Pith. sign in

REVIEW 4 major objections 5 minor 44 references

Scoring the Unscorables: Cyber Risk Assessment Beyond Internet Scans

T0 review · 4 major / 5 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read This paper claims that a cyber risk model built from crawlable website technology signatures—not Internet scans—can estimate an organization's likelihood of a data breach, with within-corpus ROC AUC up to 92.3% and 86.7% on a held-out…

desk verdict Honest, well-evaluated paper with a real new data source, but the headline AUCs may partly reflect a size/sector confound that the paper asserts but never demonstrates. read the letter →

arxiv 2506.06604 v1 pith:3V3LXTFC submitted 2025-06-07 cs.CR cs.LG

Armin Sarabi , Manish Karir , Mingyan Liu This is my paper
classification cs.CRcs.LG
keywords cyberriskquantificationdata-drivensecurityincidentsransomwaremachinelearningwebcrawlingdatabreachprediction
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper sets out to show that an organization's cyber risk can be scored from the technologies detectable on its public website, without needing to scan its IP addresses or attribute network assets to the organization. The authors crawl each domain, record digital signatures of the software and services it uses, and train a supervised model against reports of data breaches and ransomware incidents. They report that the resulting scores separate breached from non-breached organizations with area-under-the-ROC-curve values of 92.3 percent (general incidents), 86.7 percent (ransomware incidents), and 89.2 percent combined, and that the model holds at 86.7 percent on a 2024 set of ransomware incidents completely withheld from training. If this stands, cyber risk scoring becomes applicable to the millions of small and medium organizations for whom IP-based scans are unavailable or incomplete, because the method only requires a website that can be crawled.

What carries the argument

The paper's machinery is a crawl-based technology-signature pipeline. A crawler visits the organization's homepage, up to nine random internal pages, and up to nine pages containing 'privacy' in the link; from these pages it records the presence and versions of web technologies (content management systems, JavaScript libraries, CDNs, analytics trackers, payment processors, security and cookie-compliance tools, and similar). Each technology name and version becomes a binary feature, and each category and meta-category also receives a count feature, producing 1,013 features after pruning. Paired with incident labels at the domain level and trained with a gradient-boosted tree classifier, these features produce a calibrated breach probability. The domain as identifier is the load-bearing move: it avoids the error-prone IP-to-organization attribution that limits scan-based methods, and the privacy-policy heuristic is used to filter the negative sample set toward sites that plausibly belong to organizations.

What would settle it

Construct a matching test set in which each breached organization is paired with a non-breached organization of the same sector and comparable size, and recompute the model's AUC: if discrimination falls toward chance on these matched pairs, the score is capturing demographic sorting rather than the security posture claimed for the technology signatures.

Watch

Extended reading notes

Core claim

Using the domain name as the canonical identifier, the authors crawl each organization's website and record digital signatures of the technologies it runs. They pair these with positive labels from two cyber-incident corpora—general reported incidents and ransomware incidents—and negative labels from randomly sampled domains, then train a gradient-boosted tree classifier on 1,013 binary and count features. The central claim is that this domain-level model achieves strong ranking accuracy: area under the ROC curve of 92.3% for general incidents, 86.7% for ransomware incidents, and 89.2% when the corpora are combined, with a crawl yield above 95% on incident-report domains and 86.7% AUC on a 2024 ransomware set withheld from training. The authors interpret the cross-dataset drops (e.g., 79.3% when a general-incident-trained model scores ransomware victims) as evidence that ransomware victims differ systematically from the broader incident population, and they show that adding a coarse industry-sector feature improves accuracy on top of technology signatures.

Load-bearing premise

The load-bearing premise is that the randomly sampled, privacy-policy-hosting comparison domains are a valid stand-in for organizations that have not been breached; the paper itself concedes in Section 6.2 that the breached and non-breached pools differ systematically in size and sector, so if the model is mostly separating large organizations from small ones, its absolute probability estimates are not supported.

