolina State University, Raleigh, USA"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"320","published-online":{"date-parts":[[2024,4,26]]},"reference":[{"key":"e_1_3_3_2_2","doi-asserted-by":"publisher","DOI":"10.1145\/2976749.2978380"},{"key":"e_1_3_3_3_2","volume-title":"Proceedings of the 27th USENIX Security Symposium","author":"Alhuzali Abeer","year":"2018","unstructured":"Abeer Alhuzali, Rigel Gjomemo, Birhanu Eshete, and V. N. Venkatakrishnan. 2018. NAVEX: Precise and scalable exploit generation for dynamic web applications. In Proceedings of the 27th USENIX Security Symposium."},{"key":"e_1_3_3_4_2","doi-asserted-by":"publisher","DOI":"10.1145\/3176258.3176340"},{"key":"e_1_3_3_5_2","doi-asserted-by":"publisher","DOI":"10.1007\/s10664-019-09797-4"},{"key":"e_1_3_3_6_2","doi-asserted-by":"publisher","DOI":"10.1145\/2382416.2382427"},{"key":"e_1_3_3_7_2","doi-asserted-by":"publisher","DOI":"10.1145\/2630069"},{"key":"e_1_3_3_8_2","doi-asserted-by":"publisher","DOI":"10.1145\/3145574.3145590"},{"key":"e_1_3_3_9_2","doi-asserted-by":"publisher","DOI":"10.1109\/CYCONUS.2017.8167501"},{"key":"e_1_3_3_10_2","first-page":"319","volume-title":"Proceedings of the 16th Symposium on Usable Privacy and Security (SOUPS\u201920)","author":"Alomar Noura","year":"2020","unstructured":"Noura Alomar, Primal Wijesekera, Edward Qiu, and Serge Egelman. 2020. \u201cYou\u2019ve got your nice list of bugs, now what?\u201d Vulnerability discovery and management processes in the wild. In Proceedings of the 16th Symposium on Usable Privacy and Security (SOUPS\u201920). 319\u2013339."},{"key":"e_1_3_3_11_2","doi-asserted-by":"publisher","DOI":"10.1145\/3338501.3357365"},{"key":"e_1_3_3_12_2","volume-title":"Proceedings of the 18th Annual Network and Distributed System Security Symposium (NDSS\u201911).","author":"Avgerinos Thanassis","year":"2011","unstructured":"Thanassis Avgerinos, Sang Kil Cha, Brent Lim Tze Hao, and David Brumley. 2011. AEG: Automatic exploit generation. In Proceedings of the 18th Annual Network and Distributed System Security Symposium (NDSS\u201911)."},{"key":"e_1_3_3_13_2","doi-asserted-by":"publisher","DOI":"10.1145\/2560217.2560219"},{"key":"e_1_3_3_14_2","unstructured":"Bitdefender. n.d. What Is an Exploit? Exploit Prevention. Retrieved May 17 2023 from https:\/\/www.bitdefender.com\/consumer\/support\/answer\/10556\/"},{"key":"e_1_3_3_15_2","doi-asserted-by":"publisher","DOI":"10.1145\/1835804.1835821"},{"key":"e_1_3_3_16_2","doi-asserted-by":"publisher","DOI":"10.1145\/3041008.3041009"},{"key":"e_1_3_3_17_2","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2012.31"},{"key":"e_1_3_3_18_2","doi-asserted-by":"publisher","DOI":"10.1145\/3319535.3363212"},{"key":"e_1_3_3_19_2","unstructured":"Cisco. n.d. What Is an Exploit? Retrieved May 17 2023 from https:\/\/www.cisco.com\/c\/en\/us\/products\/security\/advanced-malware-protection\/what-is-exploit.html"},{"key":"e_1_3_3_20_2","unstructured":"Clarivate. 2023. Journal Citation Reports. Retrieved August 16 2023 from https:\/\/jcr.clarivate.com\/jcr\/home"},{"key":"e_1_3_3_21_2","doi-asserted-by":"publisher","DOI":"10.32604\/cmes.2021.010700"},{"key":"e_1_3_3_22_2","volume-title":"CVE Program (Website)","year":"2022","unstructured":"CVE. 2022. CVE Program (Website). Retrieved March 23, 2022 from https:\/\/www.cve.org\/"},{"key":"e_1_3_3_23_2","unstructured":"CVE Details. 