{"id":"https://openalex.org/W7220865601","doi":"https://doi.org/10.3390/computers15100681","title":"A Lifecycle-Oriented Architecture for Vulnerability Management and Security Assessment Planning in CMDB-Driven Environments","display_name":"A Lifecycle-Oriented Architecture for Vulnerability Management and Security Assessment Planning in CMDB-Driven Environments","publication_year":2026,"publication_date":"2026-10-07","ids":{"openalex":"https://openalex.org/W7220865601","doi":"https://doi.org/10.3390/computers15100681"},"language":"en","primary_location":{"id":"doi:10.3390/computers15100681","doi":"https://doi.org/10.3390/computers15100681","is_oa":true,"landing_page_url":"https://doi.org/10.3390/computers15100681","pdf_url":null,"source":{"id":"https://openalex.org/S4210228075","display_name":"Computers","issn_l":"2073-431X","issn":["2073-431X"],"is_oa":true,"is_in_doaj":true,"is_core":true,"listed_in":["cwts-core","doaj","norway-1","poland-20","russia-white-list-2"],"host_organization":"https://openalex.org/P4310310987","host_organization_name":"Multidisciplinary Digital Publishing Institute","host_organization_lineage":["https://openalex.org/P4310310987"],"host_organization_lineage_names":["Multidisciplinary Digital Publishing Institute"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Computers","raw_type":"journal-article"},"volume":null,"type":"article","is_traditional":true,"indexed_in":["crossref","doaj"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://doi.org/10.3390/computers15100681","any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5074361068","display_name":"Lu\u00eds Nogueira","orcid":"https://orcid.org/0000-0002-7094-0458","observed_orcids":["https://orcid.org/0000-0002-7094-0458"]},"institutions":[{"id":"https://openalex.org/I4405252524","display_name":"Centro de Investiga\u00e7\u00e3o em Sistemas Computacionais Embebidos e de Tempo-Real","ror":"https://ror.org/00mfa2s19","country_code":"PT","type":"education","lineage":["https://openalex.org/I4405252524"]},{"id":"https://openalex.org/I83863532","display_name":"Universidade T\u00e9cnica do Porto","ror":"https://ror.org/04988re48","country_code":"PT","type":"education","lineage":["https://openalex.org/I83863532"]}],"countries":["PT"],"is_corresponding":true,"raw_author_name":"Lu\u00eds Nogueira","raw_affiliation_strings":["Research Centre in Real-Time and Embedded Computing Systems (CISTER), 4200-135 Porto, Portugal","School of Engineering (ISEP), Technical University of Porto (UTP), 4249-015 Porto, Portugal"],"raw_orcid":"https://orcid.org/0000-0002-7094-0458","affiliations":[{"raw_affiliation_string":"Research Centre in Real-Time and Embedded Computing Systems (CISTER), 4200-135 Porto, Portugal","institution_ids":["https://openalex.org/I4405252524"]},{"raw_affiliation_string":"School of Engineering (ISEP), Technical University of Porto (UTP), 4249-015 Porto, Portugal","institution_ids":["https://openalex.org/I83863532"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5157824133","display_name":"Andr\u00e9 Duarte","orcid":"https://orcid.org/0009-0003-1468-4212","observed_orcids":["https://orcid.org/0009-0003-1468-4212"]},"institutions":[{"id":"https://openalex.org/I83863532","display_name":"Universidade T\u00e9cnica do Porto","ror":"https://ror.org/04988re48","country_code":"PT","type":"education","lineage":["https://openalex.org/I83863532"]}],"countries":["PT"],"is_corresponding":false,"raw_author_name":"Andr\u00e9 Duarte","raw_affiliation_strings":["School of Engineering (ISEP), Technical University of Porto (UTP), 4249-015 Porto, Portugal"],"raw_orcid":"https://orcid.org/0009-0003-1468-4212","affiliations":[{"raw_affiliation_string":"School of Engineering (ISEP), Technical University of Porto (UTP), 4249-015 Porto, Portugal","institution_ids":["https://openalex.org/I83863532"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":2,"corresponding_author_ids":["https://openalex.org/A5074361068"],"corresponding_institution_ids":["https://openalex.org/I4405252524","https://openalex.org/I83863532"],"apc_list":{"value":1800,"currency":"CHF","value_usd":2172},"apc_paid":{"value":1800,"currency":"CHF","value_usd":2172},"fwci":0.0,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":{"value":0.79032406,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":"15","issue":"10","first_page":"681","last_page":"681"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.9570000171661377,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.9570000171661377,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12479","display_name":"Web