Pith. sign in

REVIEW 3 major objections 4 minor 41 references

Orchestrated Vulnerability Management for Heterogeneous Networks: Adaptive Two-Stage Vulnerability Assessment, Context-Aware Risk Prioritization, and Automated Mitigation

T0 review · 3 major / 4 minor · reviewed 2026-08-12 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read The paper argues that a closed-loop, context-aware vulnerability management system can cut the urgent mitigation workload by about 75% while keeping every known-exploited vulnerability in the priority set.

desk verdict Genuinely integrated SOAR/SDN vulnerability management with credible testbed measurements, but the headline 75% workload-reduction claim is circular because KEV serves as both input feature and ground-truth label. read the letter →

arxiv 2608.08162 v1 pith:TUM3ESHC submitted 2026-08-08 cs.NI

Ricardo Lopes , Jose Moura , Rui Neto Marinheiro This is my paper · ORCID
classification cs.NI
keywords securityorchestrationautomationandresponsevulnerabilitymanagementadaptivetwo-stagescanningcontext-awareriskprioritizationexploitpredictionscoringsystemsoftware-definednetworkinginternetofthingsautomatedmitigation
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper argues that vulnerability management for heterogeneous networks can be made faster, safer, and less labor-intensive by replacing uniform scanning and severity-only prioritization with a closed, automated loop that adapts to each device. The proposed framework passively classifies assets from DHCP metadata, runs a quick threat-informed scan and then a deeper scan only when warranted, ranks every finding into four risk bands by combining CVSS severity, EPSS exploitation probability, known-exploited status, and device context, and enforces proportional SDN/IDS responses from logging to service blocking to full quarantine. In the authors' experiments the two-stage scan reduced assessment time by up to 91% while the fast stage alone kept 71% of baseline vulnerability coverage, and the context-aware risk model cut the number of vulnerabilities flagged for immediate mitigation by roughly 75% without dropping any vulnerability with verified exploitation. If these results hold, security teams can focus remediation on a much smaller genuinely urgent set, and fragile IoT devices are spared the disruptive active probing that uniform scanners would send their way.

What carries the argument

The load-bearing mechanism is the four-band risk model supported by an adaptive scan front end. The risk model is a $3 \times 2$ matrix: CVSS severity tiers (high, moderate, low) crossed with exploitation likelihood (high or low, derived from EPSS probability and known-exploited catalog membership, with missing evidence treated as high by default); an exploited moderate-severity finding outranks an unexploited severe one, and context (sensitive zone or constrained device) promotes the band by exactly one step. This matrix is what produces the 75% reduction in urgent findings while retaining every known-exploited vulnerability. The scan front end makes the reduction operationally useful by pairing a threat-informed fast port list—the union of weekly, monthly, and yearly most-attacked ports—with a device-class-specific test profile, so the fast stage returns 71% of baseline findings in about 14 minutes on a constrained device instead of an hour or more.

What would settle it

Run the risk model on vulnerabilities whose exploitation is independently confirmed but that were absent from the known-exploited catalog at the time of scoring; if any such exploited vulnerability falls outside the immediate-mitigation band, the central claim of no missed exploited vulnerabilities fails.

Watch

Extended reading notes

Core claim

The paper's central claim is that an orchestrated closed loop—passive asset discovery, adaptive two-stage assessment, context-aware risk scoring, and automated mitigation—manages the full vulnerability lifecycle better than the conventional sequential pipeline. Device class decides scan depth: resource-constrained assets receive only reconnaissance-oriented tests and remain under passive monitoring, while traditional IT hosts get the full active test set. The fast scan uses a dynamically built list of the most attacked ports so an initial risk posture and mitigation decision can be made in minutes; the deep scan covers the complementary ports afterwards. Risk is assigned per finding through a severity-by-exploitability matrix whose output band (CRITICAL, HIGH, MEDIUM, LOW) can be promoted one step for sensitive-zone or constrained devices, and each band maps to a distinct SDN-enforced action executed within milliseconds. The statistical validation uses a case-control design on 2025 published vulnerabilities with CVSS 9.0 or higher: all 84 known-exploited cases are retained by the model, while the number of non-exploited vulnerabilities escalated to immediate mitigation falls from 336 to 19, a 75% reduction in the urgent set.

Load-bearing premise

The framework assumes the passive device classifier is accurate enough that a fragile IoT device is never misclassified as a traditional IT host, because a misclassification would subject that device to disruptive active probing that could degrade or crash it.