2022. How Does It Work? Retrieved October 27 2022 from https:\/\/www.cvedetails.com\/how-does-it-work.php"},{"key":"e_1_3_3_24_2","volume-title":"Common Vulnerability Scoring System v3.0: User Guide","author":"(SIG) CVSS Special Interest Group","year":"2015","unstructured":"CVSS Special Interest Group (SIG). 2015. Common Vulnerability Scoring System v3.0: User Guide. Technical Report. Forum of Incident Response and Security Teams (FIRST). https:\/\/www.first.org\/cvss\/v3.0\/cvss-v30-user_guide_v1.6.pdf"},{"key":"e_1_3_3_25_2","volume-title":"Common Vulnerability Scoring System v3.0: Examples","author":"(SIG) CVSS Special Interest Group","year":"2017","unstructured":"CVSS Special Interest Group (SIG). 2017. Common Vulnerability Scoring System v3.0: Examples. Technical Report. Forum of Incident Response and Security Teams (FIRST). https:\/\/www.first.org\/cvss\/v3.0\/cvss-v30-examples_v1.5.pdf"},{"key":"e_1_3_3_26_2","volume-title":"Common Vulnerability Scoring System v3.1 Specification Document","author":"(SIG) CVSS Special Interest Group","year":"2019","unstructured":"CVSS Special Interest Group (SIG). 2019. Common Vulnerability Scoring System v3.1 Specification Document. Technical Report. Forum of Incident Response and Security Teams (FIRST). https:\/\/www.first.org\/cvss\/v3.1\/specification-document"},{"key":"e_1_3_3_27_2","volume-title":"Common Vulnerability Scoring System v3.1: User Guide","author":"(SIG) CVSS Special Interest Group","year":"2019","unstructured":"CVSS Special Interest Group (SIG). 2019. Common Vulnerability Scoring System v3.1: User Guide. Technical Report. Forum of Incident Response and Security Teams (FIRST). https:\/\/www.first.org\/cvss\/v3-1\/cvss-v31-user-guide_r1.pdf"},{"key":"e_1_3_3_28_2","article-title":"OSVDB: An independent and open source vulnerability database","author":"Day Brittany","year":"2003","unstructured":"Brittany Day. 2003. OSVDB: An independent and open source vulnerability database. LinuxSecurity (Web) (Dec.2003). Retrieved April 11, 2022 from https:\/\/linuxsecurity.com\/features\/osvdb-an-independent-and-open-source-vulnerability-database","journal-title":"LinuxSecurity (Web)"},{"key":"e_1_3_3_29_2","doi-asserted-by":"publisher","DOI":"10.1109\/SP46215.2023.10179447"},{"key":"e_1_3_3_30_2","doi-asserted-by":"publisher","DOI":"10.1155\/2020\/8883746"},{"key":"e_1_3_3_31_2","volume-title":"Probability and Statistics for Engineering and the Sciences (9th ed.)","author":"Devore Jay L.","year":"2014","unstructured":"Jay L. Devore. 2014. Probability and Statistics for Engineering and the Sciences (9th ed.). Cengage Learning."},{"key":"e_1_3_3_32_2","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2017.2769063"},{"key":"e_1_3_3_33_2","doi-asserted-by":"publisher","DOI":"10.1109\/TETC.2017.2785299"},{"key":"e_1_3_3_34_2","doi-asserted-by":"publisher","DOI":"10.1145\/1978672.1978683"},{"key":"e_1_3_3_35_2","volume-title":"Predicting Exploit Likelihood for Cyber Vulnerabilities with Machine Learning","author":"Edkrantz Michel","year":"2015","unstructured":"Michel Edkrantz. 2015. Predicting Exploit Likelihood for Cyber Vulnerabilities with Machine Learning. Master\u2019s Thesis. Chalmers University of Technology."},{"key":"e_1_3_3_36_2","volume-title":"Proceedings of the 13th Scandinavian Conference on Artificial Intelligence (SCAI\u201915)","author":"Edkrantz Michel","year":"2015","unstructured":"Michel Edkrantz and Alan Said. 2015. Predicting cyber vulnerability exploits with machine learning. In Proceedings of the 13th Scandinavian Conference on Artificial Intelligence (SCAI\u201915)."