{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,12]],"date-time":"2026-07-12T03:56:37Z","timestamp":1783828597594,"version":"3.55.0"},"publisher-location":"New York, NY, USA","reference-count":68,"publisher":"ACM","funder":[{"name":"Cybersecurity and Infrastructure Security Agency","award":["70RCSA22C00000008"],"award-info":[{"award-number":["70RCSA22C00000008"]}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2025,11,19]]},"DOI":"10.1145\/3719027.3765210","type":"proceedings-article","created":{"date-parts":[[2025,11,22]],"date-time":"2025-11-22T23:33:16Z","timestamp":1763854396000},"page":"1904-1918","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":5,"title":["Conflicting Scores, Confusing Signals: An Empirical Study of Vulnerability Scoring Systems"],"prefix":"10.1145","author":[{"ORCID":"https:\/\/orcid.org\/0000-0003-1616-0167","authenticated-orcid":false,"given":"Viktoria","family":"Koscinski","sequence":"first","affiliation":[{"name":"Rochester Institute of Technology, Rochester, NY, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-0775-0627","authenticated-orcid":false,"given":"Mark","family":"Nelson","sequence":"additional","affiliation":[{"name":"University of Hawai'i at M\u0101noa, Honolulu, HI, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-6664-515X","authenticated-orcid":false,"given":"Ahmet","family":"Okutan","sequence":"additional","affiliation":[{"name":"Leidos, Reston, VA, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0009-8354-0830","authenticated-orcid":false,"given":"Robert","family":"Falso","sequence":"additional","affiliation":[{"name":"Rochester Institute of Technology, Rochester, NY, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0000-7963-3756","authenticated-orcid":false,"given":"Mehdi","family":"Mirakhorli","sequence":"additional","affiliation":[{"name":"University of Hawai'i at M\u0101noa, Honolulu, HI, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"320","published-online":{"date-parts":[[2025,11,22]]},"reference":[{"key":"e_1_3_2_1_1_1","doi-asserted-by":"publisher","DOI":"10.3390\/electronics11213580"},{"key":"e_1_3_2_1_2_1","doi-asserted-by":"publisher","DOI":"10.1145\/2630069"},{"key":"e_1_3_2_1_3_1","doi-asserted-by":"publisher","DOI":"10.1145\/3498891.3501259"},{"key":"e_1_3_2_1_4_1","unstructured":"Harold Booth Doug Rike and Gregory A Witte. 2013. The national vulnerability database (nvd): Overview. (2013)."},{"key":"e_1_3_2_1_5_1","volume-title":"Vulnerability prioritization: An offensive security approach. arXiv preprint arXiv:2206.11182","author":"Bulut Muhammed Fatih","year":"2022","unstructured":"Muhammed Fatih Bulut, Abdulhamid Adebayo, Daby Sow, and Steve Ocepek. 2022. Vulnerability prioritization: An offensive security approach. arXiv preprint arXiv:2206.11182 (2022)."},{"key":"e_1_3_2_1_6_1","doi-asserted-by":"publisher","DOI":"10.1109\/SANER53432.2022.00050"},{"key":"e_1_3_2_1_7_1","unstructured":"Cybersecurity and Infrastructure Security Agency. 2022. CISA Stakeholder-Specific Vulnerability Categorization Guide."},{"key":"e_1_3_2_1_8_1","unstructured":"Cybersecurity and Infrastructure Security Agency. [n.d.]. Stakeholder-Specific Vulnerability Categorization (SSVC). https:\/\/www.cisa.gov\/stakeholder-specific-vulnerability-categorization-ssvc."},{"key":"e_1_3_2_1_9_1","volume-title":"35th Annual FIRST Conference. Available: https:\/\/www.first.org\/cvss\/v4-0\/cvss-v40-presentation.pdf.","author":"Dugal Dave","year":"2023","unstructured":"Dave Dugal and Dale Rich. 2023. Announcing CVSS v4.0. 