Editorial extensions

If this is right

  • A risk score can be produced for any organization whose website is crawlable, including the millions of small and medium enterprises that lack dedicated, attributable IP address space; the paper reports a greater-than-95% data-collection yield on incident-report domains.
  • The model's probability output is well-calibrated without post-processing, so the scores can be interpreted directly as breach likelihood under the paper's label definitions.
  • Adding a twenty-category industry-sector feature reduces error by more than 40% relative to sector-only models, suggesting that cheap auxiliary data can be layered onto the crawl features.
  • Because general incidents and ransomware incidents produce different feature importances and cross-dataset AUCs, deploying a score for a specific use case requires training on the matching incident type.
  • A historically grounded prediction setup is only partially supported by archived snapshots: coverage drops and fewer technologies are detected, so the authors state that live crawls accumulated over time—not archive replay—are the route to true forecasting.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Editorial inference: a deployed version could monitor risk continuously by re-crawling domains on a schedule, turning the point-in-time classifier into an early-warning system that flags sudden changes in technology stack as risk-relevant events; the paper does not develop this operationalization.
  • Editorial inference: the crawl features are genre-neutral enough that they could be tested against incident types outside the paper's labels (e.g., insider misuse, physical incidents, supply-chain compromise), since the model's positive set is limited to malware, hacking, social engineering, and ransomware.
  • Editorial inference: because the negative set requires a found privacy policy, the comparison may be selecting for organizations with certain regulatory or consumer-facing characteristics, so a sensitivity analysis without that filter would reveal how much of the signal is organizational form rather than security posture.
  • Editorial inference: the pool mismatch between breach victims and the random-domain negatives means the calibrated probability is safest used as a peer-relative ranking within sector and size bands, not as an absolute probability of breach for any given organization.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The paper proposes a cyber risk assessment approach that replaces Internet scan features with technology signatures collected by crawling an organization's website. Positive labels are drawn from VCDB (2022-23) and BlackFog ransomware reports (BFSR 22-23, with BFSR 24 held out), and negatives are sampled from Tranco domains that pass a live-crawl and privacy-policy filter. Features are one-hot-encoded technology names/versions plus category counts, pruned to 1,013 features, and modeled with XGBoost under 5-fold cross-validation. The authors report within-dataset ROC AUCs of 92.3% (VCDB), 86.7% (BFSR 22-23), and 89.2% (combined), a held-out BFSR 24 AUC of 86.7%, well-behaved calibration, SHAP-based feature importances, and performance gains from adding NAICS sector information. They also report a >95% data-collection yield and a Wayback Machine experiment simulating a predictive setting.

Significance. If the central claim holds, the paper makes a useful contribution: it demonstrates a new, low-cost data modality for cyber risk scoring that avoids the IP-attribution bottleneck of scan-based methods and could extend coverage to organizations without dedicated IP assets. The authors should be credited for several strengths: independent label sources, a held-out BFSR 24 set, manual validation of the automated domain-mapping step, calibration plots, SHAP analyses, and a Wayback Machine control for temporal alignment. The main risk is that the reported discrimination may reflect organizational size and sector rather than cybersecurity posture, because the positive and negative pools differ systematically. That issue is load-bearing for the paper's central claim and for the promise of scoring SMEs, and it is only addressed by an unsubstantiated assertion in Section 6.2.