Editorial extensions

If this is right

  • The urgent-remediation queue shrinks by about three quarters, so analysts and automated response systems concentrate on a small set of findings that are either being exploited or very likely to be.
  • Because the fast scan returns an actionable posture in minutes, mitigation for high-risk findings can start before the deep scan finishes, shortening the exposure window.
  • Resource-constrained IoT devices receive only reconnaissance-oriented tests and continuous passive monitoring, reducing the risk that scanning itself disrupts fragile services.
  • Mitigation rules land on the data plane in milliseconds, so a host admitted with a critical finding can be contained before normal operation proceeds.
  • Scan execution, not orchestration, is the scalability bottleneck; adding CPU or distributing scan engines is the direct path to larger deployments.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Beyond the paper: the 'zero missed exploited vulnerabilities' result is partly definitional, because the known-exploited catalog is both a model input and the evaluation ground truth; a stronger test would use independently confirmed exploitation events with timestamps to see whether the model flags them before or at first exploitation.
  • Beyond the paper: the worst-case default for missing exploitability evidence means freshly disclosed vulnerabilities with no EPSS or catalog entry are still escalated, so the 75% reduction may be smaller in a zero-day-heavy workload than in this retrospective evaluation.
  • Beyond the paper: the per-finding risk bands and per-service enforcement could be reused as inputs for zero-trust access decisions, turning each host's vulnerability posture into a continuous, context-aware trust signal.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 4 minor

Summary. The paper proposes a SOAR-orchestrated vulnerability management framework for heterogeneous networks, combining passive asset discovery, adaptive two-stage scanning, a CVSS/EPSS/KEV/context risk-band model, and SDN/OpenFlow/IDS-based mitigation. The main reported results are: up to a 91% reduction in adaptive scan time while preserving 71% vulnerability coverage after the fast scan; approximately a 75% reduction in vulnerabilities requiring immediate mitigation with complete coverage of verified exploited vulnerabilities; millisecond-scale mitigation enforcement; and scalable concurrent assessment of up to 32 hosts. The evaluation is performed on virtualized and hybrid testbeds, and the paper explicitly acknowledges several limitations, including the NVT filter providing no time savings, quarantine completion depending on DHCP renewal, and the device classifier not being evaluated.

Significance. If the results hold, the framework would be a practically useful integrated system: the adaptive scanning and SDN enforcement measurements are direct and plausible, and the authors are transparent about several limitations, which is good scientific practice. The central quantitative claim about the context-aware risk model reducing immediate-mitigation workload is, however, not currently supported as a predictive result. The evaluation in Section V-F is circular because KEV membership is both a model input and the ground-truth label, and the contextual component named in the headline is explicitly not exercised in that experiment. With a reframed or supplemented validation, the contribution would still be meaningful for automated vulnerability management, but the abstract and conclusions as written overstate what has been demonstrated.