},{"key":"e_1_3_3_37_2","doi-asserted-by":"publisher","DOI":"10.1145\/3407023.3407038"},{"key":"e_1_3_3_38_2","doi-asserted-by":"publisher","DOI":"10.1023\/A:1009820201126"},{"key":"e_1_3_3_39_2","unstructured":"ExploitDB. 2022. Exploit Database History. Retrieved September 22 2022 from https:\/\/www.exploit-db.com\/history"},{"key":"e_1_3_3_40_2","unstructured":"Fortinet. n.d. Exploit Definition. Retrieved May 17 2023 from https:\/\/www.fortinet.com\/resources\/cyberglossary\/exploit"},{"key":"e_1_3_3_41_2","volume-title":"The EPSS Model (Website)","year":"2022","unstructured":"Forum of Incident Response and Security Teams (FIRST). 2022. The EPSS Model (Website). Forum of Incident Response and Security Teams (FIRST). https:\/\/www.first.org\/epss\/model"},{"key":"e_1_3_3_42_2","doi-asserted-by":"publisher","DOI":"10.1145\/1162666.1162671"},{"key":"e_1_3_3_43_2","doi-asserted-by":"publisher","DOI":"10.1007\/978-1-4419-6967-5_6"},{"key":"e_1_3_3_44_2","doi-asserted-by":"publisher","DOI":"10.1109\/ESEM.2009.5314230"},{"key":"e_1_3_3_45_2","volume-title":"Proceedings of the 2015 Conference on Mobile Security Technologies (MoST\u201915).","author":"Gallingani Daniele","year":"2015","unstructured":"Daniele Gallingani, Rigel Gjomemo, V. N. Venkatakrishnan, and Stefano Zanero. 2015. Static detection and automatic exploitation of intent message vulnerabilities in Android applications. In Proceedings of the 2015 Conference on Mobile Security Technologies (MoST\u201915)."},{"key":"e_1_3_3_46_2","doi-asserted-by":"publisher","DOI":"10.1109\/NTMS.2011.5720656"},{"key":"e_1_3_3_47_2","doi-asserted-by":"publisher","DOI":"10.1145\/3106237.3106286"},{"key":"e_1_3_3_48_2","doi-asserted-by":"publisher","DOI":"10.1145\/3274694.3274723"},{"key":"e_1_3_3_49_2","unstructured":"GII-GRIN-SCIE. 2022. The GII-GRIN-SCIE (GGS) Conference Rating. Retrieved August 16 2023 from https:\/\/scie.lcc.uma.es\/gii-grin-scie-rating\/conferenceRating.jsf"},{"key":"e_1_3_3_50_2","article-title":"Open-source vulnerabilities database shuts down","author":"Gold Jon","year":"2016","unstructured":"Jon Gold. 2016. Open-source vulnerabilities database shuts down. CSO Online (Web). Retrieved April 11, 2022 from https:\/\/www.csoonline.com\/article\/3053549\/open-source-vulnerabilities-database-shuts-down.html","journal-title":"CSO Online (Web)."},{"key":"e_1_3_3_51_2","doi-asserted-by":"publisher","DOI":"10.1109\/ICECCS.2019.00011"},{"key":"e_1_3_3_52_2","doi-asserted-by":"publisher","DOI":"10.1109\/ASE.2017.8115640"},{"key":"e_1_3_3_53_2","unstructured":"Shashank Hedge. 2019. Linux permissions: An introduction to chmod. Red Hat. Retrieved August 16 2023 from https:\/\/www.redhat.com\/sysadmin\/introduction-chmod"},{"key":"e_1_3_3_54_2","doi-asserted-by":"publisher","DOI":"10.1145\/2420950.2420981"},{"key":"e_1_3_3_55_2","volume-title":"Proceedings of the 27th USENIX Security Symposium (USENIX Security\u201918)","author":"Heelan Sean","year":"2018","unstructured":"Sean Heelan, Tom Melham, and Daniel Kroening. 2018. Automatic heap layout manipulation for exploitation. In Proceedings of the 27th USENIX Security Symposium (USENIX Security\u201918)."