Application Security Vulnerabilities","score":0.026200000196695328,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.007699999958276749,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/vulnerability-management","display_name":"vulnerability management","score":0.9240000247955322},{"id":"https://openalex.org/keywords/configuration-management-database","display_name":"configuration management database","score":0.8759999871253967},{"id":"https://openalex.org/keywords/security-automation","display_name":"security automation","score":0.5120000243186951},{"id":"https://openalex.org/keywords/resilience-testing","display_name":"resilience testing","score":0.906000018119812},{"id":"https://openalex.org/keywords/financial-market-infrastructure","display_name":"financial market infrastructure","score":0.734000027179718}],"concepts":[{"id":"https://openalex.org/C31139447","wikidata":"https://www.wikidata.org/wiki/Q5380386","display_name":"Enterprise information security architecture","level":2,"score":0.616599977016449},{"id":"https://openalex.org/C167063184","wikidata":"https://www.wikidata.org/wiki/Q1400839","display_name":"Vulnerability assessment","level":3,"score":0.613099992275238},{"id":"https://openalex.org/C195094911","wikidata":"https://www.wikidata.org/wiki/Q14167904","display_name":"Process management","level":1,"score":0.5303999781608582},{"id":"https://openalex.org/C76178495","wikidata":"https://www.wikidata.org/wiki/Q4808784","display_name":"Asset (computer security)","level":2,"score":0.4964999854564667},{"id":"https://openalex.org/C95713431","wikidata":"https://www.wikidata.org/wiki/Q631425","display_name":"Vulnerability (computing)","level":2,"score":0.4959999918937683},{"id":"https://openalex.org/C103377522","wikidata":"https://www.wikidata.org/wiki/Q3493999","display_name":"Security information and event management","level":4,"score":0.48330000042915344},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.4722999930381775},{"id":"https://openalex.org/C56739046","wikidata":"https://www.wikidata.org/wiki/Q192060","display_name":"Knowledge management","level":1,"score":0.47189998626708984},{"id":"https://openalex.org/C2779585090","wikidata":"https://www.wikidata.org/wiki/Q3457762","display_name":"Resilience (materials science)","level":2,"score":0.4650999903678894},{"id":"https://openalex.org/C83163435","wikidata":"https://www.wikidata.org/wiki/Q3954104","display_name":"Security management","level":2,"score":0.43299999833106995},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.41769999265670776},{"id":"https://openalex.org/C527648132","wikidata":"https://www.wikidata.org/wiki/Q189900","display_name":"Information security","level":2,"score":0.39719998836517334},{"id":"https://openalex.org/C10590034","wikidata":"https://www.wikidata.org/wiki/Q1048431","display_name":"Enterprise architecture","level":3,"score":0.38749998807907104},{"id":"https://openalex.org/C172776598","wikidata":"https://www.wikidata.org/wiki/Q7943570","display_name":"Vulnerability management","level":4,"score":0.36980000138282776},{"id":"https://openalex.org/C2776517139","wikidata":"https://www.wikidata.org/wiki/Q873442","display_name":"Asset management","level":2,"score":0.35530000925064087},{"id":"https://openalex.org/C148976360","wikidata":"https://www.wikidata.org/wiki/Q1662500","display_name":"Information security management","level":5,"score":0.3504999876022339},{"id":"https://openalex.org/C112930515","wikidata":"https://www.wikidata.org/wiki/Q4389547","display_name":"Risk analysis (engineering)","level":1,"score":0.3490000069141388},{"id":"https://openalex.org/C43645609","wikidata":"https://www.wikidata.org/wiki/Q60750670","display_name":"Information technology operations","level":3,"score":0.33230000734329224},{"id":"https://openalex.org/C57041688","wikidata":"https://www.wikidata.org/wiki/Q220644","display_name":"Service-oriented