{"id":"https://openalex.org/W2906845177","doi":"https://doi.org/10.1109/candar.2018.00009","title":"The Effect of Common Vulnerability Scoring System Metrics on Vulnerability Exploit Delay","display_name":"The Effect of Common Vulnerability Scoring System Metrics on Vulnerability Exploit Delay","publication_year":2018,"publication_date":"2018-11-01","ids":{"openalex":"https://openalex.org/W2906845177","doi":"https://doi.org/10.1109/candar.2018.00009","mag":"2906845177"},"language":"en","primary_location":{"id":"doi:10.1109/candar.2018.00009","doi":"https://doi.org/10.1109/candar.2018.00009","is_oa":false,"landing_page_url":"https://doi.org/10.1109/candar.2018.00009","pdf_url":null,"source":{"id":"https://openalex.org/S4306420119","display_name":"International Symposium on Computing and Networking","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"conference"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2018 Sixth International Symposium on Computing and Networking (CANDAR)","raw_type":"proceedings-article"},"volume":null,"type":"conference-paper","is_traditional":true,"indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5007448622","display_name":"Andrew Feutrill","orcid":"https://orcid.org/0000-0002-7549-4557","observed_orcids":["https://orcid.org/0000-0002-7549-4557"]},"institutions":[{"id":"https://openalex.org/I4210123005","display_name":"ARC Centre of Excellence for Mathematical and Statistical Frontiers","ror":"https://ror.org/02vcqg248","country_code":"AU","type":"facility","lineage":["https://openalex.org/I1337719021","https://openalex.org/I165779595","https://openalex.org/I2801453606","https://openalex.org/I4210123005","https://openalex.org/I4210132349"]},{"id":"https://openalex.org/I5681781","display_name":"The University of Adelaide","ror":"https://ror.org/00892tw58","country_code":"AU","type":"education","lineage":["https://openalex.org/I4405259444","https://openalex.org/I5681781"]}],"countries":["AU"],"is_corresponding":false,"raw_author_name":"Andrew Feutrill","raw_affiliation_strings":["ARC Centre of Excellence for Mathematical and Statistical Frontiers, University of Adelaide"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"ARC Centre of Excellence for Mathematical and Statistical Frontiers, University of Adelaide","institution_ids":["https://openalex.org/I4210123005","https://openalex.org/I5681781"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5022847596","display_name":"Dinesha Ranathunga","orcid":"https://orcid.org/0000-0002-8665-371X","observed_orcids":["https://orcid.org/0000-0002-8665-371X"]},"institutions":[{"id":"https://openalex.org/I5681781","display_name":"The University of Adelaide","ror":"https://ror.org/00892tw58","country_code":"AU","type":"education","lineage":["https://openalex.org/I4405259444","https://openalex.org/I5681781"]}],"countries":["AU"],"is_corresponding":false,"raw_author_name":"Dinesha Ranathunga","raw_affiliation_strings":["School of Computer Science, University of Adelaide"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"School of Computer Science, University of Adelaide","institution_ids":["https://openalex.org/I5681781"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5056484605","display_name":"Yuval Yarom","orcid":"https://orcid.org/0000-0003-0401-4197","observed_orcids":["https://orcid.org/0000-0003-0401-4197"]},"institutions":[{"id":"https://openalex.org/I4405279643","display_name":"Data to Decisions Cooperative Research Centre","ror":"https://ror.org/01t1f0m13","country_code":"AU","type":"funder","lineage":["https://openalex.org/I4405279643"]}],"countries":["AU"],"is_corresponding":false,"raw_author_name":"Yuval Yarom","raw_affiliation_strings":["Data to Decisions CRC"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Data to Decisions CRC","institution_ids":["https://openalex.org/I4405279643"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5016001264","display_name":"Matthew