{"id":"https://openalex.org/W4393233304","doi":"https://doi.org/10.1145/3654443","title":"Early and Realistic Exploitability Prediction of Just-Disclosed Software Vulnerabilities: How Reliable Can It Be?","display_name":"Early and Realistic Exploitability Prediction of Just-Disclosed Software Vulnerabilities: How Reliable Can It Be?","publication_year":2024,"publication_date":"2024-03-27","ids":{"openalex":"https://openalex.org/W4393233304","doi":"https://doi.org/10.1145/3654443"},"language":"en","primary_location":{"id":"doi:10.1145/3654443","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3654443","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/3654443","source":{"id":"https://openalex.org/S142627899","display_name":"ACM Transactions on Software Engineering and Methodology","issn_l":"1049-331X","issn":["1049-331X","1557-7392"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319798","host_organization_name":"Association for Computing Machinery","host_organization_lineage":["https://openalex.org/P4310319798"],"host_organization_lineage_names":["Association for Computing Machinery"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"ACM Transactions on Software Engineering and Methodology","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"bronze","oa_url":"https://dl.acm.org/doi/pdf/10.1145/3654443","any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5037237385","display_name":"Emanuele Iannone","orcid":"https://orcid.org/0000-0001-7489-9969"},"institutions":[{"id":"https://openalex.org/I131729948","display_name":"University of Salerno","ror":"https://ror.org/0192m2k53","country_code":"IT","type":"education","lineage":["https://openalex.org/I131729948"]}],"countries":["IT"],"is_corresponding":false,"raw_author_name":"Emanuele Iannone","raw_affiliation_strings":["Department of Computer Science, University of Salerno, Fisciano, Italy","Software Engineering (SeSa) Lab. University of Salerno, Fisciano, Italy"],"raw_orcid":"https://orcid.org/0000-0001-7489-9969","affiliations":[{"raw_affiliation_string":"Department of Computer Science, University of Salerno, Fisciano, Italy","institution_ids":["https://openalex.org/I131729948"]},{"raw_affiliation_string":"Software Engineering (SeSa) Lab. University of Salerno, Fisciano, Italy","institution_ids":["https://openalex.org/I131729948"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5052880185","display_name":"Giulia Sellitto","orcid":"https://orcid.org/0000-0002-5491-0873"},"institutions":[{"id":"https://openalex.org/I131729948","display_name":"University of Salerno","ror":"https://ror.org/0192m2k53","country_code":"IT","type":"education","lineage":["https://openalex.org/I131729948"]}],"countries":["IT"],"is_corresponding":false,"raw_author_name":"Giulia Sellitto","raw_affiliation_strings":["Department of Computer Science, University of Salerno, Fisciano, Italy","Software Engineering (SeSa) Lab. University of Salerno, Fisciano, Italy"],"raw_orcid":"https://orcid.org/0000-0002-5491-0873","affiliations":[{"raw_affiliation_string":"Department of Computer Science, University of Salerno, Fisciano, Italy","institution_ids":["https://openalex.org/I131729948"]},{"raw_affiliation_string":"Software Engineering (SeSa) Lab. University of Salerno, Fisciano, Italy","institution_ids":["https://openalex.org/I131729948"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5094261058","display_name":"Emanuele Iaccarino","orcid":"https://orcid.org/0009-0004-1319-7604"},"institutions":[{"id":"https://openalex.org/I131729948","display_name":"University of Salerno","ror":"https://ror.org/0192m2k53","country_code":"IT","type":"education","lineage":["https://openalex.org/I131729948"]}],"countries":["IT"],"is_corresponding":false,"raw_author_name":"Emanuele Iaccarino","raw_affiliation_strings":["Department of Computer Science, University of Salerno, Fisciano, Italy","Software Engineering (SeSa) Lab. University of Salerno, Fisciano, Italy"],"raw_orcid":"https://orcid.org/0009-0004-1319-7604","affiliations":[{"raw_affiliation_string":"Department of Computer Science, University of Salerno, Fisciano, Italy","institution_ids":["https://openalex.org/I131729948"]},{"raw_affiliation_string":"Software Engineering (SeSa) Lab. University of Salerno, Fisciano, Italy","institution_ids":["https://openalex.org/I131729948"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5053084752","display_name":"Filomena Ferrucci","orcid":"https://orcid.org/0000-0002-0975-8972"},"institutions":[{"id":"https://openalex.org/I131729948","display_name":"University