architecture","level":3,"score":0.3271999955177307},{"id":"https://openalex.org/C2779343474","wikidata":"https://www.wikidata.org/wiki/Q3109175","display_name":"Context (archaeology)","level":2,"score":0.3215000033378601},{"id":"https://openalex.org/C144133560","wikidata":"https://www.wikidata.org/wiki/Q4830453","display_name":"Business","level":0,"score":0.32109999656677246},{"id":"https://openalex.org/C29983905","wikidata":"https://www.wikidata.org/wiki/Q7445066","display_name":"Security service","level":3,"score":0.30809998512268066},{"id":"https://openalex.org/C60172848","wikidata":"https://www.wikidata.org/wiki/Q7495506","display_name":"Sherwood Applied Business Security Architecture","level":5,"score":0.29499998688697815},{"id":"https://openalex.org/C2777960535","wikidata":"https://www.wikidata.org/wiki/Q131508","display_name":"Enterprise resource planning","level":2,"score":0.2782999873161316},{"id":"https://openalex.org/C2776664667","wikidata":"https://www.wikidata.org/wiki/Q1481411","display_name":"IT service management","level":4,"score":0.2750999927520752},{"id":"https://openalex.org/C2780378061","wikidata":"https://www.wikidata.org/wiki/Q25351891","display_name":"Service (business)","level":2,"score":0.26910001039505005},{"id":"https://openalex.org/C180823521","wikidata":"https://www.wikidata.org/wiki/Q1662502","display_name":"Certified Information Security Manager","level":5,"score":0.26840001344680786},{"id":"https://openalex.org/C32896092","wikidata":"https://www.wikidata.org/wiki/Q189447","display_name":"Risk management","level":2,"score":0.2678000032901764},{"id":"https://openalex.org/C2776014549","wikidata":"https://www.wikidata.org/wiki/Q3050847","display_name":"Consolidation (business)","level":2,"score":0.26019999384880066},{"id":"https://openalex.org/C27295321","wikidata":"https://www.wikidata.org/wiki/Q831795","display_name":"Enterprise information system","level":2,"score":0.257099986076355},{"id":"https://openalex.org/C62913178","wikidata":"https://www.wikidata.org/wiki/Q7554361","display_name":"Software security assurance","level":4,"score":0.2549999952316284}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.3390/computers15100681","doi":"https://doi.org/10.3390/computers15100681","is_oa":true,"landing_page_url":"https://doi.org/10.3390/computers15100681","pdf_url":null,"source":{"id":"https://openalex.org/S4210228075","display_name":"Computers","issn_l":"2073-431X","issn":["2073-431X"],"is_oa":true,"is_in_doaj":true,"is_core":true,"listed_in":["cwts-core","doaj","norway-1","poland-20","russia-white-list-2"],"host_organization":"https://openalex.org/P4310310987","host_organization_name":"Multidisciplinary Digital Publishing Institute","host_organization_lineage":["https://openalex.org/P4310310987"],"host_organization_lineage_names":["Multidisciplinary Digital Publishing Institute"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Computers","raw_type":"journal-article"},{"id":"pmh:oai:doaj.org/article:56b1fdf6ca0c4048938b7edbccb74873","doi":null,"is_oa":false,"landing_page_url":"https://doaj.org/article/56b1fdf6ca0c4048938b7edbccb74873","pdf_url":null,"source":{"id":"https://openalex.org/S4306401280","display_name":"DOAJ (DOAJ: Directory of Open Access Journals)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"Computers, Vol 15, Iss 10, p 681 (2026)","raw_type":"article"}],"best_oa_location":{"id":"doi:10.3390/computers15100681","doi":"https://doi.org/10.3390/computers15100681","is_oa":true,"landing_page_url":"https://doi.org/10.3390/computers15100681","pdf_url":null,"source":{"id":"https://openalex.org/S4210228075","display_name":"Computers","issn_l":"2073-431X","issn":["2073-431X"],"is_oa":true,"is_in_doaj":true,"is_core":true,"listed_in":["cwts-core","doaj","norway-1","poland-20","russia-white-list-2"],"host_organization":"https://openalex.org/P4310310987","host_organization_name":"Multidisciplinary Digital Publishing Institute","host_organization_lineage":["https://openalex.org/P4310310987"],"host_organization_lineage_names":["Multidisciplinary Digital Publishing