Roughan","orcid":"https://orcid.org/0000-0002-7882-7329","observed_orcids":["https://orcid.org/0000-0002-7882-7329"]},"institutions":[{"id":"https://openalex.org/I5681781","display_name":"The University of Adelaide","ror":"https://ror.org/00892tw58","country_code":"AU","type":"education","lineage":["https://openalex.org/I4405259444","https://openalex.org/I5681781"]}],"countries":["AU"],"is_corresponding":false,"raw_author_name":"Matthew Roughan","raw_affiliation_strings":["School of Computer Science, University of Adelaide"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"School of Computer Science, University of Adelaide","institution_ids":["https://openalex.org/I5681781"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":3,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":3.6795,"has_fulltext":false,"cited_by_count":53,"citation_normalized_percentile":{"value":0.94747705,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":88,"max":99},"biblio":{"volume":null,"issue":null,"first_page":"1","last_page":"10"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T12479","display_name":"Web Application Security Vulnerabilities","score":0.8252000212669373,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T12479","display_name":"Web Application Security Vulnerabilities","score":0.8252000212669373,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.16130000352859497,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.006800000090152025,"subfield":{"id":"https://openalex.org/subfields/1708","display_name":"Hardware and Architecture"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/cvss","display_name":"CVSS","score":0.9959999918937683},{"id":"https://openalex.org/keywords/vulnerability-disclosure","display_name":"vulnerability disclosure","score":0.5550000071525574},{"id":"https://openalex.org/keywords/national-vulnerability-database","display_name":"National Vulnerability Database","score":0.8859999775886536},{"id":"https://openalex.org/keywords/software-security","display_name":"software security","score":0.5170000195503235}],"concepts":[{"id":"https://openalex.org/C165696696","wikidata":"https://www.wikidata.org/wiki/Q11287","display_name":"Exploit","level":2,"score":0.985026478767395},{"id":"https://openalex.org/C95713431","wikidata":"https://www.wikidata.org/wiki/Q631425","display_name":"Vulnerability (computing)","level":2,"score":0.8669060468673706},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7760915756225586},{"id":"https://openalex.org/C172776598","wikidata":"https://www.wikidata.org/wiki/Q7943570","display_name":"Vulnerability management","level":4,"score":0.5433050990104675},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.5252649188041687},{"id":"https://openalex.org/C167063184","wikidata":"https://www.wikidata.org/wiki/Q1400839","display_name":"Vulnerability assessment","level":3,"score":0.49257785081863403},{"id":"https://openalex.org/C112930515","wikidata":"https://www.wikidata.org/wiki/Q4389547","display_name":"Risk analysis (engineering)","level":1,"score":0.3363540470600128},{"id":"https://openalex.org/C144133560","wikidata":"https://www.wikidata.org/wiki/Q4830453","display_name":"Business","level":0,"score":0.14124056696891785},{"id":"https://openalex.org/C71924100","wikidata":"https://www.wikidata.org/wiki/Q11190","display_name":"Medicine","level":0,"score":0.0832611620426178},{"id":"https://openalex.org/C118552586","wikidata":"https://www.wikidata.org/wiki/Q7867","display_name":"Psychiatry","level":1,"score":0.0},{"id":"https://openalex.org/C27415008","wikidata":"https://www.wikidata.org/wiki/Q7256382","display_name":"Psychological intervention","level":2,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/candar.2018.00009","doi":"https://doi.org/10.1109/candar.2018.00009","is_oa":false,"landing_page_url":"https://doi.org/10.1109/candar.2018.00009","pdf_url":null,"source":{"id":"https://openalex.org/S4306420119","display_name":"International Symposium on Computing and