Pith. sign in

REVIEW 3 major objections 5 minor 42 references

PECR: A Reproducible Specification and Synthetic Stress Test of Telemetry-Informed Vulnerability Prioritization for SD-WAN

T0 review · 3 major / 5 minor · reviewed 2026-08-08 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read PECR specifies a nine-factor, telemetry-informed scoring method for SD-WAN vulnerability prioritization that separates score, confidence, and cryptographic migration; on synthetic records it substantially reorders remediation versus…

desk verdict PECR is a transparent, well-scoped prioritization specification whose main claims are conditional on a sampled graph-factors shortcut; worth sending to review if the artifact and an F6/F7 check are required. read the letter →

arxiv 2608.03110 v1 pith:P6HIJRIY submitted 2026-08-04 cs.CR cs.NI

Saeed Alam This is my paper · ORCID
classification cs.CRcs.NI
keywords vulnerabilityprioritizationSD-WANsecuritytelemetry-informedscoringevidencequalityuncertaintyintervalsglobalsensitivityanalysiscryptographicmigrationsyntheticvalidation
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

PECR is a decision-support specification for ordering vulnerability remediation in SD-WAN environments. It combines nine normalized factors — base severity, exploit evidence, exploit probability, untrusted accessibility, attainable privilege, path reachability, blast radius, operational consequence, and control concentration — into a single score, while reporting confidence and plausible score intervals separately and placing cryptographic migration in an independent queue. The paper's central finding is calibrated and modest: on a 100-record synthetic cohort, PECR's operational order differs sharply from severity-, probability-, and KEV-only queues (Kendall τ ≈ 0.196–0.301), but a simpler five-factor context-lite comparator is far closer (τ = 0.755), indicating that most of the differentiation comes from adding basic context rather than the full factor set. The queue order remains reasonably stable under 30,000 joint Dirichlet weight draws (median τ ≈ 0.836–0.924), and masking 10% of factor cells labels 47 records as evidence-limited. The paper claims executable specification, queue differentiation, and stress-test robustness — not predictive accuracy or production effectiveness.

What carries the argument

The load-bearing object is the weighted aggregation identity $R = 100\sum_{i=1}^{9} w_i f_i$ over nine normalized factors, with an AHP-elicited weight vector and a companion confidence formula $C = \sum_{i=1}^{9} w_i q_i$, plus interval-valued factor bounds that yield $R^-$ and $R^+$. The mechanism around it does the work: a bounded directed reachability computation produces $F_6 = 1/(1+h)$ (path distance from an untrusted origin) and $F_7$ (two-hop blast radius), and the interval rule routes any record whose $R^-$ and $R^+$ cross a band boundary into an evidence-limited verification workflow. Cryptographic dependencies are scored by $g(d) = 0.25c_1 + 0.25c_2 + 0.20c_3 + 0.10c_4 + 0.10c_5 + 0.10c_6$, aggregated as $G(a) = \max_d g(d)$, and sent to an independent migration queue. The final-band, descending-score, stable-identifier sort key makes the operational order deterministic and replayable.

What would settle it

Run the PECR protocol on a real, multi-environment SD-WAN dataset with recorded exploitation outcomes and compare top-k precision and time-to-mitigate for later-exploited findings against the five-factor context-lite comparator; if context-lite matches or beats PECR's nine-factor queue on validated outcomes while PECR's extra factors merely reorder the queue, the central refinement claim fails. Alternatively, regenerate the synthetic cohort with a different latent-threat structure and check whether the full queue still reorders the top 10 and keeps median Kendall τ with context-lite above about 0.7 under the same weight stresses.

Watch

Extended reading notes

Core claim

The paper establishes that a fully specified, vendor-neutral scoring protocol can turn SD-WAN telemetry into a deterministic work queue in which each record carries a score $R$, a confidence $C$, and lower/upper bounds, and in which records whose bounds cross a criticality band are routed to verification. The score is the weighted sum of nine normalized factors, with weights derived from an analytic hierarchy process matrix; the operational sort key is final band, then descending $R$, then record identifier, with an exception that forces any confirmed-exploited and Internet-accessible finding to at least High. A separate cryptographic-readiness queue, scored by $g(d)$ and maximized over an asset's cryptographic dependencies, keeps post-quantum migration planning distinct from vulnerability remediation. In the synthetic evaluation, this full protocol reorders the queue relative to CVSS-only, EPSS-only, KEV-first, and CVSS×EPSS comparators, but the context-lite comparator shows that basic context already accounts for most of the top-10 behavior, with PECR's extra factors refining within- and near-band order. The author explicitly frames the result as evidence of incremental differentiation and synthetic feasibility, not a demonstration of avoided loss or accuracy.

Load-bearing premise

The validation rests on the synthetic generator: real SD-WAN telemetry could correlate severity, exploitability, reachability, and consequence differently than the hand-declared role and zone profiles, and F6 and F7 are sampled rather than produced by executing the graph-construction procedure, so the reported queue differentiation and stability numbers may not transfer.

