{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,7,27]],"date-time":"2025-07-27T07:46:59Z","timestamp":1753602419642,"version":"3.41.0"},"publisher-location":"New York, NY, USA","reference-count":38,"publisher":"ACM","content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2025,2,10]]},"DOI":"10.1145\/3727166.3727189","type":"proceedings-article","created":{"date-parts":[[2025,6,28]],"date-time":"2025-06-28T04:18:56Z","timestamp":1751084336000},"page":"55-65","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":1,"title":["Predicting IoT Device Vulnerability Fix Times with Survival and Failure Time Models"],"prefix":"10.1145","author":[{"ORCID":"https:\/\/orcid.org\/0000-0001-9748-2453","authenticated-orcid":false,"given":"Carlos Alberto","family":"Rivera Alvarez","sequence":"first","affiliation":[{"name":"Computer Science and Engineering, The University of New South Wales (UNSW - Sydney), Sydney, NSW, Australia"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0009-0005-8901-2618","authenticated-orcid":false,"given":"Xinzhang","family":"Chen","sequence":"additional","affiliation":[{"name":"Computer Science and Engineering, The University of New South Wales (UNSW - Sydney), Sydney, NSW, Australia"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-6630-9519","authenticated-orcid":false,"given":"Arash","family":"Shaghaghi","sequence":"additional","affiliation":[{"name":"Computer Science and Engineering, The University of New South Wales (UNSW - Sydney), Sydney, NSW, Australia"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-3482-8442","authenticated-orcid":false,"given":"Gustavo","family":"Batista","sequence":"additional","affiliation":[{"name":"Computer Science and Engineering, The University of New South Wales (UNSW - Sydney), Sydney, NSW, Australia"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-1835-3475","authenticated-orcid":false,"given":"Salil","family":"Kanhere","sequence":"additional","affiliation":[{"name":"Computer Science and Engineering, The University of New South Wales (UNSW - Sydney), Sydney, NSW, Australia"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"320","published-online":{"date-parts":[[2025,6,27]]},"reference":[{"key":"e_1_3_3_2_2_2","doi-asserted-by":"crossref","unstructured":"Elie Alhajjar and Taylor Bradley. 2021. Survival analysis for insider threat: Detecting insider threat incidents using survival analysis techniques. Computational and mathematical organization theory (2021) 1\u201317.","DOI":"10.1007\/s10588-021-09341-0"},{"key":"e_1_3_3_2_3_2","doi-asserted-by":"crossref","first-page":"82","DOI":"10.1109\/CYCONUS.2017.8167501","volume-title":"2017 International Conference on Cyber Conflict (CyCon US)","author":"Almukaynizi Mohammed","year":"2017","unstructured":"Mohammed Almukaynizi, Eric Nunes, Krishna Dharaiya, Manoj Senguttuvan, Jana Shakarian, and Paulo Shakarian. 2017. Proactive identification of exploits in the wild through vulnerability mentions online. In 2017 International Conference on Cyber Conflict (CyCon US). IEEE, 82\u201388."},{"key":"e_1_3_3_2_4_2","first-page":"1093","volume-title":"26th USENIX security symposium (USENIX Security 17)","author":"Antonakakis Manos","year":"2017","unstructured":"Manos Antonakakis, Tim April, Michael Bailey, Matt Bernhard, Elie Bursztein, Jaime Cochran, Zakir Durumeric, J\u00a0Alex Halderman, Luca Invernizzi, Michalis Kallitsis, et\u00a0al. 2017. Understanding the mirai botnet. In 26th USENIX security symposium (USENIX Security 17). 1093\u20131110."},{"key":"e_1_3_3_2_5_2","doi-asserted-by":"publisher","unstructured":"Avinash Barnwal Hyunsu Cho and Toby Hocking. 2022. Survival Regression with Accelerated Failure Time Model in XGBoost. J. Comput. Graph. Stat. 31 4 (2022) 1292\u20131302. 