{"id":"https://openalex.org/W4399909403","doi":"https://doi.org/10.1109/icnc59896.2024.10556231","title":"Towards Automatically Matching Security Advisories to CPEs: String Similarity-based Vendor Matching","display_name":"Towards Automatically Matching Security Advisories to CPEs: String Similarity-based Vendor Matching","publication_year":2024,"publication_date":"2024-02-19","ids":{"openalex":"https://openalex.org/W4399909403","doi":"https://doi.org/10.1109/icnc59896.2024.10556231"},"language":"en","primary_location":{"id":"doi:10.1109/icnc59896.2024.10556231","is_oa":false,"landing_page_url":"https://doi.org/10.1109/icnc59896.2024.10556231","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2024 International Conference on Computing, Networking and Communications (ICNC)","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5010750132","display_name":"Kylie McClanahan","orcid":"https://orcid.org/0000-0002-7809-6554"},"institutions":[{"id":"https://openalex.org/I78715868","display_name":"University of Arkansas at Fayetteville","ror":"https://ror.org/05jbt9m15","country_code":"US","type":"education","lineage":["https://openalex.org/I78715868"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Kylie McClanahan","raw_affiliation_strings":["University of Arkansas"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of Arkansas","institution_ids":["https://openalex.org/I78715868"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5100670308","display_name":"Qinghua Li","orcid":"https://orcid.org/0009-0004-5811-3689"},"institutions":[{"id":"https://openalex.org/I78715868","display_name":"University of Arkansas at Fayetteville","ror":"https://ror.org/05jbt9m15","country_code":"US","type":"education","lineage":["https://openalex.org/I78715868"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Qinghua Li","raw_affiliation_strings":["University of Arkansas"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of Arkansas","institution_ids":["https://openalex.org/I78715868"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":["https://openalex.org/I78715868"],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":6,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":"233","last_page":"238"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11719","display_name":"Data Quality and Management","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/1803","display_name":"Management Science and Operations Research"},"field":{"id":"https://openalex.org/fields/18","display_name":"Decision Sciences"},"domain":{"id":"https://openalex.org/domains/2","display_name":"Social Sciences"}},"topics":[{"id":"https://openalex.org/T11719","display_name":"Data Quality and Management","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/1803","display_name":"Management Science and Operations Research"},"field":{"id":"https://openalex.org/fields/18","display_name":"Decision Sciences"},"domain":{"id":"https://openalex.org/domains/2","display_name":"Social Sciences"}},{"id":"https://openalex.org/T12479","display_name":"Web Application Security Vulnerabilities","score":0.9944999814033508,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12016","display_name":"Web Data Mining and Analysis","score":0.9937000274658203,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.7391720414161682},{"id":"https://openalex.org/keywords/string-metric","display_name":"String metric","score":0.701052725315094},{"id":"https://openalex.org/keywords/string-searching-algorithm","display_name":"String searching algorithm","score":0.6920396685600281},{"id":"https://openalex.org/keywords/matching","display_name":"Matching (statistics)","score":0.685307502746582},{"id":"https://openalex.org/keywords/vendor","display_name":"Vendor","score":0.6565819382667542},{"id":"https://openalex.org/keywords/similarity","display_name":"Similarity (geometry)","score":0.5361585021018982},{"id":"https://openalex.org/keywords/approximate-string-matching","display_name":"Approximate string matching","score":0.505003035068512},{"id":"https://openalex.org/keywords/pattern-matching","display_name":"Pattern matching","score":0.39196425676345825},{"id":"https://openalex.org/keywords/information-retrieval","display_name":"Information retrieval","score":0.3247203826904297},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.2714742422103882},{"id":"https://openalex.org/keywords/mathematics","display_name":"Mathematics","score":0.07929202914237976}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7391720414161682},{"id":"https://openalex.org/C22820288","wikidata":"https://www.wikidata.org/wiki/Q9050568","display_name":"String metric","level":4,"score":0.701052725315094},{"id":"https://openalex.org/C7757238","wikidata":"https://www.wikidata.org/wiki/Q374040","display_name":"String searching algorithm","level":3,"score":0.6920396685600281},{"id":"https://openalex.org/C165064840","wikidata":"https://www.wikidata.org/wiki/Q1321061","display_name":"Matching (statistics)","level":2,"score":0.685307502746582},{"id":"https://openalex.org/C2777338717","wikidata":"https://www.wikidata.org/wiki/Q1762621","display_name":"Vendor","level":2,"score":0.6565819382667542},{"id":"https://openalex.org/C103278499","wikidata":"https://www.wikidata.org/wiki/Q254465","display_name":"Similarity (geometry)","level":3,"score":0.5361585021018982},{"id":"https://openalex.org/C32610155","wikidata":"https://www.wikidata.org/wiki/Q1798621","display_name":"Approximate string matching","level":3,"score":0.505003035068512},{"id":"https://openalex.org/C68859911","wikidata":"https://www.wikidata.org/wiki/Q1503724","display_name":"Pattern