major comments (3)
  1. [Section V-F and Algorithm 2] The claim that the model reduces immediate-mitigation workload by approximately 75% while missing no exploited vulnerability is not supported as a predictive result. In Algorithm 2, exploitability is set to high when a CVE is listed in the CISA KEV catalog, and in Section V-F the positive ground-truth class is defined as KEV membership. Every positive case is therefore prioritized by construction, so the reported 84/84 true positives and zero false negatives are tautological. The reduction from 420 to 103 vulnerabilities is the filtering effect of the EPSS cutoff on the negative controls, not a measured ability to anticipate exploitation. The paper acknowledges that the 19 remaining positives are 'the cost of anticipating exploitation,' but no temporal or out-of-sample test shows that high-EPSS non-KEV vulnerabilities are actually exploited later. Moreover, the false-positive count and hence the 75% figure depend on the EPSS cutoff, which Section V-E states was not calibrated against a labeled exploitation dataset, and no sensitivity analysis is reported. Please either reframe the claim as workload reduction conditional on KEV/EPSS inputs, or add a temporal holdout evaluation (e.g., use KEV entries known before a cutoff date to predict entries added afterward). The abstract and conclusions should not state 'without missing any vulnerability with verified exploitation' as an empirical finding.
  2. [Section V-F] The paper's headline attributes the 75% workload reduction to the 'context-aware risk model,' but Section V-F explicitly states: 'The contextual component is not exercised in this experiment, since the evaluation operates on published vulnerability data rather than on deployed hosts.' The quantitative validation therefore covers only the EPSS/KEV exploitation axis; the context promotion mechanism from Section III-C and Table IV (sensitive zone, constrained device) is illustrated only qualitatively in Section V-E using a single host (Table XVI). This is a load-bearing mismatch between the claim and the evidence: the abstract and conclusions should either be restricted to the exploitation-aware component, or a quantitative experiment exercising the contextual component on deployed hosts should be added.
  3. [Section IV-B and Section VI-C] The device classification step is load-bearing for the safety promise of the framework. The claim that resource-constrained devices are not disrupted by active probing depends on fragile devices never being classified as traditional IT hosts. Section IV-B states that 'The classifier was not evaluated here,' and Section VI-C admits that 'The current architecture does not account for edge-case misclassifications, such as identifying a resource-constrained IoT device as a traditional IT host. This could inadvertently subject fragile assets to disruptive active probing.' This is the exact error direction that would break the 'minimizing disruption' objective of RQ1. Because the default-to-constrained rule does not address the fragile-as-IT case, the paper should either report an evaluation of classification accuracy with a misclassification-cost analysis, or explicitly limit the safety and non-disruption claims to the case where the classifier is correct.
minor comments (4)
  1. [Section V-D] Two consecutive, nearly identical paragraphs begin with 'Table XIII reports the per-stage latency...' and 'Excluding scan execution...'; one copy should be removed. The same section also contains the typo 'is is approximately 2.0%.'
  2. [Table IX] The column header 'Red.%' is ambiguous; it should read 'Reduction (%)' and the units of 'Time (m)' should be stated explicitly as minutes.
  3. [Section IV-B] The phrase 'Centralizing this scan logic in to the security management component' should be corrected to 'into the security management component,' and 'This work main novelty' in the introduction should be 'This work's main novelty.'
  4. [Table XII and Section V-C] The 'Aware Deep (complement)' row reports 42.9% coverage, but the text explains that deep-scan findings partially overlap with fast-scan findings because both identify host-level issues; presenting the unique additional coverage contributed by the deep scan would make the two-stage benefit clearer.

Circularity Check

1 steps flagged · score 7.0 of 10

KEV serves as both an input feature and the ground-truth label in Section V-F, so 'zero missed exploited vulnerabilities' is guaranteed by construction rather than demonstrated.

  1. self definitional [Algorithm 2 (Section IV-C) and Section V-F (Exploitation-Aware Risk Prioritization)]
    "kev listed←(some CVE of v is in KEV) ... exploit high←kev listed∨epss high (Algorithm 2). ... The ground truth for exploitation was established using the CISA Known Exploited Vulnerabilities (KEV) catalog. Within this dataset, KEV entries constitute the positive case (Cases), whereas non-KEV vulnerabilities form the negative class (Controls). ... a True Positive (TP) corresponds to a vulnerability listed in the CISA Known Exploited Vulnerabilities (KEV) catalog that is correctly prioritized for immediate mitigation."

    The model's exploitability axis is defined to be high whenever a finding's CVE is in KEV (Algorithm 2: 'exploit high←kev listed∨epss high'; Section IV-C: 'It is considered high if any of a finding's CVEs are listed in KEV'). The evaluation defines the positive ground-truth class as KEV membership and a True Positive as 'a vulnerability listed in the CISA Known Exploited Vulnerabilities (KEV) catalog that is correctly prioritized for immediate mitigation.' Therefore every positive case is prioritized by construction; the reported 100% recall (84/84) is a logical consequence of the model definition, not a predictive result.

full rationale

The central circularity is localized to Section V-F. Algorithm 2 makes KEV membership a sufficient condition for high exploitability, and the same KEV catalog is then used as the positive ground-truth class in the statistical validation. Consequently, the 'no missed exploited vulnerabilities' result is not an empirical finding about predictive performance but an identity: every KEV-listed CVE is assigned a high exploitability band by the scoring rule. The reduction in false positives (336 to 19) is a real arithmetic consequence of applying the EPSS cutoff to a case-control sample of 2025 critical-severity CVEs, but it is not an out-of-sample or temporal validation that these high-EPSS non-KEV vulnerabilities are actually exploited later. The paper also acknowledges that the 0.1 EPSS cutoff was not calibrated against a labeled exploitation dataset, which further weakens any predictive interpretation of the 75% figure. No load-bearing self-citation circularity is present: citations to prior work by the same group are used mainly for baseline comparison and architectural context, not to justify the risk-model's evaluation. Overall, the paper's strongest quantitative claim is partially circular: the workload-reduction number has independent content, but the 'zero missed KEV' component is forced by the model definition.