major comments (4)
  1. [Section 3.3 and Section 6.2] The negative pool is constructed from Tranco domains that survive a live-crawl filter and a privacy-policy filter (Section 3.3.2), while positives come from VCDB and BFSR incident reports that, as the paper concedes in Section 6.2, are biased toward larger organizations and disclosure-prone sectors. Because technology-signature features are also correlated with website sophistication and budget, the high AUCs may largely separate 'large/sophisticated' from 'small/simple' organizations rather than breached from non-breached ones. Section 6.2 asserts that 'there is substantial risk separation among firms of the same type,' but no size-stratified, sector-stratified, or matched-control result is provided anywhere in the paper. Please add within-sector or size-stratified AUC analyses, or a matched-control experiment (e.g., matching positives to negatives on NAICS sector and a firm-size proxy), and report how much discrimination remains.
  2. [Section 3.4 and Contribution (2)] The >95% yield claim is computed over positive samples whose domains were already resolved and known to host websites (817/830 for VCDB and 1,322/1,366 for BFSR 22-24). For the Tranco negative population, only 3,971 of 10,000 domains (39.7%) pass both the crawl and privacy-policy filters. The paper's stated contribution (2) that this 'model can be applied to the millions of small entities' is therefore not supported by the reported yield, since coverage among SMEs without a detectable privacy policy or with a non-crawlable website may be much lower. Please report coverage on a population-representative sample stratified by organization size, or revise the yield and applicability claims to reflect the actual denominator.
  3. [Section 4.2.3 and Section 6.3] The BFSR 24 evaluation is presented as evidence of robustness over time, but the features for BFSR 24 domains are collected by live crawls at the time of the study, after the 2024 incidents occurred. The paper itself states in Section 6.3 that the crawled data is not temporally aligned with incident dates. Thus, the BFSR 24 AUC demonstrates generalization to a new label source with contemporaneous features, not predictive performance in a true time-lapse setting. Please either restrict the temporal-robustness claim to the Wayback Machine experiment in Section 6.3, or clearly label the BFSR 24 result as a contemporaneous-feature transfer evaluation.
  4. [Section 4.2.3, Figure 6] The calibration plot is computed on the constructed positive/negative pools, whose ratio and composition are determined by the sampling design rather than by any population base rate. Because the negative pool is a privacy-policy-filtered Tranco sample, the empirical positive rate in each bin is an artifact of the sampling scheme. The statement that the classifier outputs are 'well-calibrated' and require no further calibration can therefore support only within-sample calibration, not calibrated breach probabilities for arbitrary organizations. Please add a prevalence-adjusted discussion or soften the absolute probability interpretation.
minor comments (5)
  1. [Section 2] There is a typo in the opening sentence: 'we leveragesupervised learning' should read 'we leverage supervised learning.'
  2. [Section 3.3, Table 2 caption] 'Table 2 summaries the curated datasets' should be 'Table 2 summarizes the curated datasets.'
  3. [Section 4.2.2] The description of SHAP contributions is confusing: the text says HTTP/3 and Cloudflare are 'positive contributors to lower estimated risk' and Siteimprove and Simpli.fi are 'negative contributors,' which inverts the usual sign convention. Please state the sign convention explicitly (e.g., positive SHAP pushes output toward the positive class).
  4. [Figure 3 and Figure 7 legends] The legends contain apparent typos such as 'B th → B th' and oddly spaced labels like 'F alse p sitive rate' and 'T rue p sitive rate'; please correct these in the final figures.
  5. [Section 6.2] The paper cites Woods and Böhme [46] for the concern that the model may distinguish large corporations from smaller organizations, but it does not discuss what fraction of the separation is attributable to size/sector even after including sector as a feature in Section 5. Reporting the sector-only AUC together with the combined AUC is useful, but an explicit decomposition of variance or an interaction analysis would clarify the residual role of technology features.

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity: features and labels are independently sourced and the headline AUCs are evaluated on held-out and out-of-distribution data.

full rationale

The paper's derivation chain is self-contained rather than circular. Features are technology signatures collected by crawling organization websites (Section 3.1), and labels come from external incident datasets, VCDB and BFSR, with no fitted parameter being relabeled as a prediction. The headline performance numbers (92.3% VCDB, 86.7% BFSR 22-23, 89.2% combined) are produced by five-fold cross-validation (Section 4.1), and the model is additionally evaluated on a genuinely held-out, out-of-distribution BFSR 24 set (Figure 7, Section 4.2.3). Self-citations to the authors' earlier scan-based work [24] are used for comparison and motivation, not as evidence for the present model's correctness, so they are not load-bearing. The paper explicitly acknowledges the most serious limitation in Section 6.2: 'our positive and negative samples are drawn from different pools: the former from a breach dataset biased toward larger organizations (and those associated with sectors/regions with higher reporting requirements), and the latter from a broader pool,' citing Woods and Bohme [46]. This is a sample-comparability and external-validity concern rather than a circular reduction: the model's output is not defined in terms of the labels, nor are the labels derived from the features. The defense that 'there is substantial risk separation among firms of the same type' is asserted but not demonstrated, which is an evidentiary gap, not a circularity. Overall, the central empirical claim rests on independent feature and label data with held-out evaluation, so no significant circularity is present.