},{"key":"e_1_3_3_56_2","doi-asserted-by":"publisher","DOI":"10.1145\/3319535.3354224"},{"key":"e_1_3_3_57_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2015.04.012"},{"key":"e_1_3_3_58_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.jss.2013.06.040"},{"key":"e_1_3_3_59_2","doi-asserted-by":"publisher","DOI":"10.1109\/SERE.2012.20"},{"key":"e_1_3_3_60_2","doi-asserted-by":"publisher","DOI":"10.1109\/TR.2014.2299198"},{"key":"e_1_3_3_61_2","doi-asserted-by":"publisher","DOI":"10.1109\/ICPC52881.2021.00046"},{"key":"e_1_3_3_62_2","doi-asserted-by":"publisher","DOI":"10.1093\/cybsec\/tyaa015"},{"key":"e_1_3_3_63_2","doi-asserted-by":"publisher","DOI":"10.1145\/3436242"},{"key":"e_1_3_3_64_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.jnca.2021.103210"},{"key":"e_1_3_3_65_2","doi-asserted-by":"publisher","DOI":"10.1145\/3548606.3560575"},{"key":"e_1_3_3_66_2","first-page":"10","volume-title":"Proceedings of the 2011 International Conference on Security and Management (SAM\u201911)","author":"Joh HyunChul","year":"2011","unstructured":"HyunChul Joh and Yashwant K. Malaiya. 2011. Defining and assessing quantitative security risk measures using vulnerability lifecycle and CVSS metrics. In Proceedings of the 2011 International Conference on Security and Management (SAM\u201911). 10\u201316."},{"key":"e_1_3_3_67_2","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2016.2644614"},{"key":"e_1_3_3_68_2","doi-asserted-by":"publisher","DOI":"10.1145\/3533767.3534398"},{"key":"e_1_3_3_69_2","doi-asserted-by":"publisher","DOI":"10.1201\/b19467"},{"key":"e_1_3_3_70_2","doi-asserted-by":"crossref","unstructured":"Martijn Koster Gary Illyes Henner Zeller and Lizzi Sassman. 2022. Robots Exclusion Protocol. Retrieved September 6 2022 from https:\/\/www.rfc-editor.org\/rfc\/internet-drafts\/draft-koster-rep-12.html","DOI":"10.17487\/RFC9309"},{"key":"e_1_3_3_71_2","doi-asserted-by":"publisher","DOI":"10.3390\/s22041335"},{"key":"e_1_3_3_72_2","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-36563-8_13"},{"key":"e_1_3_3_73_2","article-title":"OSVDB shut down permanently","author":"Kovacs Eduard","year":"2016","unstructured":"Eduard Kovacs. 2016. OSVDB shut down permanently. Security Week (Web) (April2016). Retrieved April 11, 2022 from https:\/\/www.securityweek.com\/osvdb-shut-down-permanently","journal-title":"Security Week (Web)"},{"key":"e_1_3_3_74_2","doi-asserted-by":"publisher","DOI":"10.2307\/2529310"},{"key":"e_1_3_3_75_2","doi-asserted-by":"publisher","DOI":"10.1109\/CCST.2018.8585560"},{"key":"e_1_3_3_76_2","doi-asserted-by":"publisher","DOI":"10.1145\/3524842.3528433"},{"key":"e_1_3_3_77_2","article-title":"A survey on data-driven software vulnerability assessment and prioritization","author":"Le Triet H. M.","year":"2022","unstructured":"Triet H. M. Le, Huaming Chen, and M. Ali Babar. 2022. A survey on data-driven software vulnerability assessment and prioritization. ACM Computing Surveys.Just Accepted.","journal-title":"ACM Computing Surveys."},{"key":"e_1_3_3_78_2","doi-asserted-by":"publisher","DOI":"10.1109\/MSR.2019.00063"},{"key":"e_1_3_3_79_2","volume-title":"Proceedings of the 30th USENIX Security Symposium (USENIX Security\u201921)","author":"Lee Yoochan","year":"2021","unstructured":"Yoochan Lee, Changwoo Min, and Byoungyoung Lee. 2021. ExpRace: Exploiting kernel races through raising interrupts. In Proceedings of the 30th USENIX Security Symposium (USENIX Security\u201921)."