of Salerno","ror":"https://ror.org/0192m2k53","country_code":"IT","type":"education","lineage":["https://openalex.org/I131729948"]}],"countries":["IT"],"is_corresponding":false,"raw_author_name":"Filomena Ferrucci","raw_affiliation_strings":["Department of Computer Science, University of Salerno, Fisciano, Italy","Software Engineering (SeSa) Lab. University of Salerno, Fisciano, Italy"],"raw_orcid":"https://orcid.org/0000-0002-0975-8972","affiliations":[{"raw_affiliation_string":"Department of Computer Science, University of Salerno, Fisciano, Italy","institution_ids":["https://openalex.org/I131729948"]},{"raw_affiliation_string":"Software Engineering (SeSa) Lab. University of Salerno, Fisciano, Italy","institution_ids":["https://openalex.org/I131729948"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5079088548","display_name":"Andrea De Lucia","orcid":"https://orcid.org/0000-0002-4238-1425"},"institutions":[{"id":"https://openalex.org/I131729948","display_name":"University of Salerno","ror":"https://ror.org/0192m2k53","country_code":"IT","type":"education","lineage":["https://openalex.org/I131729948"]}],"countries":["IT"],"is_corresponding":false,"raw_author_name":"Andrea De Lucia","raw_affiliation_strings":["Department of Computer Science, University of Salerno, Fisciano, Italy","Software Engineering (SeSa) Lab. University of Salerno, Fisciano, Italy"],"raw_orcid":"https://orcid.org/0000-0002-4238-1425","affiliations":[{"raw_affiliation_string":"Department of Computer Science, University of Salerno, Fisciano, Italy","institution_ids":["https://openalex.org/I131729948"]},{"raw_affiliation_string":"Software Engineering (SeSa) Lab. University of Salerno, Fisciano, Italy","institution_ids":["https://openalex.org/I131729948"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5033738898","display_name":"Fabio Palomba","orcid":"https://orcid.org/0000-0001-9337-5116"},"institutions":[{"id":"https://openalex.org/I131729948","display_name":"University of Salerno","ror":"https://ror.org/0192m2k53","country_code":"IT","type":"education","lineage":["https://openalex.org/I131729948"]}],"countries":["IT"],"is_corresponding":false,"raw_author_name":"Fabio Palomba","raw_affiliation_strings":["Department of Computer Science, University of Salerno, Fisciano, Italy","Software Engineering (SeSa) Lab. University of Salerno, Fisciano, Italy"],"raw_orcid":"https://orcid.org/0000-0001-9337-5116","affiliations":[{"raw_affiliation_string":"Department of Computer Science, University of Salerno, Fisciano, Italy","institution_ids":["https://openalex.org/I131729948"]},{"raw_affiliation_string":"Software Engineering (SeSa) Lab. University of Salerno, Fisciano, Italy","institution_ids":["https://openalex.org/I131729948"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":["https://openalex.org/I131729948"],"apc_list":null,"apc_paid":null,"fwci":5.2019,"has_fulltext":true,"cited_by_count":14,"citation_normalized_percentile":{"value":0.96168582,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":90,"max":99},"biblio":{"volume":"33","issue":"6","first_page":"1","last_page":"41"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T12423","display_name":"Software Reliability and Analysis Research","score":0.9995999932289124,"subfield":{"id":"https://openalex.org/subfields/1712","display_name":"Software"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T12423","display_name":"Software Reliability and Analysis Research","score":0.9995999932289124,"subfield":{"id":"https://openalex.org/subfields/1712","display_name":"Software"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10260","display_name":"Software Engineering Research","score":0.9990000128746033,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9853000044822693,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.8783164024353027},{"id":"https://openalex.org/keywords/software","display_name":"Software","score":0.5492645502090454},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.49091440439224243},{"id":"https://openalex.org/keywords/software-engineering","display_name":"Software engineering","score":0.363701194524765},{"id":"https://openalex.org/keywords/risk-analysis","display_name":"Risk analysis (engineering)","score":0.32816118001937866},{"id":"https://openalex.org/keywords/programming-language","display_name":"Programming