10.1080\/10618600.2022.2067548https:\/\/doi.org\/10.1080\/10618600.2022.2067548","DOI":"10.1080\/10618600.2022.2067548"},{"key":"e_1_3_3_2_6_2","doi-asserted-by":"crossref","unstructured":"Avinash Barnwal Hyunsu Cho and Toby Hocking. 2022. Survival regression with accelerated failure time model in XGBoost. Journal of Computational and Graphical Statistics 31 4 (2022) 1292\u20131302.","DOI":"10.1080\/10618600.2022.2067548"},{"key":"e_1_3_3_2_7_2","doi-asserted-by":"crossref","unstructured":"Lotfi Ben\u00a0Othmane Golriz Chehrazi Eric Bodden Petar Tsalovski and Achim\u00a0D Brucker. 2017. Time for addressing software security issues: Prediction models and impacting factors. Data Science and Engineering 2 (2017) 107\u2013124.","DOI":"10.1007\/s41019-016-0019-8"},{"key":"e_1_3_3_2_8_2","doi-asserted-by":"crossref","unstructured":"Navneet Bhatt Adarsh Anand and Venkata\u00a0SS Yadavalli. 2021. Exploitability prediction of software vulnerabilities. Quality and Reliability Engineering International 37 2 (2021) 648\u2013663.","DOI":"10.1002\/qre.2754"},{"key":"e_1_3_3_2_9_2","doi-asserted-by":"crossref","unstructured":"Adam\u00a0R Brentnall and Jack Cuzick. 2018. Use of the concordance index for predictors of censored survival data. Statistical methods in medical research 27 8 (2018) 2359\u20132373.","DOI":"10.1177\/0962280216680245"},{"key":"e_1_3_3_2_10_2","doi-asserted-by":"crossref","unstructured":"Hua Chai Zi-na Li De-yu Meng Liang-yong Xia and Yong Liang. 2017. A new semi-supervised learning model combined with Cox and SP-AFT models in cancer survival analysis. Scientific reports 7 1 (2017) 13053.","DOI":"10.1038\/s41598-017-13133-5"},{"key":"e_1_3_3_2_11_2","first-page":"6503","volume-title":"IJCAI","author":"Chen Haipeng","year":"2019","unstructured":"Haipeng Chen, Jing Liu, Rui Liu, Noseong Park, and VS Subrahmanian. 2019. VEST: A System for Vulnerability Exploit Scoring & Timing.. In IJCAI. 6503\u20136505."},{"key":"e_1_3_3_2_12_2","doi-asserted-by":"publisher","DOI":"10.1145\/3292500.3330742"},{"key":"e_1_3_3_2_13_2","doi-asserted-by":"publisher","DOI":"10.1145\/2939672.2939785"},{"key":"e_1_3_3_2_14_2","doi-asserted-by":"crossref","first-page":"17","DOI":"10.1007\/978-3-031-31632-6_3","volume-title":"Modern Survival Analysis in Clinical Research: Cox Regressions Versus Accelerated Failure Time Models","author":"Cleophas Ton\u00a0J","year":"2023","unstructured":"Ton\u00a0J Cleophas and Aeilko\u00a0H Zwinderman. 2023. Accelerated Failure Time Models. In Modern Survival Analysis in Clinical Research: Cox Regressions Versus Accelerated Failure Time Models. Springer, 17\u201326."},{"key":"e_1_3_3_2_15_2","unstructured":"Jeff Costlow. 2022. Understand the risk of IoT vulnerabilities in the remote work era. (2022). https:\/\/www.scmagazine.com\/perspective\/iot\/understand-the-risk-of-iot-vulnerabilities-in-the-remote-work-era"},{"key":"e_1_3_3_2_16_2","doi-asserted-by":"crossref","unstructured":"Yutong Du Cheng Huang Genpei Liang Zhihao Fu Dunhan Li and Yong Ding. 2023. ExpSeeker: Extract public exploit code information from social media. Applied Intelligence 53 12 (2023) 15772\u201315786.","DOI":"10.1007\/s10489-022-04178-9"},{"key":"e_1_3_3_2_17_2","first-page":"67","volume-title":"Sensors, and Command, Control, Communications, and Intelligence (C3I) Technologies for Homeland Security, Defense, and Law Enforcement Applications XVI","author":"Farris Katheryn\u00a0A","year":"2017","unstructured":"Katheryn\u00a0A Farris, John Sullivan, and George Cybenko. 2017. Vulnerability survival analysis: a novel approach to vulnerability management. In Sensors, and Command, Control, Communications, and Intelligence (C3I) Technologies for Homeland Security, Defense, and Law Enforcement Applications XVI, Vol.