35th Annual FIRST Conference. Available: https:\/\/www.first.org\/cvss\/v4-0\/cvss-v40-presentation.pdf."},{"key":"e_1_3_2_1_10_1","doi-asserted-by":"publisher","DOI":"10.1145\/3196884"},{"key":"e_1_3_2_1_11_1","doi-asserted-by":"publisher","DOI":"10.1145\/3381038"},{"key":"e_1_3_2_1_12_1","unstructured":"FIRST.Org Inc. [n.d.]. Common Vulnerability Scoring System Version 4.0. https:\/\/www.first.org\/cvss\/v4-0\/."},{"key":"e_1_3_2_1_13_1","unstructured":"FIRST.Org Inc. 2019. Common Vulnerability Scoring System version 3.1 Specification Document Revision 1. Technical Report. FIRST.Org Inc. https:\/\/www.first.org\/cvss\/v3-1\/cvss-v31-specification_r1.pdf"},{"key":"e_1_3_2_1_14_1","unstructured":"First.org Inc. 2023. EPSS Frequently Asked Questions. https:\/\/www.first.org\/epss\/faq."},{"key":"e_1_3_2_1_15_1","unstructured":"First.org Inc. 2025. Exploit Prediction Scoring System. https:\/\/www.first.org\/epss\/."},{"key":"e_1_3_2_1_16_1","unstructured":"Centers for Disease Control and Prevention. 2019. How is well-being defined? https:\/\/www.cdc.gov\/hrqol\/wellbeing.htm#three."},{"key":"e_1_3_2_1_17_1","volume-title":"Vulnerability management","author":"Foreman Park","unstructured":"Park Foreman. 2019. Vulnerability management. CRC Press."},{"key":"e_1_3_2_1_18_1","doi-asserted-by":"publisher","DOI":"10.1109\/ESEM.2009.5314230"},{"key":"e_1_3_2_1_19_1","first-page":"123","article-title":"BEST PRACTICES FOR VULNERABILITY MANAGEMENT IN LARGE ENTERPRISES: A CRITICAL VIEW ON THE COMMON VULNERABILITY SCORING SYSTEM. Risk Analysis","volume":"214","author":"Hans Jaqueline","year":"2022","unstructured":"Jaqueline Hans and Roman Brandtweiner. 2022. BEST PRACTICES FOR VULNERABILITY MANAGEMENT IN LARGE ENTERPRISES: A CRITICAL VIEW ON THE COMMON VULNERABILITY SCORING SYSTEM. Risk Analysis, Hazard Mitigation and Safety and Security Engineering XIII, Vol. 214 (2022), 123.","journal-title":"Hazard Mitigation and Safety and Security Engineering XIII"},{"key":"e_1_3_2_1_20_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2015.04.012"},{"key":"e_1_3_2_1_21_1","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2022.3152164"},{"key":"e_1_3_2_1_22_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.eswa.2023.119734"},{"key":"e_1_3_2_1_23_1","doi-asserted-by":"publisher","DOI":"10.1145\/3491263"},{"key":"e_1_3_2_1_24_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.jss.2013.06.040"},{"key":"e_1_3_2_1_25_1","unstructured":"Ponemon Institute. 2020. Ponemon Study on the Challenging State of Vulnerability Management. https:\/\/www.balbix.com\/press-releases\/ponemon-report-on-vulnerability-management-challenges\/. Accessed: 2025-07-14."},{"key":"e_1_3_2_1_26_1","doi-asserted-by":"publisher","DOI":"10.1093\/cybsec\/tyaa015"},{"key":"e_1_3_2_1_27_1","doi-asserted-by":"publisher","DOI":"10.1145\/3436242"},{"key":"e_1_3_2_1_28_1","doi-asserted-by":"publisher","DOI":"10.1109\/EuroSPW59978.2023.00027"},{"key":"e_1_3_2_1_29_1","doi-asserted-by":"publisher","DOI":"10.1145\/3465481.3470093"},{"key":"e_1_3_2_1_30_1","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2016.2644614"},{"key":"e_1_3_2_1_31_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2022.102639"},{"key":"e_1_3_2_1_32_1","volume-title":"Amanda Mullens, Samuel Perl, Daniel Roethlisberger, Sigitas Rokas, Mary Rossell, Robin M. Ruefle, D\u00e9sir\u00e9e Sacher, Krassimir T. Tzvetanov, and Mark Zajicek.","author":"Kossakowski Klaus-Peter","year":"2019","unstructured":"Klaus-Peter Kossakowski, Vilius Benetis, Olivier Caleff, Cristine Hoepers, Angela Horneman, Allen Householder, Art Manion, Amanda Mullens, Samuel Perl, Daniel Roethlisberger, Sigitas Rokas, Mary Rossell, Robin M. Ruefle, D\u00e9sir\u00e9e Sacher, Krassimir T. Tzvetanov, and Mark Zajicek. 