},{"key":"e_1_3_3_80_2","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2022.3171922"},{"key":"e_1_3_3_81_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.comcom.2010.04.006"},{"key":"e_1_3_3_82_2","doi-asserted-by":"publisher","DOI":"10.1155\/2014\/932397"},{"key":"e_1_3_3_83_2","doi-asserted-by":"publisher","DOI":"10.1109\/MSP.2006.145"},{"key":"e_1_3_3_84_2","volume-title":"A Complete Guide to the Common Vulnerability Scoring System Version 2.0","author":"Mell Peter","year":"2007","unstructured":"Peter Mell, Karen Scarfone, and Sasha Romansky. 2007. A Complete Guide to the Common Vulnerability Scoring System Version 2.0. Technical Report. Forum of Incident Response and Security Teams (FIRST). https:\/\/www.first.org\/cvss\/v2\/cvss-v2-guide.pdf"},{"key":"e_1_3_3_85_2","unstructured":"Microsoft. 2022. Microsoft Exploitability Index (Website). Retrieved April 10 2022 from https:\/\/www.microsoft.com\/en-us\/msrc\/exploitability-index"},{"key":"e_1_3_3_86_2","unstructured":"Microsoft. 2022. Security Update Severity Rating System (Website). Retrieved September 30 2022 from https:\/\/www.microsoft.com\/en-us\/msrc\/security-update-severity-rating-system"},{"key":"e_1_3_3_87_2","first-page":"717","volume-title":"Proceedings of the 2021 36th IEEE\/ACM International Conference on Automated Software Engineering (ASE\u201921)","author":"Le Triet Huynh Minh","year":"2021","unstructured":"Triet Huynh Minh Le, David Hin, Roland Croft, and M. Ali Babar. 2021. DeepCVA: Automated commit-level vulnerability assessment with deep multi-task learning. In Proceedings of the 2021 36th IEEE\/ACM International Conference on Automated Software Engineering (ASE\u201921). 717\u2013729."},{"key":"e_1_3_3_88_2","unstructured":"National Institute of Standards and Technology (NIST). 2022. Computer Security Resource Center (CSRC) Glossary. National Institute of Standards and Technology (NIST). https:\/\/csrc.nist.gov\/glossary"},{"key":"e_1_3_3_89_2","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-11379-1_21"},{"key":"e_1_3_3_90_2","unstructured":"NIST. 2021. National Vulnerability Database. Retrieved March 30 2024 from https:\/\/nvd.nist.gov\/"},{"key":"e_1_3_3_91_2","unstructured":"Oxford English Dictionary (OED). 2022. Exploit v. In OED Online. Oxford University Press. https:\/\/www.oed.com\/view\/Entry\/66647"},{"key":"e_1_3_3_92_2","doi-asserted-by":"publisher","DOI":"10.1145\/3005714"},{"key":"e_1_3_3_93_2","doi-asserted-by":"publisher","DOI":"10.1162\/qss_a_00023"},{"key":"e_1_3_3_94_2","doi-asserted-by":"publisher","DOI":"10.1145\/3194707.3194711"},{"key":"e_1_3_3_95_2","doi-asserted-by":"publisher","DOI":"10.14236\/ewic\/EASE2008.8"},{"key":"e_1_3_3_96_2","doi-asserted-by":"publisher","DOI":"10.1109\/ICSM.2015.7332492"},{"key":"e_1_3_3_97_2","doi-asserted-by":"publisher","DOI":"10.1109\/ICSME.2018.00054"},{"key":"e_1_3_3_98_2","doi-asserted-by":"publisher","DOI":"10.1007\/s10664-020-09830-x"},{"key":"e_1_3_3_99_2","doi-asserted-by":"publisher","DOI":"10.1109\/MSR.2019.00064"},{"key":"e_1_3_3_100_2","doi-asserted-by":"publisher","DOI":"10.4236\/jis.2016.74022"},{"key":"e_1_3_3_101_2","doi-asserted-by":"publisher","DOI":"10.4236\/jis.2017.82009"},{"key":"e_1_3_3_102_2","volume-title":"CVSS-SIG Version 2 History","author":"Reid Gavin","year":"2007","unstructured":"Gavin Reid, Peter Mell, and Karen Scarfone. 