language","score":0.11074432730674744}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8783164024353027},{"id":"https://openalex.org/C2777904410","wikidata":"https://www.wikidata.org/wiki/Q7397","display_name":"Software","level":2,"score":0.5492645502090454},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.49091440439224243},{"id":"https://openalex.org/C115903868","wikidata":"https://www.wikidata.org/wiki/Q80993","display_name":"Software engineering","level":1,"score":0.363701194524765},{"id":"https://openalex.org/C112930515","wikidata":"https://www.wikidata.org/wiki/Q4389547","display_name":"Risk analysis (engineering)","level":1,"score":0.32816118001937866},{"id":"https://openalex.org/C199360897","wikidata":"https://www.wikidata.org/wiki/Q9143","display_name":"Programming language","level":1,"score":0.11074432730674744},{"id":"https://openalex.org/C71924100","wikidata":"https://www.wikidata.org/wiki/Q11190","display_name":"Medicine","level":0,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1145/3654443","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3654443","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/3654443","source":{"id":"https://openalex.org/S142627899","display_name":"ACM Transactions on Software Engineering and Methodology","issn_l":"1049-331X","issn":["1049-331X","1557-7392"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319798","host_organization_name":"Association for Computing Machinery","host_organization_lineage":["https://openalex.org/P4310319798"],"host_organization_lineage_names":["Association for Computing Machinery"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"ACM Transactions on Software Engineering and Methodology","raw_type":"journal-article"}],"best_oa_location":{"id":"doi:10.1145/3654443","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3654443","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/3654443","source":{"id":"https://openalex.org/S142627899","display_name":"ACM Transactions on Software Engineering and Methodology","issn_l":"1049-331X","issn":["1049-331X","1557-7392"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319798","host_organization_name":"Association for Computing Machinery","host_organization_lineage":["https://openalex.org/P4310319798"],"host_organization_lineage_names":["Association for Computing Machinery"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"ACM Transactions on Software Engineering and Methodology","raw_type":"journal-article"},"sustainable_development_goals":[{"display_name":"Peace, Justice and strong institutions","score":0.5899999737739563,"id":"https://metadata.un.org/sdg/16"}],"awards":[],"funders":[],"has_content":{"pdf":true,"grobid_xml":true},"content_urls":{"pdf":"https://content.openalex.org/works/W4393233304.pdf","grobid_xml":"https://content.openalex.org/works/W4393233304.grobid-xml"},"referenced_works_count":92,"referenced_works":["https://openalex.org/W150078352","https://openalex.org/W1587715758","https://openalex.org/W1603939896","https://openalex.org/W1721182246","https://openalex.org/W1971733255","https://openalex.org/W1989962588","https://openalex.org/W1994485670","https://openalex.org/W1997646511","https://openalex.org/W1997981086","https://openalex.org/W2004026774","https://openalex.org/W2004584049","https://openalex.org/W2015004885","https://openalex.org/W2016944307","https://openalex.org/W2020841721","https://openalex.org/W2037027324","https://openalex.org/W2044625105","https://openalex.org/W2065890363","https://openalex.org/W2078283664","https://openalex.org/W2082998226","https://openalex.org/W2093040750","https://openalex.org/W2096598529","https://openalex.org/W2098162425","https://openalex.org/W2105131482","https://openalex.org/W2107432340","https://openalex.org/W2109553965","https://openalex.org/W2112736324","https://openalex.org/W2121972257","https://openalex.org/W2123258673","https://openalex.org/W2126725946","https://openalex.org/W2133286915","https://openalex.org/W2137952932","https://openalex.org/W2147152072","https://openalex.org/W2152311353","https://openalex.org/W2160590935","https://openalex.org/W2162373348","https://openalex.org/W2204102791","https://openalex.org/W2244109919","https://openalex.org/W2244669237","https://openalex.org/W2294973055","https://openalex.org/W2296444013","https://openalex.org/W2342603028","https://openalex.org/W2603292144","https://openalex.org/W2757935660","https://openalex.org/W2767521898","https://openalex.org/W2774398706","https://openalex.org/W2806746626","https://openalex.org/W2889391561","https://openalex.org/W2899204848","https://openalex.org/W2901980656","https://openalex.org/W2911964244","https://openalex.org/W2967289