Assumptions & free parameters 4 free parameters · 4 assumptions · 0 invented entities

The paper introduces no new theoretical entities, particles, forces, or conserved quantities. The main ledger items are domain assumptions about what the datasets represent and the hand-chosen filtering rules that shape the negative sample. The most consequential is the privacy-policy filter, which removes over half of crawled negatives and therefore controls the definition of the 'unscored' SME population the paper claims to serve.

free parameters (4)
  • Privacy-policy filtering rule = not applicable (criterion: presence of a privacy page with HTTP status below 400)
    The 52.5% of negatives removed for lacking a privacy page (Section 3.4) is a hand-chosen sample-selection rule that materially shapes the negative distribution. It is not a numeric parameter but functions as a selection criterion controlling the difficulty of the classification task and the interpretation of results.
  • Feature pruning threshold = 20 occurrences
    Features observed fewer than 20 times in crawled websites are dropped (Section 3.2), reducing 1,013 features for live crawls. The threshold is chosen by hand, and while it is standard practice, it affects the feature space and is not derived from the data itself.
  • XGBoost hyperparameters = learning rate 0.1, 1000 rounds, max 128 leaves, 32 bins, early stopping 50
    These are chosen by cross-validation (Section 4.1) and are not fitted to the target variable directly, so they do not constitute circularity. They are listed for completeness because a re-implementation would need the same values to reproduce the reported AUCs.
  • Domain-mapping similarity threshold = 0.9 for manual inspection, 3-character minimum matching
    The threshold for which domain mappings are manually inspected (Section 3.3.1) is a hand-chosen quality control parameter. It affects label noise levels, since samples above 0.9 were mostly not manually verified.
assumptions (4)
  • domain assumption The presence or absence of a privacy policy page identifies organizational websites and excludes individual-owned sites (Section 3.3.2).
    This assumption is load-bearing for negative-sample construction: 52.5% of successfully crawled Tranco domains are discarded for lacking a privacy page. If personal blogs frequently have privacy pages, or small business sites frequently lack them, the negative set is biased toward larger, more compliance-oriented organizations.
  • domain assumption Technology signatures collected after an incident are informative of the organization's pre-incident security posture (Section 6.3).
    The main model trains on crawls performed after incident dates, implicitly assuming that website technology stacks are stable over the incident window. The Wayback experiment provides partial support (80.3% overlap of detected technology names), but the assumption is not fully established.
  • domain assumption The label databases (VCDB and BFSR) are unbiased samples of real breaches and ransomware incidents (Section 3.3.1).
    These databases are known to skew toward publicly disclosed breaches, mandatory-reporting sectors, and larger organizations. The paper acknowledges this in Section 6.2 citing Woods and Böhme [46]. If label availability correlates with observability, the model learns to predict disclosure propensity as well as breach probability.
  • domain assumption Google Search results and the AI chatbot correctly map organization names to their primary domains (Section 3.3.1).
    The paper reports 97.0% and 90.8% accuracy for automated retrieval on VCDB and BFSR respectively, after manual corrections. The 9.2% error rate in the BFSR set means the automated label pipeline introduces measurable label noise.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Scoring the Unscorables: Cyber Risk Assessment Beyond Internet Scans." pith.science (2026). https://pith.science/paper/3V3LXTFC

@misc{pith2026250606604,
  author       = {Pith},
  title        = {Pith review of: Scoring the Unscorables: Cyber Risk Assessment Beyond Internet Scans},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/3V3LXTFC}},
  note         = {Machine review of arXiv:2506.06604}
}
read the original abstract

In this paper we present a study on using novel data types to perform cyber risk quantification by estimating the likelihood of a data breach. We demonstrate that it is feasible to build a highly accurate cyber risk assessment model using public and readily available technology signatures obtained from crawling an organization's website. This approach overcomes the limitations of previous similar approaches that relied on large-scale IP address based scanning data, which suffers from incomplete/missing IP address mappings as well as the lack of such data for large numbers of small and medium-sized organizations (SMEs). In comparison to scan data, technology digital signature data is more readily available for millions of SMEs. Our study shows that there is a strong relationship between these technology signatures and an organization's cybersecurity posture. In cross-validating our model using different cyber incident datasets, we also highlight the key differences between ransomware attack victims and the larger population of cyber incident and data breach victims.