2007. CVSS-SIG Version 2 History. Technical Report. Forum of Incident Response and Security Teams (FIRST). https:\/\/www.first.org\/cvss\/v2\/history"},{"key":"e_1_3_3_103_2","doi-asserted-by":"publisher","DOI":"10.1145\/3139337.3139346"},{"issue":"1","key":"e_1_3_3_104_2","first-page":"18","article-title":"Examining exploitability risk of vulnerabilities: A hazard model","volume":"46","author":"Roumani Yaman","year":"2020","unstructured":"Yaman Roumani and Joseph Nwankpa. 2020. Examining exploitability risk of vulnerabilities: A hazard model. Communications of the Association for Information Systems 46, 1 (2020), 18.","journal-title":"Communications of the Association for Information Systems"},{"key":"e_1_3_3_105_2","volume-title":"Proceedings of the 24th USENIX Security Symposium (USENIX Security\u201915)","author":"Sabottke Carl","year":"2015","unstructured":"Carl Sabottke, Octavian Suciu, and Tudor Dumitra\u015f. 2015. Vulnerability disclosure in the age of social media: Exploiting Twitter for predicting real-world exploits. In Proceedings of the 24th USENIX Security Symposium (USENIX Security\u201915)."},{"key":"e_1_3_3_106_2","doi-asserted-by":"publisher","DOI":"10.1109\/LISS.2016.7854490"},{"key":"e_1_3_3_107_2","doi-asserted-by":"publisher","DOI":"10.1109\/ESEM.2009.5314220"},{"key":"e_1_3_3_108_2","volume-title":"Proceedings of the 20th USENIX Security Symposium (USENIX Security\u201911)","author":"Schwartz Edward J.","year":"2011","unstructured":"Edward J. Schwartz, Thanassis Avgerinos, and David Brumley. 2011. Q: Exploit hardening made easy. In Proceedings of the 20th USENIX Security Symposium (USENIX Security\u201911)."},{"key":"e_1_3_3_109_2","unstructured":"SCImago. 2023. SCImago Journal & Country Rank [Portal]. Retrieved August 16 2023 from https:\/\/www.scimagojr.com"},{"key":"e_1_3_3_110_2","unstructured":"SciTools Support. 2021. What Metrics Does Understand Have? Retrieved October 27 2022 from https:\/\/support.scitools.com\/support\/solutions\/articles\/70000582223-what-metrics-does-understand-have-"},{"key":"e_1_3_3_111_2","unstructured":"Semantic Scholar. n.d. Semantic Scholar Academic Graph API. Retrieved July 18 2023 from https:\/\/www.semanticscholar.org\/product\/api"},{"key":"e_1_3_3_112_2","doi-asserted-by":"publisher","DOI":"10.1111\/deci.12212"},{"key":"e_1_3_3_113_2","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2016.17"},{"key":"e_1_3_3_114_2","first-page":"203","volume-title":"14th International Conference on Computational Intelligence in Security for Information Systems and 12th International Conference on European Transnational Educational (CISIS 2021 and ICEUTE 2021)","author":"Mart\u00ednez Eva Sotos","year":"2021","unstructured":"Eva Sotos Mart\u00ednez, Nora M. Villanueva, and Lilian Adkinson Orellana. 2021. A survey on the state of the art of vulnerability assessment techniques. In 14th International Conference on Computational Intelligence in Security for Information Systems and 12th International Conference on European Transnational Educational (CISIS 2021 and ICEUTE 2021), Juan Jos\u00e9 Gude Prego, Jos\u00e9 Gaviria de la Puerta, Pablo Garc\u00eda Bringas, H\u00e9ctor Quinti\u00e1n, and Emilio Corchado (Eds.). Springer International Publishing, Cham, 203\u2013213."