Assumptions & free parameters 5 free parameters · 6 assumptions · 0 invented entities

The ledger shows that the headline numbers are measurements under specific configuration choices rather than derived constants. The risk-model evaluation rests on the assumption that KEV is both an input and the ground truth, which is the main circularity burden. No new theoretical entities are postulated.

free parameters (5)
  • EPSS cutoff = 0.1 (configurable)
    Exploitability is 'high' when max EPSS >= cutoff or KEV listed (Algorithm 2). Used in Sections V-E and V-F; the 75% reduction and 19 false positives depend on this value. The paper adopts 0.1 as a common reference from [7], not calibrated to its own data.
  • Fast-scan port list size (Top N per DShield tier) = 200 (evaluated 200, 500, 1000)
    Algorithm 1 uses per-tier top-N; N=200 chosen after the trade-off experiment in Section V-B. The 91% scan-time reduction and 71% coverage are measured with this setting.
  • Transport-share threshold = 30%
    Algorithm 1 lines 8-11 keep a port on TCP or UDP only when that transport carries at least 30% of its attack activity. Affects fast and deep port lists.
  • Context promotion step = +1 band, capped at Critical
    Table IV promotes findings by one band for sensitive zones or constrained devices. Affects risk-band distribution and mitigation actions.
  • Rescan intervals = 50 h (traditional IT), 100 h (constrained)
    Section IV-D; configurable policy affecting reassessment frequency, not central to the headline claims.
assumptions (6)
  • domain assumption Device classification from DHCP metadata and Fingerbank lineage is accurate enough to choose safe scan profiles
    Section IV-B classifies hosts as constrained or traditional IT from Option 55/60 and MAC; Section VI-C admits misclassification could disrupt fragile assets.
  • domain assumption Reconnaissance-only unauthenticated scans detect vulnerabilities by service and version matching; active tests are required to confirm some flaws
    Section V-C shows the aware profile misses a critical backdoor on 5515/tcp because it has no version banner; the framework relies on passive monitoring to compensate.
  • domain assumption CISA KEV is a valid and sufficient ground truth for 'verified exploitation'
    Section V-F uses KEV to define cases and controls; the paper acknowledges many real-world exploitations are never publicly disclosed in Section VI-C.
  • domain assumption DShield attack telemetry reflects the ports most likely to be targeted in the deployment
    Section V-B builds the fast port list from ISC DShield tiers; if local threat profiles differ, the fast scan would miss relevant ports.
  • domain assumption Findings without exploitability evidence are treated as exploited (worst-case default)
    Algorithm 2 lines 6-7 set exploit_high=true when no CVE or no EPSS/KEV data; this inflates the immediate-mitigation set and affects the reported false-positive count.
  • domain assumption Continuous passive monitoring by Suricata compensates for vulnerabilities that reconnaissance-only scanning cannot confirm
    Section V-C and VI-C state this compensation but admit its effectiveness is not quantitatively evaluated ('Quantitatively evaluating the effectiveness of this complementary monitoring strategy remains an important direction for future work').

how reviews work

0 comments
Cite this review

Pith. "Pith review of Orchestrated Vulnerability Management for Heterogeneous Networks: Adaptive Two-Stage Vulnerability Assessment, Context-Aware Risk Prioritization, and Automated Mitigation." pith.science (2026). https://pith.science/paper/TUM3ESHC

@misc{pith2026260808162,
  author       = {Pith},
  title        = {Pith review of: Orchestrated Vulnerability Management for Heterogeneous Networks: Adaptive Two-Stage Vulnerability Assessment, Context-Aware Risk Prioritization, and Automated Mitigation},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/TUM3ESHC}},
  note         = {Machine review of arXiv:2608.08162}
}
read the original abstract