Networking","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"conference"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2018 Sixth International Symposium on Computing and Networking (CANDAR)","raw_type":"proceedings-article"}],"best_oa_location":null,"sustainable_development_goals":[],"study_designs":[],"awards":[],"funders":[{"id":"https://openalex.org/F4320335741","display_name":"Data to Decisions Cooperative Research Centres","ror":"https://ror.org/01t1f0m13"}],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":14,"referenced_works":["https://openalex.org/W33506368","https://openalex.org/W150078352","https://openalex.org/W918972627","https://openalex.org/W1707806712","https://openalex.org/W1971733255","https://openalex.org/W2077937403","https://openalex.org/W2106865630","https://openalex.org/W2108246235","https://openalex.org/W2155923496","https://openalex.org/W2489040287","https://openalex.org/W2595368813","https://openalex.org/W2603292144","https://openalex.org/W2610800826","https://openalex.org/W3137883743"],"related_works":["https://openalex.org/W3100479002","https://openalex.org/W4240236915","https://openalex.org/W4396944851","https://openalex.org/W2965876165","https://openalex.org/W4385655814","https://openalex.org/W2037027324","https://openalex.org/W2967263059","https://openalex.org/W3127389863","https://openalex.org/W7161486896","https://openalex.org/W2561590396"],"abstract_inverted_index":{"Modern":[0],"system":[1,95],"administrators":[2,32,96],"need":[3],"to":[4,36,47,75,148,185,187,211],"monitor":[5],"disclosed":[6],"software":[7],"vulnerabilities":[8,12,24,35,50,144],"and":[9,16,55,94,132,145,171],"address":[10],"applicable":[11],"via":[13],"patching,":[14],"reconfiguration":[15],"other":[17],"measures.":[18],"In":[19,104],"2017,":[20],"over":[21],"14,000":[22],"new":[23],"were":[25],"disclosed,":[26],"so,":[27],"a":[28,66,78,118,181],"key":[29],"question":[30],"for":[31,77],"is":[33,44,63,123,193],"which":[34,49,136],"prioritise.":[37],"The":[38],"Common":[39],"Vulnerability":[40,129],"Scoring":[41],"System":[42],"(CVSS)":[43],"often":[45],"used":[46],"decide":[48],"pose":[51],"the":[52,73,99,109,115,127,133,140,163,174,198],"greatest":[53],"risk":[54],"hence":[56],"inform":[57],"patching":[58],"policy.":[59],"A":[60,80],"CVSS":[61,112,151,169],"score":[62],"indicative":[64],"of":[65,82,101,111,120,139,143],"vulnerability":[67,203],"severity,":[68],"but":[69],"it":[70],"doesn't":[71],"predict":[72],"time":[74,116,164,205],"exploit":[76,83,122,146,158,204],"vulnerability.":[79],"prediction":[81],"delay":[84,176],"would":[85],"greatly":[86],"assist":[87],"vendors":[88],"in":[89,97,190,201,209,214],"prioritising":[90,98],"their":[91],"patch":[92],"releases":[93],"installation":[100],"these":[102],"patches.":[103],"this":[105],"paper,":[106],"we":[107],"study":[108],"effect":[110],"metrics":[113,152,170],"on":[114],"until":[117],"proof":[119],"concept":[121],"developed.":[124],"We":[125,160],"use":[126],"National":[128],"Database":[130],"(NVD)":[131],"Exploit":[134],"Database,":[135],"represent":[137],"two":[138],"largest":[141],"listings":[142],"data,":[147],"show":[149],"how":[150],"can":[153],"provide":[154],"better":[155],"insight":[156],"into":[157],"delay.":[159],"also":[161],"investigate":[162],"lag":[165],"associated":[166],"with":[167],"populating":[168],"find":[172],"that":[173],"median":[175,202],"has":[177],"increased":[178],"rapidly":[179],"from":[180,206],"single":[182],"day":[183],"prior":[184],"2017":[186],"19":[188],"days":[189,208,213],"2018.":[191,215],"This":[192],"an":[194],"alarming":[195],"trend,":[196],"given":[197],"rapid":[199],"decline":[200],"296":[207],"2005":[210],"six":[212]},"counts_by_year":[{"year":2026,"cited_by_count":3},{"year":2025,"cited_by_count":7},{"year":2024,"cited_by_count":5},{"year":2023,"cited_by_count":8},{"year":2022,"cited_by_count":8},{"year":2021,"cited_by_count":11},{"year":2020,"cited_by_count":10},{"year":2019,"cited_by_count":1}],"updated_date":"2026-11-07T11:25:07.637180","created_date":"2019-01-11T00:00:00"}