matching","level":2,"score":0.39196425676345825},{"id":"https://openalex.org/C23123220","wikidata":"https://www.wikidata.org/wiki/Q816826","display_name":"Information retrieval","level":1,"score":0.3247203826904297},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.2714742422103882},{"id":"https://openalex.org/C33923547","wikidata":"https://www.wikidata.org/wiki/Q395","display_name":"Mathematics","level":0,"score":0.07929202914237976},{"id":"https://openalex.org/C105795698","wikidata":"https://www.wikidata.org/wiki/Q12483","display_name":"Statistics","level":1,"score":0.0},{"id":"https://openalex.org/C144133560","wikidata":"https://www.wikidata.org/wiki/Q4830453","display_name":"Business","level":0,"score":0.0},{"id":"https://openalex.org/C162853370","wikidata":"https://www.wikidata.org/wiki/Q39809","display_name":"Marketing","level":1,"score":0.0},{"id":"https://openalex.org/C115961682","wikidata":"https://www.wikidata.org/wiki/Q860623","display_name":"Image (mathematics)","level":2,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/icnc59896.2024.10556231","is_oa":false,"landing_page_url":"https://doi.org/10.1109/icnc59896.2024.10556231","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2024 International Conference on Computing, Networking and Communications (ICNC)","raw_type":"proceedings-article"}],"best_oa_location":null,"sustainable_development_goals":[],"awards":[{"id":"https://openalex.org/G850776510","display_name":null,"funder_award_id":"DE-CR0000003","funder_id":"https://openalex.org/F4320306084","funder_display_name":"U.S. Department of Energy"}],"funders":[{"id":"https://openalex.org/F4320306084","display_name":"U.S. Department of Energy","ror":"https://ror.org/01bj3aw27"}],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":22,"referenced_works":["https://openalex.org/W41404523","https://openalex.org/W1581712682","https://openalex.org/W1647671624","https://openalex.org/W2034190452","https://openalex.org/W2060417289","https://openalex.org/W3041550943","https://openalex.org/W3047932800","https://openalex.org/W3048335302","https://openalex.org/W3114772106","https://openalex.org/W3155638005","https://openalex.org/W3193977931","https://openalex.org/W3197955032","https://openalex.org/W3210147837","https://openalex.org/W4206001290","https://openalex.org/W4242744113","https://openalex.org/W4247397059","https://openalex.org/W4294352778","https://openalex.org/W4360605004","https://openalex.org/W4399909337","https://openalex.org/W6636771404","https://openalex.org/W6636915900","https://openalex.org/W6737911558"],"related_works":["https://openalex.org/W2257399947","https://openalex.org/W2371263218","https://openalex.org/W2141423589","https://openalex.org/W2386746909","https://openalex.org/W2399644331","https://openalex.org/W2037600093","https://openalex.org/W2245915510","https://openalex.org/W2366300241","https://openalex.org/W3145288231","https://openalex.org/W4210951666"],"abstract_inverted_index":{"When":[0],"a":[1,29,76,99,113,164,221],"vulnerability":[2,26],"is":[3,27,65,112,161,227],"reported":[4],"by":[5,233],"the":[6,16,25,54,86,95,104,108,122,129,137,142,148,156,168,175,183,188,195,216,238],"National":[7],"Vulnerability":[8],"Database":[9],"(NVD),":[10],"affected":[11,73],"products":[12,74,97],"are":[13],"listed":[14],"in":[15,28,75,98,107,133,141,174,237],"structured":[17,77,92,138],"Common":[18],"Platform":[19],"Enumeration":[20],"(CPE)":[21],"format.":[22,145],"Unfortunately,":[23],"if":[24,62],"software":[30],"library":[31],"(e.g.,":[32],"Log4j),":[33],"it":[34],"will":[35,191],"not":[36,71],"include":[37],"CPEs":[38,93],"for":[39,94,210],"each":[40,172],"product":[41,64],"containing":[42],"that":[43,226],"library.":[44],"In":[45],"these":[46,68],"cases,":[47],"security":[48,58,101,134],"operators":[49],"need":[50],"to":[51,60,136,154,162,187],"manually":[52],"read":[53],"vendor's":[55],"or":[56],"third-party":[57],"advisories":[59,69,135],"see":[61],"their":[63],"affected.":[66],"However,":[67],"do":[70],"report":[72],"format,":[78],"which":[79],"prevents":[80],"automated":[81],"processing,":[82],"This":[83],"paper":[84,118],"makes":[85],"first":[87,198],"effort":[88],"towards":[89],"automatically":[90],"constructing":[91],"vulnerable":[96],"non-NVD":[100,169],"advisory":[102,170],"from":[103,167,229],"unstructured":[105],"data":[106],"advisory.":[109],"Since":[110],"this":[111,117,211],"very":[114],"challenging":[115],"problem,":[116],"specifically":[119],"focuses":[120],"on":[121],"initial":[123],"but":[124],"key":[125],"step":[126],"of":[127,150,204],"matching":[128,212],"un-structured":[130],"vendor":[131,139,165,173,181,190,240],"names":[132],"representations":[140],"standard":[143],"CPE":[144,177,180],"We":[146,197],"explore":[147],"feasibility":[149],"using":[151],"string":[152,207,223],"similarity":[153,185,208,224],"solve":[155],"problem.":[157,213],"The":[158,179],"basic":[159],"idea":[160],"compare":[163],"name":[166,241],"with":[171,182],"official":[176],"dictionary.":[178],"highest":[184],"score":[186],"advisory's":[189,239],"be":[192],"considered":[193],"as":[194],"match.":[196],"conduct":[199],"an":[200,230],"experimental,":[201],"comparative":[202],"study":[203],"multiple":[205],"mainstream":[206],"metrics":[209],"To":[214],"improve":[215],"performance,":[217],"we":[218],"then":[219],"design":[220],"new":[222],"metric":[225,232],"adapted":[228],"existing":[231],"weighing":[234],"different":[235],"tokens":[236],"differently.":[242]},"counts_by_year":[{"year":2026,"cited_by_count":1},{"year":2025,"cited_by_count":3},{"year":2024,"cited_by_count":2}],"updated_date":"2026-07-14T23:27:15.235271","created_date":"2025-10-10T00:00:00"}