Heterogeneous networks pose significant security challenges due to device diversity, fragile operating conditions, and heterogeneous firmware and service configurations. Traditional vulnerability management often relies on static scanning and severity-based prioritization, overlooking exploitation likelihood and asset context. This can delay mitigation and increase operational overhead. This paper proposes a SOAR-orchestrated vulnerability management framework integrating passive asset discovery, adaptive two-stage vulnerability assessment, context-aware risk assessment, and automated SDN-based mitigation. The detection engine progressively characterizes device attack surfaces using assessment strategies tailored to device capabilities, minimizing disruption to resource-constrained IoT assets. Risk assessment combines CVSS severity, EPSS exploitation probability, and contextual attributes to prioritize vulnerabilities by operational risk. Based on risk bands, mitigation is automatically enforced through coordinated OpenFlow and IDS policies, ranging from monitoring and selective service isolation to complete host quarantine. Experimental results demonstrate the framework's effectiveness. Adaptive two-stage assessment reduces scan time by up to 91% while identifying 71% of baseline vulnerabilities during the initial stage before selectively triggering further analysis. The context-aware risk model reduces vulnerabilities requiring immediate mitigation by approximately 75% without missing any vulnerability with verified exploitation. Compared with conventional assessment, the framework reduces assessment time for 32 physical hosts by up to 45% and enforces mitigation within milliseconds, enabling efficient and scalable vulnerability management through adaptive assessment, context-aware prioritization, and automated mitigation.

Figures

Figures reproduced from arXiv: 2608.08162 by the authors.

Figure 1
Figure 1. Proposed SOAR-driven vulnerability management framework with SDN enforcement. [PITH_FULL_IMAGE:figures/full_fig_p003_1.png] view at source ↗
Figure 2
Figure 2. SOAR-orchestrated workflow of the proposed framework [PITH_FULL_IMAGE:figures/full_fig_p007_2.png] view at source ↗
Figure 3
Figure 3. It first describes the deployed environment and the [PITH_FULL_IMAGE:figures/full_fig_p009_3.png] view at source ↗
Figures from the paper (4 more)
Figure 3
Figure 3. Figure 3: Deployment of proposed SOAR-driven vulnerability management framework with SDN enforcement. TABLE II TECHNOLOGIES USED IN THE IMPLEMENTATION AND THEIR ROLES Component Technology Version Role Orchestrator Catalyst SOAR 0.15.7 Loop coordination SDN controller Ryu 4.34 Ac…
Figure 4
Figure 4. Figure 4: Statistical validation of the proposed risk assessment model [PITH_FULL_IMAGE:figures/full_fig_p019_4.png]
Figure 5
Figure 5. Figure 5: Execution time (in minutes) required to assess 1-32 Metasploitable2 [PITH_FULL_IMAGE:figures/full_fig_p020_5.png]
Figure 7
Figure 7. Figure 7: Time (in minutes) to assess 1–32 Windows 2003 hosts for the proposed [PITH_FULL_IMAGE:figures/full_fig_p021_7.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

41 extracted references · 36 canonical work pages

  1. [1]

    Guide to operational technology (ot) security,

    K. A. Stouffer, M. Pease, C. Tang, T. Zimmerman, V . Y . Pillitteri, S. Lightman, A. Hahn, S. Saravia, A. Sherule, and M. Thompson, “Guide to operational technology (ot) security,” 2023-09-28 04:09:00

    work page 2023

  2. [2]

    Deepsdn: Deep learning based software defined network model for cyberthreat detection in iot network,

    K. M and S. R. K, “Deepsdn: Deep learning based software defined network model for cyberthreat detection in iot network,”ACM Trans. Internet Technol., vol. 26, no. 1, Jan. 2026. [Online]. Available: https://doi.org/10.1145/3737875

    work page doi:10.1145/3737875 2026

  3. [3]

    Holistic cyber risk assessment in the cloud continuum: A multi-layer, multi-domain approach,

    G. Gatti, J. M. J. Valero, M. Gil P ´erez, and C. Basile, “Holistic cyber risk assessment in the cloud continuum: A multi-layer, multi-domain approach,”IEEE Access, vol. 13, pp. 180 593–180 612, 2025

    work page 2025

  4. [4]

    A smart framework to detect threats and protect data of iot based on machine learning,

    A. M. Almasabi, M. Khemakhem, F. E. Eassa, A. Ahmed Abi Sen, A. B. Alkhodre, and A. Harbaoui, “A smart framework to detect threats and protect data of iot based on machine learning,”IEEE Access, vol. 12, pp. 176 833–176 844, 2024

    work page 2024

  5. [5]

    Pro- grammable active scans controlled by passive traffic inference for iot asset characterization,