Figures

Figures reproduced from arXiv: 2506.06604 by the authors.

Figure 1
Figure 1. A domain based cyber risk prediction/assessment system. Dashed circle indicates optional data element [PITH_FULL_IMAGE:figures/full_fig_p003_1.png] view at source ↗
Figure 2
Figure 2. A partial hierarchy of technology names/versions, categories, and meta-categories. Each node repre [PITH_FULL_IMAGE:figures/full_fig_p008_2.png] view at source ↗
Figure 3
Figure 3. ROC curves of the trained classifier. 𝑋 → 𝑌 refers to a model trained on 𝑋 and then evaluated on 𝑌. The blue (orange) curve is trained and evaluated on VCDB (BFSR 22-23) labels only; the green uses both sets of labels. The two worse-performing curves correspond to cross-dataset evaluation, the red trained on VCDB and evaluated on BFSR 22-23 and the purple trained on BFSR 22-23 and evaluated on VCDB. guided grow poli… view at source ↗
Figures from the paper (8 more)
Figure 4
Figure 4. Figure 4: Distribution of classifier outputs on all positive and negative samples used in this study, including [PITH_FULL_IMAGE:figures/full_fig_p013_4.png]
Figure 5
Figure 5. Figure 5: Contributions of different feature groups to model outputs: meta-categories (left), categories (middle), [PITH_FULL_IMAGE:figures/full_fig_p014_5.png]
Figure 6
Figure 6. Figure 6: Binned model outputs (risk estimates) vs. true empirical probabilities of belonging to the positive [PITH_FULL_IMAGE:figures/full_fig_p015_6.png]
Figure 7
Figure 7. Figure 7: Accuracy of models for scoring BFSR 24 incidents. Models trained on BFSR 22-23 and the combination [PITH_FULL_IMAGE:figures/full_fig_p016_7.png]
Figure 8
Figure 8. Figure 8: Distribution of AI-derived sectors for positives (VCDB and BFSR 22-24) and negatives. Numbers in [PITH_FULL_IMAGE:figures/full_fig_p017_8.png]
Figure 9
Figure 9. Figure 9: Accuracy of models trained on the combination of technology features and sector information (as an [PITH_FULL_IMAGE:figures/full_fig_p018_9.png]
Figure 10
Figure 10. Figure 10: Technology categories (left) and names (right) with the largest differences in contributions for the [PITH_FULL_IMAGE:figures/full_fig_p019_10.png]
Figure 11
Figure 11. Figure 11: Accuracy of models trained on combined technology features from Wayback Machine data and [PITH_FULL_IMAGE:figures/full_fig_p020_11.png]

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

44 extracted references · 38 canonical work pages

  1. [1]

    Understanding the Mirai botnet

    Manos Antonakakis, Tim April, Michael Bailey, Matt Bernhard, Elie Bursztein, Jaime Cochran, Zakir Durumeric, J Alex Halderman, Luca Invernizzi, Michalis Kallitsis, Deepak Kumar, Chaz Lever, Zane Ma, Joshua Mason, Damian Menscher, Chad Seaman, Nick Sullivan, Kurt Thomas, and Yi Zhou. Understanding the Mirai botnet. In USENIX Security Symposium, pages 1092–...

    work page 2017

  2. [2]

    Scanning the Internet for liveness

    Shehar Bano, Philipp Richter, Mobin Javed, Srikanth Sundaresan, Zakir Durumeric, Steven J Murdoch, Richard Mortier, and Vern Paxson. Scanning the Internet for liveness. ACM SIGCOMM Computer Communication Review , 48(2):2–9, 2018

    work page 2018

  3. [3]

    RiskTeller: Predicting the risk of cyber incidents

    Leyla Bilge, Yufei Han, and Matteo Dell’Amico. RiskTeller: Predicting the risk of cyber incidents. In ACM SIGSAC Conference on Computer and Communications Security , pages 1299–1311, 2017

    work page 2017

  4. [4]

    The state of ransomware 2024

    Blackfog. The state of ransomware 2024. https://web.archive.org/web/20250219091716/https://www.blackfog.com/the- state-of-ransomware-2024

    arXiv 2024

  5. [5]