},{"key":"e_1_3_3_115_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.jss.2018.09.039"},{"key":"e_1_3_3_116_2","doi-asserted-by":"publisher","DOI":"10.1145\/2491845.2491871"},{"key":"e_1_3_3_117_2","first-page":"377","volume-title":"Proceedings of the 31st USENIX Security Symposium","author":"Suciu Octavian","year":"2022","unstructured":"Octavian Suciu, Connor Nelson, Zhuoer Lyu, Tiffany Bao, and Tudor Dumitras. 2022. Expected exploitability: Predicting the development of functional vulnerability exploits. In Proceedings of the 31st USENIX Security Symposium. 377\u2013394."},{"key":"e_1_3_3_118_2","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-39564-7_22"},{"key":"e_1_3_3_119_2","unstructured":"TrendMicro. n.d. Exploit. Retrieved May 17 2023 from https:\/\/www.trendmicro.com\/vinfo\/us\/security\/definition\/exploit"},{"key":"e_1_3_3_120_2","doi-asserted-by":"publisher","DOI":"10.1109\/APSEC.2017.30"},{"key":"e_1_3_3_121_2","article-title":"SYMBALS: A systematic review methodology blending active learning and snowballing","volume":"6","author":"Haastrecht Max van","year":"2021","unstructured":"Max van Haastrecht, Injy Sarhan, Bilge Yigit Ozkan, Matthieu Brinkhuis, and Marco Spruit. 2021. SYMBALS: A systematic review methodology blending active learning and snowballing. Frontiers in Research Metrics and Analytics 6 (2021), 685591.","journal-title":"Frontiers in Research Metrics and Analytics"},{"key":"e_1_3_3_122_2","unstructured":"Debbie Walkowski. 2021. F5: Threats Vulnerabilities Exploits and Their Relationship to Risk. Retrieved May 17 2023 from https:\/\/www.f5.com\/labs\/learning-center\/threats-vulnerabilities-exploits-and-their-relationship-to-risk"},{"key":"e_1_3_3_123_2","doi-asserted-by":"publisher","DOI":"10.1186\/s42400-018-0018-3"},{"key":"e_1_3_3_124_2","doi-asserted-by":"publisher","DOI":"10.1109\/WAIM.2008.66"},{"key":"e_1_3_3_125_2","doi-asserted-by":"publisher","DOI":"10.1145\/3243734.3243847"},{"key":"e_1_3_3_126_2","unstructured":"Thomas Wood Sewwandi Perera Shi Yan Lin Padgha and Alistair Moffat. 2022. CORE: Conference Details. Retrieved August 16 2023 from https:\/\/www.core.edu.au\/conference-portal#h.p_ID_44"},{"key":"e_1_3_3_127_2","volume-title":"Proceedings of the 31st USENIX Security Symposium (USENIX Security\u201922)","author":"Wu Qiushi","unstructured":"Qiushi Wu, Yue Xiao, Xiaojing Liao, and Kangjie Lu. 2022. OS-aware vulnerability prioritization via differential severity analysis. In Proceedings of the 31st USENIX Security Symposium (USENIX Security\u201922)."},{"key":"e_1_3_3_128_2","volume-title":"Proceedings of the 28th USENIX Security Symposium (USENIX Security\u201919)","author":"Wu Wei","year":"2019","unstructured":"Wei Wu, Yueqi Chen, Xinyu Xing, and Wei Zou. 2019. KEPLER: Facilitating control-flow hijacking primitive evaluation for Linux kernel vulnerabilities. In Proceedings of the 28th USENIX Security Symposium (USENIX Security\u201919)."},{"key":"e_1_3_3_129_2","volume-title":"Proceedings of the 27th USENIX Security Symposium (USENIX Security\u201918)","author":"Wu Wei","year":"2018","unstructured":"Wei Wu, Yueqi Chen, Jun Xu, Xinyu Xing, Xiaorui Gong, and Wei Zou. 2018. FUZE: Towards facilitating exploit generation for kernel use-after-free vulnerabilities. In Proceedings of the 27th USENIX Security Symposium (USENIX Security\u201918)."},{"key":"e_1_3_3_130_2","volume-title":"Proceedings of the 27th USENIX Security Symposium (USENIX Security\u201918)","author":"Xiao Chaowei","year":"2018","unstructured":"Chaowei Xiao, Armin Sarabi, Yang Liu, Bo Li, Mingyan Liu, and Tudor Dumitras. 