    H. Sullivan, A. Sivanathan, A. Hamza, and H. H. Gharakheili, “Pro- grammable active scans controlled by passive traffic inference for iot asset characterization,” inNOMS 2023-2023 IEEE/IFIP Network Operations and Management Symposium, 2023, pp. 1–6

    work page 2023

  6. [6]

    Exploit prediction scoring system (epss),

    J. Jacobs, S. Romanosky, B. Edwards, I. Adjerid, and M. Roytman, “Exploit prediction scoring system (epss),”Digital Threats, vol. 2, no. 3, Jul. 2021. [Online]. Available: https://doi.org/10.1145/3436242

    doi:10.1145/3436242 2021

  7. [7]

    Vulnerability management chaining: An integrated framework for efficient cybersecurity risk prioritization,

    N. Shimizu and M. Hashimoto, “Vulnerability management chaining: An integrated framework for efficient cybersecurity risk prioritization,” IEEE Access, vol. 14, p. 31407–31424, 2026. [Online]. Available: http://dx.doi.org/10.1109/ACCESS.2026.3665768

    arXiv 2026

  8. [8]

    On the road to proactive vulnerability analysis and mitigation leveraged by software defined networks: A systematic review,

    J. Pol ´onio, J. Moura, and R. Neto Marinheiro, “On the road to proactive vulnerability analysis and mitigation leveraged by software defined networks: A systematic review,”IEEE Access, vol. 12, pp. 98 546– 98 566, 2024

    work page 2024

Show all 41 references
  1. [9]

    Toward automatic detection and mitigation of high-risk cybersecurity vulnerabilities at networked systems,

    J. Pol ´onio, J. Moura, and R. N. Marinheiro, “Toward automatic detection and mitigation of high-risk cybersecurity vulnerabilities at networked systems,”IEEE Access, vol. 13, pp. 181 957–181 976, 2025

    2025

  2. [10]

    Comparison of active vulnerability scanning vs. passive vul- nerability detection,

    H. Ecik, “Comparison of active vulnerability scanning vs. passive vul- nerability detection,” in2021 International Conference on Information Security and Cryptology (ISCTURKEY), 2021, pp. 87–92

    2021

  3. [11]

    Adaptive real-time risk and impact assessment for 5g network security,

    D. Varvarigou, K. Lampropoulos, S. Denazis, and P. Kitsos, “Adaptive real-time risk and impact assessment for 5g network security,”Network, vol. 6, no. 1, 2026. [Online]. Available: https: //www.mdpi.com/2673-8732/6/1/3

    2026

  4. [12]

    Comparing vulnerability severity and exploits using case-control studies,

    L. Allodi and F. Massacci, “Comparing vulnerability severity and exploits using case-control studies,”ACM Trans. Inf. Syst. Secur., vol. 17, no. 1, Aug. 2014. [Online]. Available: https://doi.org/10.1145/2630069

    2014 doi

  5. [13]

    Common vulnerability scoring system,

    P. Mell, K. Scarfone, and S. Romanosky, “Common vulnerability scoring system,”IEEE Security & Privacy, vol. 4, no. 6, pp. 85–89, 2006

    2006

  6. [14]

    Ram-iot: Risk assessment model for iot-based critical assets,

    A. S., A. Jacobsson, and P. Davidsson, “Ram-iot: Risk assessment model for iot-based critical assets,” inIoTBDS, 01 2025, pp. 191–198

    2025

  7. [15]

    Iot sentinel: Automated device-type identification for se- curity enforcement in iot,

    M. Miettinen, S. Marchal, I. Hafeez, N. Asokan, A.-R. Sadeghi, and S. Tarkoma, “Iot sentinel: Automated device-type identification for se- curity enforcement in iot,” in2017 IEEE 37th International Conference on Distributed Computing Systems (ICDCS), 2017, pp. 2177–2184

    2017

  8. [16]

    Ai/ml in security orchestration, automation and response: Future research directions

    J. Kinyua and L. Awuah, “Ai/ml in security orchestration, automation and response: Future research directions.”Intelligent Automation & Soft Computing, vol. 28, no. 2, 2021. JOURNAL OF LATEX CLASS FILES, VOL. 14, NO. 8, AUGUST 2021 24

    2021

  9. [17]

    Elastic provisioning of network and computing resources at the edge for iot services,