    Ransomwhere: A crowdsourced ransomware payment dataset

    Jack Cable. Ransomwhere: A crowdsourced ransomware payment dataset. https://doi.org/10.5281/zenodo.13999026, 2024

    work page doi:10.5281/zenodo.13999026 2024

  6. [6]

    XGBoost: A scalable tree boosting system

    Tianqi Chen and Carlos Guestrin. XGBoost: A scalable tree boosting system. In ACM SIGKDD International Conference on Knowledge Discovery and Data Mining , pages 785–794, 2016

    work page 2016

  7. [8]

    Scanning the Internet for ROS: A view of security in robotics research

    Nicholas DeMarinis, Stefanie Tellex, Vasileios P Kemerlis, George Konidaris, and Rodrigo Fonseca. Scanning the Internet for ROS: A view of security in robotics research. In International Conference on Robotics and Automation , pages 8514–8521. IEEE, 2019. 22 Armin Sarabi, Manish Karir, and Mingyan Liu

    work page 2019

  8. [9]

    A search engine backed by Internet-wide scanning

    Zakir Durumeric, David Adrian, Ariana Mirian, Michael Bailey, and J Alex Halderman. A search engine backed by Internet-wide scanning. In ACM SIGSAC Conference on Computer and Communications Security , pages 542–553, 2015

    work page 2015

Show all 44 references
  1. [10]

    Alex Halderman

    Zakir Durumeric, Frank Li, James Kasten, Johanna Amann, Jethro Beekman, Mathias Payer, Nicolas Weaver, David Adrian, Vern Paxson, Michael Bailey, and J. Alex Halderman. The matter of Heartbleed. In Internet Measurement Conference, pages 475–488. ACM, 2014

    2014

  2. [11]

    ZMap: Fast Internet-wide scanning and its security applications

    Zakir Durumeric, Eric Wustrow, and J Alex Halderman. ZMap: Fast Internet-wide scanning and its security applications. In USENIX Security Symposium, pages 605–620, 2013

    2013

  3. [12]

    Measuring HTTPS adoption on the web

    Adrienne Porter Felt, Richard Barnes, April King, Chris Palmer, Chris Bentzel, and Parisa Tabriz. Measuring HTTPS adoption on the web. In USENIX Security Symposium, pages 1323–1338, 2017

    2017

  4. [13]

    Acquisitional rule-based engine for discovering Internet-of-Things devices

    Xuan Feng, Qiang Li, Haining Wang, and Limin Sun. Acquisitional rule-based engine for discovering Internet-of-Things devices. In USENIX Security Symposium, pages 327–341, 2018

    2018

  5. [14]

    Why do tree-based models still outperform deep learning on typical tabular data? Advances in Neural Information Processing Systems , 35:507–520, 2022

    Léo Grinsztajn, Edouard Oyallon, and Gaël Varoquaux. Why do tree-based models still outperform deep learning on typical tabular data? Advances in Neural Information Processing Systems , 35:507–520, 2022

    2022

  6. [15]

    The Elements of Statistical Learning: Data Mining, Inference, and Prediction

    Trevor Hastie, Robert Tibshirani, and Jerome Friedman. The Elements of Statistical Learning: Data Mining, Inference, and Prediction. Springer, 2001

    2001

  7. [16]

    X-force threat intelligence index 2024

    IBM. X-force threat intelligence index 2024. https://web.archive.org/web/20250529175340/https://www.ccinfo.nl/ _downloads/c9f7bfb1d157ece7d96be9ed9d986d2c, 2024

    2024

  8. [17]

    Wayback machine

    Internet Archive. Wayback machine. http://web.archive.org

  9. [18]

    Exploit prediction scoring system (EPSS)

    Jay Jacobs, Sasha Romanosky, Benjamin Edwards, Idris Adjerid, and Michael Roytman. Exploit prediction scoring system (EPSS). Digital Threats: Research and Practice , 2(3):1–17, 2021

    2021

  10. [19]

    Enhancing vulnerability prioritization: Data-driven exploit predictions with community-driven insights