Institute"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Computers","raw_type":"journal-article"},"sustainable_development_goals":[],"study_designs":[],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":13,"referenced_works":["https://openalex.org/W3016327142","https://openalex.org/W3193339215","https://openalex.org/W3206487040","https://openalex.org/W3214395631","https://openalex.org/W4206313867","https://openalex.org/W4246409399","https://openalex.org/W4322704102","https://openalex.org/W4360841606","https://openalex.org/W4388740140","https://openalex.org/W4392121222","https://openalex.org/W4400033176","https://openalex.org/W4402264535","https://openalex.org/W6922071056"],"related_works":["https://openalex.org/W7134259877","https://openalex.org/W1978425056","https://openalex.org/W7167069065","https://openalex.org/W4238498475","https://openalex.org/W2007778041","https://openalex.org/W7162992874","https://openalex.org/W2007218974","https://openalex.org/W7223472034","https://openalex.org/W6930866012","https://openalex.org/W4206368806"],"abstract_inverted_index":{"Enterprise":[0],"vulnerability":[1,32,65,95,269],"management":[2,76],"increasingly":[3],"relies":[4],"on":[5],"heterogeneous":[6,98],"security":[7,18,25,60,99,174],"platforms":[8],"that":[9,51],"provide":[10,248],"complementary":[11,79],"but":[12],"fragmented":[13],"views":[14],"of":[15,31,201,228,250,257,268,280],"the":[16,29,58,81,87,104,115,182,220,233,239,251,258,262,266,274,278],"organizational":[17,37,127],"posture.":[19],"Transforming":[20],"this":[21,53,123],"information":[22,96],"into":[23],"coordinated":[24],"assessment":[26,40,72,131,135,178],"activities":[27],"requires":[28],"integration":[30,54],"intelligence,":[33],"enterprise":[34,111,152],"asset":[35],"context,":[36],"policies,":[38],"historical":[39],"knowledge,":[41],"and":[42,68,74,86,102,107,129,142,157,171,194,212,235,253,277,283],"operational":[43,140,255],"workflows.":[44],"This":[45],"paper":[46],"presents":[47],"a":[48],"lifecycle-oriented":[49],"architecture":[50,63,260],"addresses":[52],"problem":[55],"without":[56],"replacing":[57],"existing":[59],"ecosystem.":[61],"The":[62,92,120,163,246],"separates":[64],"intelligence":[66,125],"acquisition":[67],"consolidation":[69,204,270],"from":[70,97,114],"persistent":[71,130],"planning":[73,281],"lifecycle":[75,143],"through":[77],"two":[78],"services:":[80],"Security":[82],"Automation":[83],"Service":[84],"(SAS)":[85],"Resilience":[88],"Testing":[89],"Framework":[90],"(RTF).":[91],"SAS":[93,234],"acquires":[94],"platforms,":[100,175],"normalizes":[101],"correlates":[103],"resulting":[105],"observations,":[106],"enriches":[108],"them":[109],"with":[110,126,176,241],"context":[112],"retrieved":[113],"Configuration":[116],"Management":[117],"Database":[118],"(CMDB).":[119],"RTF":[121],"combines":[122],"contextualized":[124],"policies":[128],"knowledge":[132],"to":[133,273],"support":[134],"prioritization,":[136],"strategy":[137],"selection,":[138],"scheduling,":[139],"synchronization,":[141],"evolution.":[144],"A":[145,215],"functional":[146],"prototype":[147],"was":[148],"deployed":[149],"in":[150,207,224,261],"an":[151],"financial":[153],"market":[154],"infrastructure":[155],"environment":[156],"observed":[158,243,254],"for":[159,232,238],"approximately":[160,168,229],"one":[161],"year.":[162],"industrial":[164],"case":[165],"study":[166],"covered":[167],"1150":[169],"assets":[170],"eight":[172],"integrated":[173],"756":[177],"plans":[179,188],"processed":[180],"during":[181],"observation":[183],"period.":[184],"Of":[185],"these,":[186],"612":[187],"were":[189,192,196],"reused,":[190],"19":[191],"updated,":[193],"125":[195],"newly":[197],"created.":[198],"Manual":[199],"validation":[200,267],"50":[202],"sampled":[203,275],"cases":[205,276],"resulted":[206,223],"93.5%":[208],"precision,":[209],"96.7%":[210],"recall,":[211],"95.1%":[213],"F1-score.":[214],"separate":[216],"load":[217],"test":[218],"under":[219],"tested":[221],"conditions":[222],"average":[225],"response":[226],"times":[227],"3":[230],"ms":[231,237],"4":[236],"RTF,":[240],"no":[242],"request":[244],"errors.":[245],"results":[247],"evidence":[249],"feasibility":[252],"behaviour":[256],"proposed":[259],"evaluated":[263],"environment,":[264],"while":[265],"is":[271],"limited":[272],"correctness":[279],"decisions":[282],"general":[284],"scalability":[285],"remain":[286],"independently":[287],"unvalidated.":[288]},"counts_by_year":[],"updated_date":"2026-11-04T10:54:05.112534","created_date":"2026-10-08T00:00:00"}