2019. Computer Security Incident Response Team (CSIRT) Services Framework version 2.1.0. Technical Report. FIRST.Org, Inc."},{"key":"e_1_3_2_1_33_1","volume-title":"Content Analysis: An Introduction to Its Methodology","author":"Krippendorff Klaus","year":"2022","unstructured":"Klaus Krippendorff. 2022. Content Analysis: An Introduction to Its Methodology (4th ed.). SAGE Publications, Thousand Oaks, CA.","edition":"4"},{"key":"e_1_3_2_1_34_1","doi-asserted-by":"publisher","DOI":"10.1145\/3529757"},{"key":"e_1_3_2_1_35_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.infsof.2022.106856"},{"key":"e_1_3_2_1_36_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.comcom.2010.04.006"},{"key":"e_1_3_2_1_37_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.jss.2012.03.057"},{"key":"e_1_3_2_1_38_1","unstructured":"Lockheed Martin. [n.d.]. The Cyber Kill Chain. https:\/\/www.lockheedmartin.com\/en-us\/capabilities\/cyber\/cyber-kill-chain.html."},{"key":"e_1_3_2_1_39_1","unstructured":"Microsoft Inc. [n.d.]. Microsoft Exploitability Index. https:\/\/www.microsoft.com\/en-us\/msrc\/exploitability-index\/."},{"key":"e_1_3_2_1_40_1","doi-asserted-by":"publisher","DOI":"10.1145\/3664476.3670915"},{"key":"e_1_3_2_1_41_1","unstructured":"Ahmet Okutan and Mehdi Mirakhorli. 2022a. Exploitability Analysis Datasets and Models. https:\/\/github.com\/SoftwareDesignLab\/exploitability_analysis."},{"key":"e_1_3_2_1_42_1","doi-asserted-by":"publisher","DOI":"10.1145\/3524489.3527298"},{"key":"e_1_3_2_1_43_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.anbehav.2015.01.010"},{"key":"e_1_3_2_1_44_1","unstructured":"QED Secure Solutions. [n.d.]. Risk Scoring System. https:\/\/www.riskscoringsystem.com\/."},{"key":"e_1_3_2_1_45_1","unstructured":"Qualys Inc. [n.d.]. Qualys Vulnerability Management Detection and Response Tool. https:\/\/www.qualys.com\/apps\/vulnerability-management-detection-response\/."},{"key":"e_1_3_2_1_46_1","unstructured":"Rapid7 Inc. [n.d.]. Nexpose Vulnerability Scanner. https:\/\/www.rapid7.com\/products\/nexpose\/."},{"key":"e_1_3_2_1_47_1","unstructured":"Recorded Future Inc. [n.d.]. Recorded Future Threat Intelligence. https:\/\/www.recordedfuture.com\/."},{"key":"e_1_3_2_1_48_1","doi-asserted-by":"publisher","DOI":"10.3390\/electronics11091334"},{"key":"e_1_3_2_1_49_1","doi-asserted-by":"publisher","DOI":"10.1007\/s10664-008-9102-8"},{"key":"e_1_3_2_1_50_1","doi-asserted-by":"publisher","DOI":"10.1177\/1548512919874129"},{"key":"e_1_3_2_1_51_1","unstructured":"Snyk Ltd. [n.d.]. Snyk Priority Score. https:\/\/snyk.io\/."},{"key":"e_1_3_2_1_52_1","doi-asserted-by":"publisher","DOI":"10.1145\/3139367.3139390"},{"key":"e_1_3_2_1_53_1","doi-asserted-by":"publisher","DOI":"10.1145\/2491845.2491871"},{"key":"e_1_3_2_1_54_1","doi-asserted-by":"publisher","DOI":"10.1109\/MSEC.2020.3044475"},{"key":"e_1_3_2_1_55_1","volume-title":"Towards improving CVSS","author":"Spring Jonathan","year":"2018","unstructured":"Jonathan Spring, Eric Hatleback, A Manion, and D Shic. 2018. Towards improving CVSS. Software Engineering Institute, Carnegie Mellon University, Tech. Rep (2018)."