    Jay Jacobs, Sasha Romanosky, Octavian Suciu, Ben Edwards, and Armin Sarabi. Enhancing vulnerability prioritization: Data-driven exploit predictions with community-driven insights. In IEEE European Symposium on Security and Privacy Workshops, pages 194–206, 2023

    2023

  11. [20]

    Coming of age: A longitudinal study of TLS deployment

    Platon Kotzias, Abbas Razaghpanah, Johanna Amann, Kenneth G Paterson, Narseo Vallina-Rodriguez, and Juan Caballero. Coming of age: A longitudinal study of TLS deployment. InInternet Measurement Conference, pages 415–428. ACM, 2018

    2018

  12. [21]

    Tracking certificate misissuance in the wild

    Deepak Kumar, Zhengping Wang, Matthew Hyder, Joseph Dickinson, Gabrielle Beck, David Adrian, Joshua Mason, Zakir Durumeric, J Alex Halderman, and Michael Bailey. Tracking certificate misissuance in the wild. In IEEE Symposium on Security and Privacy , pages 785–798, 2018

    2018

  13. [22]

    Asset criticality and risk prediction for an effective cybersecurity risk management of cyber-physical system

    Halima Ibrahim Kure, Shareeful Islam, Mustansar Ghazanfar, Asad Raza, and Maruf Pasha. Asset criticality and risk prediction for an effective cybersecurity risk management of cyber-physical system. Neural Computing and Applications, 34(1):493–514, 2022

    2022

  14. [23]

    Using grocery data for credit decisions

    Jung Youn Lee, Joonhyuk Yang, and Eric T Anderson. Using grocery data for credit decisions. Management Science, 71(4):2753–2777, 2025

    2025

  15. [24]

    Cloudy with a chance of breach: Forecasting cyber security incidents

    Yang Liu, Armin Sarabi, Jing Zhang, Parinaz Naghizadeh, Manish Karir, Michael Bailey, and Mingyan Liu. Cloudy with a chance of breach: Forecasting cyber security incidents. In USENIX Security Symposium, pages 1009–1024, 2015

    2015

  16. [25]

    A unified approach to interpreting model predictions.Advances in Neural Information Processing Systems, 30, 2017

    Scott M Lundberg and Su-In Lee. A unified approach to interpreting model predictions.Advances in Neural Information Processing Systems, 30, 2017

    2017

  17. [26]

    Predicting good probabilities with supervised learning

    Alexandru Niculescu-Mizil and Rich Caruana. Predicting good probabilities with supervised learning. In International Conference on Machine learning , pages 625–632, 2005

    2005

  18. [27]

    Dark hazard: Large-scale discovery of unknown hidden sensitive operations in Android apps

    Xiaorui Pan, Xueqiang Wang, Yue Duan, XiaoFeng Wang, and Heng Yin. Dark hazard: Large-scale discovery of unknown hidden sensitive operations in Android apps. In Network and Distributed System Security Symposium , pages 1–15. Internet Society, 2017

    2017

  19. [28]

    Tranco: A research-oriented top sites ranking hardened against manipulation

    Victor Le Pochat, Tom Van Goethem, Samaneh Tajalizadehkhoob, Maciej Korczyński, and Wouter Joosen. Tranco: A research-oriented top sites ranking hardened against manipulation. arXiv preprint arXiv:1806.01156, 2018

    2018 arXiv

  20. [29]

    A free and community-driven critical infrastructure ransomware dataset

    Aunshul Rege and Rachel Bleiman. A free and community-driven critical infrastructure ransomware dataset. In International Conference on Cybersecurity, Situational A wareness and Social Media, pages 25–37. Springer, 2023

    2023

  21. [30]

    Early-stage malware prediction using recurrent neural networks

    Matilda Rhode, Pete Burnap, and Kevin Jones. Early-stage malware prediction using recurrent neural networks. Computers & Security, 77:578–594, 2018

    2018

  22. [31]

    Vulnerability disclosure in the age of social media: Exploiting Twitter for predicting real-world exploits

    Carl Sabottke, Octavian Suciu, and Tudor Dumitras,. Vulnerability disclosure in the age of social media: Exploiting Twitter for predicting real-world exploits. In USENIX Security Symposium, pages 1041–1056, 2015