    P. Cardoso, J. Moura, and R. N. Marinheiro, “Elastic provisioning of network and computing resources at the edge for iot services,” Sensors, vol. 23, no. 5, 2023. [Online]. Available: https://www.mdpi. com/1424-8220/23/5/2762

    2023

  10. [18]

    Horizon- tal pod autoscaling in kubernetes for elastic container orchestration,

    T.-T. Nguyen, Y .-J. Yeom, T. Kim, D.-H. Park, and S. Kim, “Horizon- tal pod autoscaling in kubernetes for elastic container orchestration,” Sensors, vol. 20, no. 16, 2020

    2020

  11. [19]

    Exec: Elastic extensible edge cloud,

    A. Zavodovski, N. Mohan, S. Bayhan, W. Wong, and J. Kangasharju, “Exec: Elastic extensible edge cloud,” inProceedings of the 2Nd International Workshop on Edge Systems, Analytics and Networking, 2019, pp. 24–29

    2019

  12. [20]

    All things considered: An analysis of {IoT}devices on home networks,

    D. Kumar, K. Shen, B. Case, D. Garg, G. Alperovich, D. Kuznetsov, R. Gupta, and Z. Durumeric, “All things considered: An analysis of {IoT}devices on home networks,” in28th USENIX security symposium (USENIX Security 19), 2019, pp. 1169–1185

    2019

  13. [21]

    Inferring mobile applications usage from dns traffic,

    C. Campo, C. Garcia-Rubio, A. Jimenez-Berenguel, M. Moure-Garrido, F. Almenares, and D. D ´ıaz-Sanchez, “Inferring mobile applications usage from dns traffic,”Ad Hoc Networks, vol. 163, p. 103601, 2024

    2024

  14. [22]

    Detecting iot devices in the internet,

    H. Guo and J. Heidemann, “Detecting iot devices in the internet,” IEEE/ACM transactions on networking, vol. 28, no. 5, pp. 2323–2336, 2020

    2020

  15. [23]

    Machine learning algorithms for enhancing intrusion detection within sdn/nfv,

    A. Sahbi, F. Jaidi, and A. Bouhoula, “Machine learning algorithms for enhancing intrusion detection within sdn/nfv,” in2023 International Wireless Communications and Mobile Computing (IWCMC), 2023, pp. 602–607

    2023

  16. [24]

    Aegisguard: A context-aware framework for semantic vulnerability detection and risk stratification,

    P.-C. Huang, C.-H. Mao, and C.-M. Lai, “Aegisguard: A context-aware framework for semantic vulnerability detection and risk stratification,” IEEE Access, 2026

    2026

  17. [25]

    Vulnerability assessment in autonomic networks and services: A survey,

    M. Barrere, R. Badonnel, and O. Festor, “Vulnerability assessment in autonomic networks and services: A survey,”IEEE communications surveys & tutorials, vol. 16, no. 2, pp. 988–1004, 2013

    2013

  18. [26]

    Vulcon: A system for vulnerability prioritization, mitigation, and management,

    K. A. Farris, A. Shah, G. Cybenko, R. Ganesan, and S. Jajodia, “Vulcon: A system for vulnerability prioritization, mitigation, and management,” ACM Transactions on Privacy and Security (TOPS), vol. 21, no. 4, pp. 1–28, 2018

    2018

  19. [27]

    Licality—likelihood and criticality: Vulnerability risk prioritization through logical reasoning and deep learning,

    Z. Zeng, Z. Yang, D. Huang, and C.-J. Chung, “Licality—likelihood and criticality: Vulnerability risk prioritization through logical reasoning and deep learning,”IEEE Transactions on Network and Service Man- agement, vol. 19, no. 2, pp. 1746–1760, 2021

    2021

  20. [28]

    Towards optimal triage and mitigation of context-sensitive cyber vulnerabilities,

    S. Hore, F. Moomtaheen, A. Shah, and X. Ou, “Towards optimal triage and mitigation of context-sensitive cyber vulnerabilities,”IEEE Transactions on Dependable and Secure Computing, vol. 20, no. 2, pp. 1270–1285, 2022

    2022

  21. [29]

    Enhancing anomaly alert prioritization through calibrated standard deviation uncertainty estimation with an ensemble of auto-encoders,

    J. F. Masakuna, D. K. Nkashama, A. Soltani, M. Frappier, P.-M. Tardif, and F. Kabanza, “Enhancing anomaly alert prioritization through calibrated standard deviation uncertainty estimation with an ensemble of auto-encoders,”IEEE Transactions on Network and Service Manage- ment,...