\u00a010184. SPIE, 67\u201380."},{"key":"e_1_3_3_2_18_2","first-page":"012008","volume-title":"Journal of Physics: Conference Series","volume":"974","author":"Faruk Alfensi","year":"2018","unstructured":"Alfensi Faruk. 2018. The comparison of proportional hazards and accelerated failure time models in analyzing the first birth interval survival data. In Journal of Physics: Conference Series, Vol.\u00a0974. IOP Publishing, 012008."},{"key":"e_1_3_3_2_19_2","unstructured":"Private Industry\u00a0Notification. Federal Bureau\u00a0of Investigation\u00a0(FBI). 2022. Unpatched and Outdated Medical Devices Provide Cyber Attack Opportunities. (2022). https:\/\/www.ic3.gov\/Media\/News\/2022\/220912.pdf"},{"key":"e_1_3_3_2_20_2","doi-asserted-by":"crossref","unstructured":"Glenn Heller and Qianxing Mo. 2016. Estimating the concordance probability in a survival analysis with a discrete number of risk groups. Lifetime data analysis 22 (2016) 263\u2013279.","DOI":"10.1007\/s10985-015-9330-3"},{"key":"e_1_3_3_2_21_2","doi-asserted-by":"crossref","unstructured":"Jay Jacobs Sasha Romanosky Idris Adjerid and Wade Baker. 2020. Improving vulnerability remediation through better exploit prediction. Journal of Cybersecurity 6 1 (2020) tyaa015.","DOI":"10.1093\/cybsec\/tyaa015"},{"key":"e_1_3_3_2_22_2","doi-asserted-by":"crossref","unstructured":"Jay Jacobs Sasha Romanosky Benjamin Edwards Idris Adjerid and Michael Roytman. 2021. Exploit prediction scoring system (epss). Digital Threats: Research and Practice 2 3 (2021) 1\u201317.","DOI":"10.1145\/3436242"},{"key":"e_1_3_3_2_23_2","unstructured":"Madeline Lauver. 2022. 53% of hospital IoT devices have security vulnerabilities. (2022). https:\/\/www.securitymagazine.com\/articles\/97065-53-of-hospital-iot-devices-have-security-vulnerabilities"},{"key":"e_1_3_3_2_24_2","doi-asserted-by":"crossref","unstructured":"In Lee. 2020. Internet of Things (IoT) cybersecurity: Literature review and IoT cyber risk management. Future internet 12 9 (2020) 157.","DOI":"10.3390\/fi12090157"},{"key":"e_1_3_3_2_25_2","doi-asserted-by":"crossref","unstructured":"In Lee and Kyoochun Lee. 2015. The Internet of Things (IoT): Applications investments and challenges for enterprises. Business horizons 58 4 (2015) 431\u2013440.","DOI":"10.1016\/j.bushor.2015.03.008"},{"key":"e_1_3_3_2_26_2","doi-asserted-by":"crossref","unstructured":"\u00c9ireann Leverett Matilda Rhode and Adam Wedgbury. 2022. Vulnerability Forecasting: Theory and practice. Digital Threats: Research and Practice 3 4 (2022) 1\u201327.","DOI":"10.1145\/3492328"},{"key":"e_1_3_3_2_27_2","doi-asserted-by":"publisher","DOI":"10.1145\/3133956.3134072"},{"key":"e_1_3_3_2_28_2","doi-asserted-by":"publisher","unstructured":"Pei Liu Bo Fu Simon\u00a0X. Yang Ling Deng Xiaorong Zhong and Hong Zheng. 2021. Optimizing Survival Analysis of XGBoost for Ties to Predict Disease Progression of Breast Cancer. IEEE Trans. Biomed. Eng. 68 1 (2021) 148\u2013160. 10.1109\/TBME.2020.2993278https:\/\/doi.org\/10.1109\/TBME.2020.2993278","DOI":"10.1109\/TBME.2020.2993278"},{"key":"e_1_3_3_2_29_2","doi-asserted-by":"crossref","first-page":"50","DOI":"10.1145\/3338507.3358619","volume-title":"Proceedings of the 2nd International ACM Workshop on Security and Privacy for the Internet-of-Things","author":"Maroof Uzma","year":"2019","unstructured":"Uzma Maroof, Arash Shaghaghi, and Sanjay Jha. 2019. PLAR: Towards a pluggable software architecture for securing IoT devices. In Proceedings of the 2nd International ACM Workshop on Security and Privacy for the Internet-of-Things. 50\u201357."