},{"key":"e_1_3_2_1_56_1","volume-title":"Madison Oliver, Vijay Sarvapalli, Laurie Tyzenhaus, and Charles Yarbrough.","author":"Spring Jonathan M","year":"2021","unstructured":"Jonathan M Spring, Allen Householder, Eric Hatleback, Art Manion, Madison Oliver, Vijay Sarvapalli, Laurie Tyzenhaus, and Charles Yarbrough. 2021b. Prioritizing Vulnerability Response: A Stakeholder-Specific Vulnerability Categorization (Version 2.0). Technical Report. CARNEGIE-MELLON UNIV PITTSBURGH PA."},{"key":"e_1_3_2_1_57_1","first-page":"377","volume-title":"31st USENIX Security Symposium (USENIX Security 22)","author":"Suciu Octavian","year":"2022","unstructured":"Octavian Suciu, Connor Nelson, Zhuoer Lyu, Tiffany Bao, and Tudor Dumitra?. 2022. Expected exploitability: Predicting the development of functional vulnerability exploits. In 31st USENIX Security Symposium (USENIX Security 22). 377-394."},{"key":"e_1_3_2_1_58_1","unstructured":"Wei Tai. 2020. What Is VPR and How Is It Different from CVSS? https:\/\/www.tenable.com\/blog\/what-is-vpr-and-how-is-it-different-from-cvss."},{"key":"e_1_3_2_1_59_1","doi-asserted-by":"publisher","DOI":"10.1145\/3723158"},{"key":"e_1_3_2_1_60_1","unstructured":"Tenable Inc. 2023. Tenable Security Center 6.1.x User Guide. Technical Report. https:\/\/docs.tenable.com\/security-center\/Content\/PDF\/Tenable_Security_Center-User_Guide.pdf"},{"key":"e_1_3_2_1_61_1","unstructured":"The MITRE Corporation. [n.d.]. Common Weakness Enumeration. https:\/\/cwe.mitre.org\/."},{"key":"e_1_3_2_1_62_1","unstructured":"The MITRE Corporation. 2025. CVE Metrics. https:\/\/www.cve.org\/About\/Metrics. Accessed: 2025-08-04."},{"key":"e_1_3_2_1_63_1","unstructured":"ThreatGEN. [n.d.]. Industrial Vulnerability Scoring System. https:\/\/threatgen.com\/resources\/ivss\/."},{"key":"e_1_3_2_1_64_1","article-title":"Visualizing data using t-SNE","volume":"9","author":"der Maaten Laurens Van","year":"2008","unstructured":"Laurens Van der Maaten and Geoffrey Hinton. 2008. Visualizing data using t-SNE. Journal of machine learning research, Vol. 9, 11 (2008).","journal-title":"Journal of machine learning research"},{"key":"e_1_3_2_1_65_1","doi-asserted-by":"publisher","DOI":"10.1109\/RCIS.2009.5089295"},{"key":"e_1_3_2_1_66_1","doi-asserted-by":"publisher","DOI":"10.1109\/FUZZY.2010.5584447"},{"key":"e_1_3_2_1_67_1","doi-asserted-by":"publisher","DOI":"10.23919\/SoftCOM52868.2021.9559094"},{"key":"e_1_3_2_1_68_1","doi-asserted-by":"publisher","DOI":"10.3390\/app11188735"}],"event":{"name":"CCS '25: ACM SIGSAC Conference on Computer and Communications Security","location":"Taipei Taiwan","acronym":"CCS '25","sponsor":["SIGSAC ACM Special Interest Group on Security, Audit, and Control"]},"container-title":["Proceedings of the 2025 ACM SIGSAC Conference on Computer and Communications Security"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3719027.3765210","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,12,22]],"date-time":"2025-12-22T22:15:39Z","timestamp":1766441739000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3719027.3765210"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,11,19]]},"references-count":68,"alternative-id":["10.1145\/3719027.3765210","10.1145\/3719027"],"URL":"https:\/\/doi.org\/10.1145\/3719027.3765210","relation":{},"subject":[],"published":{"date-parts":[[2025,11,19]]},"assertion":[{"value":"2025-11-22","order":3,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}