    2026

  22. [30]

    A survey on vul- nerability prioritization: Taxonomy, metrics, and research challenges,

    Y . Jiang, N. Oo, Q. Meng, H. W. Lim, and B. Sikdar, “A survey on vul- nerability prioritization: Taxonomy, metrics, and research challenges,” arXiv preprint arXiv:2502.11070, 2025

    2025 arXiv

  23. [31]

    Cira-cyber intelligent risk assessment methodology for industrial internet of things based on machine learning,

    G. Abbas, M. Ali, M. Ahmad, and A. Khan, “Cira-cyber intelligent risk assessment methodology for industrial internet of things based on machine learning,”IEEE Access, vol. 13, pp. 77 001–77 016, 2025

    2025

  24. [32]

    A decision support system for optimal selection of enterprise information security preventative actions,

    F. ¨O. S ¨onmez and B. G. Kılıc ¸, “A decision support system for optimal selection of enterprise information security preventative actions,”IEEE Transactions on Network and Service Management, vol. 18, no. 3, pp. 3260–3279, 2020

    2020

  25. [33]

    An inter-domain collaboration scheme to remedy ddos attacks in computer networks,

    S. Simpson, S. N. Shirazi, A. Marnerides, S. Jouet, D. Pezaros, and D. Hutchison, “An inter-domain collaboration scheme to remedy ddos attacks in computer networks,”IEEE Transactions on Network and Service Management, vol. 15, no. 3, pp. 879–893, 2018

    2018

  26. [34]

    Neighbor discovery for ip version 6 (ipv6),

    T. Narten, E. Nordmark, W. A. Simpson, and H. Soliman, “Neighbor discovery for ip version 6 (ipv6),” Internet Engineering Task Force, RFC 4861, September 2007. [Online]. Available: https://www.rfc-editor.org/rfc/rfc4861

    2007

  27. [35]

    Overview on intrusion detection systems for computers networking security,

    L. Diana, P. Dini, and D. Paolini, “Overview on intrusion detection systems for computers networking security,”Computers, vol. 14, no. 3, p. 87, 2025

    2025

  28. [36]

    Moving target defense in software-defined networks–a systematic review,

    L. Souto, P. Eisenkraemer, R. Shrestha, M. Chamana, O. Adeyanju, and S. Bayne, “Moving target defense in software-defined networks–a systematic review,”IEEE Access, 2026

    2026

  29. [37]

    Ts-vula: A triple-stage vulnerability analysis framework for industrial internet of things,

    F. Xing, Z. Liu, F. Tong, S. He, and G. Cheng, “Ts-vula: A triple-stage vulnerability analysis framework for industrial internet of things,”IEEE Transactions on Information Forensics and Security, vol. 21, pp. 5059– 5074, 2026

    2026

  30. [38]

    Decentralized control orchestration for dynamic edge pro- grammable systems,

    J. Moura, “Decentralized control orchestration for dynamic edge pro- grammable systems,” in2023 3rd International Conference on Electri- cal, Computer, Communications and Mechatronics Engineering (ICEC- CME), July 2023, pp. 1–6

    2023

  31. [39]

    Flexible zero trust architecture for the cybersecurity of industrial iot infrastructures,

    C. Zanasi, S. Russo, and M. Colajanni, “Flexible zero trust architecture for the cybersecurity of industrial iot infrastructures,” Ad Hoc Netw., vol. 156, no. C, Apr. 2024. [Online]. Available: https://doi.org/10.1016/j.adhoc.2024.103414

    2024

  32. [40]

    Identifying vulnerabilities using internet-wide scanning data,

    J. O’Hare, R. Macfarlane, and O. Lo, “Identifying vulnerabilities using internet-wide scanning data,” in2019 IEEE 12th International Confer- ence on Global Security, Safety and Sustainability (ICGS3), 2019, pp. 1–10. Ricardo Lopesreceived the B.Sc. degree in Telecommunications...

    2019

  33. [2023]

    Available: https://tsapps.nist.gov/publication/get pdf

    [Online]. Available: https://tsapps.nist.gov/publication/get pdf. cfm?pub id=956505

Pith tools

Reviewed August 12, 2026 · model on record in the stance chip above.