    2015

  23. [32]

    Characterizing the Internet host population using deep learning: A universal and lightweight numerical embedding

    Armin Sarabi and Mingyan Liu. Characterizing the Internet host population using deep learning: A universal and lightweight numerical embedding. In Internet Measurement Conference, pages 133–146. ACM, 2018

    2018

  24. [33]

    Risky business: Fine-grained data breach prediction using business profiles

    Armin Sarabi, Parinaz Naghizadeh, Yang Liu, and Mingyan Liu. Risky business: Fine-grained data breach prediction using business profiles. Journal of Cybersecurity, 2(1):15–28, 2016

    2016

  25. [34]

    An LLM-based framework for fingerprinting Internet-connected devices

    Armin Sarabi, Tongxin Yin, and Mingyan Liu. An LLM-based framework for fingerprinting Internet-connected devices. In Internet Measurement Conference, pages 478–484. ACM, 2023. Scoring the Unscorables: Cyber Risk Assessment Beyond Internet Scans 23

    2023

  26. [35]

    A first look at certification authority authorization (CAA)

    Quirin Scheitle, Taejoong Chung, Jens Hiller, Oliver Gasser, Johannes Naab, Roland van Rijswijk-Deij, Oliver Hohlfeld, Ralph Holz, Dave Choffnes, Alan Mislove, and Georg Carie. A first look at certification authority authorization (CAA). ACM SIGCOMM Computer Communication Revi...

    2018

  27. [36]

    Tiresias: Predicting security events through deep learning

    Yun Shen, Enrico Mariconti, Pierre Antoine Vervier, and Gianluca Stringhini. Tiresias: Predicting security events through deep learning. In ACM SIGSAC Conference on Computer and Communications Security , pages 592–605, 2018

    2018

  28. [37]

    Automatically detecting vulnerable websites before they turn malicious

    Kyle Soska and Nicolas Christin. Automatically detecting vulnerable websites before they turn malicious. In USENIX Security Symposium, pages 625–640, 2014

    2014

  29. [39]

    Ransomware attacks map

    StateScoop. Ransomware attacks map. https://web.archive.org/web/20250320073527/https://statescoop.com/ ransomware-map

  30. [40]

    Expected exploitability: Predicting the development of functional vulnerability exploits

    Octavian Suciu, Connor Nelson, Zhuoer Lyu, Tiffany Bao, and Tudor Dumitras,. Expected exploitability: Predicting the development of functional vulnerability exploits. In USENIX Security Symposium, pages 377–394, 2022

    2022

  31. [41]

    DarkEmbed: Exploit prediction with neural language models

    Nazgol Tavabi, Palash Goyal, Mohammed Almukaynizi, Paulo Shakarian, and Kristina Lerman. DarkEmbed: Exploit prediction with neural language models. In AAAI Conference on Artificial Intelligence , volume 32, 2018

    2018

  32. [42]

    NAICS codes & understanding industry classification systems

    United States Census Bureau. NAICS codes & understanding industry classification systems. https: //web.archive.org/web/20250506224832/https://www.census.gov/programs-surveys/economic-census/year/ 2022/guidance/understanding-naics.html

    2022

  33. [43]

    Small Business Administration Office of Advoacy

    U.S. Small Business Administration Office of Advoacy. Frequently asked questions about small busi- ness. https://web.archive.org/web/20250517030943/https://advocacy.sba.gov/2023/03/07/frequently-asked-questions- about-small-business-2023, 2023

    2023

  34. [44]

    The VERIS community database (VCDB)

    Verizon. The VERIS community database (VCDB). https://web.archive.org/web/20250126114847/https:// verisframework.org/vcdb.html

  35. [45]

    Inscriptis – A Python-based HTML to text conversion library optimized for knowledge extraction from the web

    Albert Weichselbraun. Inscriptis – A Python-based HTML to text conversion library optimized for knowledge extraction from the web. Journal of Open Source Software , 6(66):3557, 2021

    2021

  36. [46]

    SoK: Quantifying cyber risk

    Daniel W Woods and Rainer Böhme. SoK: Quantifying cyber risk. In IEEE Symposium on Security and Privacy , pages 211–228. IEEE, 2021

    2021

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.