945","https://openalex.org/W2967556797","https://openalex.org/W2969657790","https://openalex.org/W2984772254","https://openalex.org/W3009290003","https://openalex.org/W3021134120","https://openalex.org/W3023350219","https://openalex.org/W3035156651","https://openalex.org/W3035390927","https://openalex.org/W3080878745","https://openalex.org/W3084484304","https://openalex.org/W3084558590","https://openalex.org/W3085047896","https://openalex.org/W3090088279","https://openalex.org/W3093266389","https://openalex.org/W3093734859","https://openalex.org/W3098605233","https://openalex.org/W3102673518","https://openalex.org/W3121596715","https://openalex.org/W3137883743","https://openalex.org/W3175201754","https://openalex.org/W3175995826","https://openalex.org/W3195612455","https://openalex.org/W3203411727","https://openalex.org/W3208810397","https://openalex.org/W3209096362","https://openalex.org/W3214913126","https://openalex.org/W4205544737","https://openalex.org/W4206767299","https://openalex.org/W4210493608","https://openalex.org/W4214525227","https://openalex.org/W4226032162","https://openalex.org/W4226043105","https://openalex.org/W4239510810","https://openalex.org/W4296483261","https://openalex.org/W4301003819","https://openalex.org/W4308643127","https://openalex.org/W4309939034","https://openalex.org/W4364355697","https://openalex.org/W4385412300","https://openalex.org/W4393233304","https://openalex.org/W6679155404"],"related_works":["https://openalex.org/W2748952813","https://openalex.org/W2390279801","https://openalex.org/W2358668433","https://openalex.org/W2376932109","https://openalex.org/W2001405890","https://openalex.org/W2382290278","https://openalex.org/W2478288626","https://openalex.org/W4391913857","https://openalex.org/W2350741829","https://openalex.org/W2530322880"],"abstract_inverted_index":{"With":[0],"the":[1,39,52,57,61,134,158,169,176,198],"rate":[2],"of":[3],"discovered":[4],"and":[5,60,67,86,119,136,153,189],"disclosed":[6],"vulnerabilities":[7],"escalating,":[8],"researchers":[9],"have":[10],"been":[11],"experimenting":[12],"with":[13,44,94,144],"machine":[14,79],"learning":[15,80],"to":[16,161],"predict":[17],"whether":[18],"a":[19,30,127],"vulnerability":[20],"will":[21],"be":[22,141],"exploited.":[23],"Existing":[24],"solutions":[25],"leverage":[26,103],"information":[27],"unavailable":[28],"when":[29],"CVE":[31,54,114,151],"is":[32],"created,":[33],"making":[34],"them":[35],"unsuitable":[36],"just":[37],"after":[38],"disclosure.":[40],"This":[41],"paper":[42],"experiments":[43],"early":[45],"exploitability":[46],"prediction":[47,73],"models":[48,74,99,102,123],"driven":[49],"exclusively":[50],"by":[51,108,132],"initial":[53],"record,":[55],"i.e.,":[56,113],"original":[58],"description":[59],"linked":[62],"online":[63],"discussions.":[64],"Leveraging":[65],"NVD":[66],"Exploit":[68],"Database,":[69],"we":[70],"evaluate":[71],"72":[72],"trained":[75],"using":[76],"six":[77],"traditional":[78],"classifiers,":[81],"four":[82],"feature":[83],"representation":[84],"schemas,":[85],"three":[87,110],"data":[88,111,160],"balancing":[89],"algorithms.":[90],"We":[91,179],"also":[92],"experiment":[93],"five":[95],"pre-trained":[96],"large":[97],"language":[98],"(LLMs).":[100],"The":[101,122,147],"seven":[104],"different":[105],"corpora":[106],"made":[107],"combining":[109],"sources,":[112],"description,":[115],"Security":[116,154],"Focus":[117,155],",":[118,129],"BugTraq":[120],".":[121],"are":[124,157],"evaluated":[125],"in":[126,175,196],"realistic":[128],"time-aware":[130],"fashion":[131],"removing":[133],"training":[135],"test":[137],"instances":[138],"that":[139,150],"cannot":[140],"labeled":[142],"\u201cneutral\u201d":[143],"sufficient":[145],"confidence.":[146],"validation":[148],"reveals":[149],"descriptions":[152],"discussions":[156],"best":[159],"train":[162],"on.":[163],"Pre-trained":[164],"LLMs":[165],"do":[166],"not":[167],"show":[168],"expected":[170],"performance,":[171],"requiring":[172],"further":[173],"pre-training":[174],"security":[177,194],"domain.":[178],"distill":[180],"new":[181],"research":[182],"directions,":[183],"identify":[184],"possible":[185],"room":[186],"for":[187],"improvement,":[188],"envision":[190],"automated":[191],"systems":[192],"assisting":[193],"experts":[195],"assessing":[197],"exploitability.":[199]},"counts_by_year":[{"year":2026,"cited_by_count":3},{"year":2025,"cited_by_count":10},{"year":2024,"cited_by_count":1}],"updated_date":"2026-05-21T06:26:12.895304","created_date":"2025-10-10T00:00:00"}