2018. From patching delays to infection symptoms: Using risk profiles for an early discovery of vulnerabilities exploited in the wild. In Proceedings of the 27th USENIX Security Symposium (USENIX Security\u201918)."},{"key":"e_1_3_3_131_2","doi-asserted-by":"publisher","DOI":"10.1109\/BADGERS.2015.018"},{"key":"e_1_3_3_132_2","doi-asserted-by":"publisher","DOI":"10.1109\/PAC.2017.10"},{"key":"e_1_3_3_133_2","doi-asserted-by":"publisher","DOI":"10.3390\/app10072555"},{"key":"e_1_3_3_134_2","doi-asserted-by":"publisher","DOI":"10.1145\/3427228.3427568"},{"key":"e_1_3_3_135_2","doi-asserted-by":"publisher","DOI":"10.1145\/2857705.2857750"},{"key":"e_1_3_3_136_2","doi-asserted-by":"publisher","DOI":"10.1007\/s11219-015-9274-6"},{"key":"e_1_3_3_137_2","doi-asserted-by":"publisher","DOI":"10.1109\/QRS.2015.44"},{"key":"e_1_3_3_138_2","doi-asserted-by":"publisher","DOI":"10.1109\/HASE.2014.10"},{"key":"e_1_3_3_139_2","doi-asserted-by":"publisher","DOI":"10.1007\/s10664-017-9587-0"},{"key":"e_1_3_3_140_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.eswa.2018.11.021"},{"key":"e_1_3_3_141_2","volume-title":"Proceedings of the 31st USENIX Security Symposium","author":"Zeng Kyle","year":"2022","unstructured":"Kyle Zeng, Yueqi Chen, Haehyun Cho, Xinyu Xing, Adam Doup\u00e9, Yan Shoshitaishvili, and Tiffany Bao. 2022. Playing for K(H)heaps: Understanding and improving Linux kernel exploit reliability. In Proceedings of the 31st USENIX Security Symposium."},{"key":"e_1_3_3_142_2","doi-asserted-by":"publisher","DOI":"10.1109\/CNS48642.2020.9162225"},{"key":"e_1_3_3_143_2","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-52683-2_5"},{"key":"e_1_3_3_144_2","volume-title":"Proceedings of the 19th Annual Network and Distributed System Security Symposium (NDSS\u201912).","author":"Zhou Yajin","year":"2012","unstructured":"Yajin Zhou, Zhi Wang, Wu Zhou, and Xuxian Jiang. 2012. Hey, you, get off of my market: Detecting malicious apps in official and alternative Android markets. In Proceedings of the 19th Annual Network and Distributed System Security Symposium (NDSS\u201912)."},{"key":"e_1_3_3_145_2","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-19223-5_17"}],"container-title":["ACM Computing Surveys"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3648610","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3648610","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,18]],"date-time":"2025-06-18T22:50:20Z","timestamp":1750287020000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3648610"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2024,4,26]]},"references-count":144,"journal-issue":{"issue":"8","published-print":{"date-parts":[[2024,8,31]]}},"alternative-id":["10.1145\/3648610"],"URL":"https:\/\/doi.org\/10.1145\/3648610","relation":{},"ISSN":["0360-0300","1557-7341"],"issn-type":[{"value":"0360-0300","type":"print"},{"value":"1557-7341","type":"electronic"}],"subject":[],"published":{"date-parts":[[2024,4,26]]},"assertion":[{"value":"2022-11-28","order":0,"name":"received","label":"Received","group":{"name":"publication_history","label":"Publication History"}},{"value":"2024-01-31","order":2,"name":"accepted","label":"Accepted","group":{"name":"publication_history","label":"Publication History"}},{"value":"2024-04-26","order":3,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}