},{"key":"e_1_3_3_2_30_2","volume-title":"2024 17th International Conference on Security of Information and Networks (SIN)","author":"Rivera\u00a0A. Carlos\u00a0A.","year":"2024","unstructured":"Carlos\u00a0A. Rivera\u00a0A., Arash Shaghaghi, Gustavo Batista, and Salil\u00a0S Kanhere. 2024. Towards Weaknesses and Attack Patterns Prediction for IoT Devices. In 2024 17th International Conference on Security of Information and Networks (SIN). IEEE."},{"key":"e_1_3_3_2_31_2","doi-asserted-by":"crossref","unstructured":"Luis\u00a0Puche Rondon Leonardo Babun Ahmet Aris Kemal Akkaya and A\u00a0Selcuk Uluagac. 2022. Survey on enterprise Internet-of-Things systems (E-IoT): A security perspective. Ad Hoc Networks 125 (2022) 102728.","DOI":"10.1016\/j.adhoc.2021.102728"},{"key":"e_1_3_3_2_32_2","doi-asserted-by":"crossref","unstructured":"Yaman Roumani. 2021. Patching zero-day vulnerabilities: an empirical analysis. Journal of Cybersecurity 7 1 (2021) tyab023.","DOI":"10.1093\/cybsec\/tyab023"},{"key":"e_1_3_3_2_33_2","doi-asserted-by":"crossref","unstructured":"Yaman Roumani and Joseph Nwankpa. 2020. Examining exploitability risk of vulnerabilities: a hazard model. Communications of the Association for Information Systems 46 1 (2020) 18.","DOI":"10.17705\/1CAIS.04618"},{"key":"e_1_3_3_2_34_2","first-page":"1041","volume-title":"24th USENIX Security Symposium (USENIX Security 15)","author":"Sabottke Carl","year":"2015","unstructured":"Carl Sabottke, Octavian Suciu, and Tudor Dumitra\u0219. 2015. Vulnerability disclosure in the age of social media: Exploiting twitter for predicting { Real-World} exploits. In 24th USENIX Security Symposium (USENIX Security 15). 1041\u20131056."},{"key":"e_1_3_3_2_35_2","doi-asserted-by":"publisher","unstructured":"Ravid Shwartz-Ziv and Amitai Armon. 2022. Tabular data: Deep learning is not all you need. Inf. Fusion 81 (2022) 84\u201390. 10.1016\/J.INFFUS.2021.11.011https:\/\/doi.org\/10.1016\/J.INFFUS.2021.11.011","DOI":"10.1016\/J.INFFUS.2021.11.011"},{"key":"e_1_3_3_2_36_2","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v32i1.11428"},{"key":"e_1_3_3_2_37_2","unstructured":"Lionel\u00a0Sujay Vailshery. 2022. Number of IoT connected devices worldwide 2019-2021 with forecasts to 2030. (2022). https:\/\/www.statista.com\/statistics\/1183457\/iot-connected-devices-worldwide\/"},{"key":"e_1_3_3_2_38_2","doi-asserted-by":"crossref","unstructured":"Ping Wang Yan Li and Chandan\u00a0K Reddy. 2019. Machine learning for survival analysis: A survey. ACM Computing Surveys (CSUR) 51 6 (2019) 1\u201336.","DOI":"10.1145\/3214306"},{"key":"e_1_3_3_2_39_2","doi-asserted-by":"crossref","unstructured":"Yating Wang Jinxia Su and Xuejing Zhao. 2023. Penalized semiparametric Cox regression model on XGBoost and random survival forests. Communications in Statistics-Simulation and Computation 52 7 (2023) 3095\u20133103.","DOI":"10.1080\/03610918.2021.1926505"}],"event":{"name":"ACSW 2025: 2025 Australasian Computer Science Week","location":"Brisbane Australia","acronym":"ACSW 2025"},"container-title":["Proceedings of the 2025 Australasian Computer Science Week"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3727166.3727189","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,28]],"date-time":"2025-06-28T04:19:32Z","timestamp":1751084372000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3727166.3727189"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,2,10]]},"references-count":38,"alternative-id":["10.1145\/3727166.3727189","10.1145\/3727166"],"URL":"https:\/\/doi.org\/10.1145\/3727166.3727189","relation":{},"subject":[],"published":{"date-parts":[[2025,2,10]]},"assertion":[{"value":"2025-06-27","order":3,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}