Editorial extensions

If this is right

  • An operator can implement PECR from the specification alone: the sort key, factors, interval rules, and thresholds are defined precisely enough for independent, reproducible implementation.
  • Because score and confidence are reported separately and intervals are preserved, missing or contradictory evidence changes the workflow — a record is sent to verification rather than silently scored at a midpoint.
  • The E1 exception floor guarantees that any finding with confirmed exploitation and Internet accessibility is at least High in the queue regardless of its computed score.
  • Cryptographic migration planning is decoupled from vulnerability remediation: an asset with a classical-crypto dependency that fails the horizon check appears in the migration queue via $G(a)$ without changing its vulnerability score.
  • The synthetic results imply that organizations adopting such a method should expect the biggest queue changes from basic context (exploit evidence, probability, accessibility, consequence), with privilege, path, blast-radius, and control-concentration factors mostly refining near-band order.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If the synthetic differentiation transfers, the first deployment win is likely to come from assembling a five-factor context-lite queue, because it captures most of the top-10 difference with far fewer inputs and less topology dependency.
  • A natural extension the paper does not run: replace the sampled $F_6$ and $F_7$ with actual graph-construction outputs on a small real SD-WAN topology and re-measure the Kendall τ versus context-lite; this would test whether the reachability machinery adds order information beyond its sampled distribution.
  • The evidence-limited interval rule implies a cost-of-honesty problem: adversarial or contradictory inputs can inflate the number of records routed to verification, so a production deployment would need per-source rate limits and a queue floor for low-confidence, high-upper-bound records; the paper identifies but does not solve this.
  • The unpopulated Critical band suggests the default band thresholds are uncalibrated for this generator, so adoption would require a governed calibration step on historical outcomes, not just configuration; this is the author's own limitation, but the corollary is that an outcome-feedback loop is needed for operational use.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. This paper specifies PECR, a decision-support method for SD-WAN vulnerability prioritization that combines nine normalized factors (severity, exploit evidence, EPSS probability, exposure, privilege, path reachability, blast radius, consequence, and control concentration), reports confidence and interval bounds separately, and maintains a distinct cryptographic-migration (C-BOM) queue. The evaluation is entirely synthetic: 100 role- and zone-consistent records over 62 assets from a disclosed generator, 30 seeds of replication, five baseline queues, 30,000 joint Dirichlet weight draws for sensitivity, and one 10% missing-cell masking test. The headline results are that a simple context-lite five-factor subset captures much of PECR's top-10 behavior (Kendall tau = 0.755), the full factor set refines order further, and the ranking is reasonably stable under weight perturbation (median tau 0.836-0.924 across broad, moderate, and narrow regimes). The paper explicitly disclaims predictive accuracy and production effectiveness. However, F6 and F7 are sampled from role/zone profiles rather than computed by the Section 4.2 graph procedure, and the promised archival artifact is not yet available.

Significance. The contribution is a detailed, auditable decision specification plus an honest synthetic stress-test methodology. Strengths include explicit equations, deterministic queue semantics, separation of score/confidence/bounds/migration, broad joint-weight sensitivity analysis, transparency about limitations, and a clearly stated absence of predictive-performance claims. If accompanied by an accessible artifact and a check that the graph-construction procedure yields similar ordering behavior, the paper would be a useful reference point for telemetry-informed prioritization. As it stands, the headline numerical results are plausible but the advertised 'executable specification' is not fully realized, because the two graph-derived factors are not exercised by the validation and the artifact cannot currently be checked.

major comments (3)
  1. [Section 12] The reproducibility claim is not currently verifiable: Section 12 states that 'A permanent archival identifier will be added in a subsequent version' and provides no artifact URL, DOI, or checksum. Because the paper's central contribution is an executable, auditable specification, this is a load-bearing issue rather than a cosmetic one. Please provide a stable archival link to the supplementary artifact (including the generator, seeds, CSV, and analysis scripts) at submission time, or explicitly rebrand the paper as a specification-only manuscript whose quantitative results cannot yet be independently reproduced.
  2. [Section 8.1 and Section 4.2 / Tables 6 and 8] The validation never executes the directed-reachability procedure of Section 4.2. As stated in Section 8.1, F6 and F7 are sampled from declared role and zone profiles, and Section 10 acknowledges this. Since F6 and F7 are the only factors that implement the paper's network-aware contribution, the differences between PECR and context-lite in Tables 6 and 8 are conditional on an unvalidated shortcut. If the actual procedure produced F6/F7 values that are nearly constant, dominated by F4, or differently correlated with the latent threat z, the reported refinement margin and queue-differentiation numbers could change materially. The paper should either run the Section 4.2 procedure on the synthetic topology and show whether the Table 6 and Table 8 results survive, or restrict the behavioral claims to the non-graph factors and relabel F6/F7 as externally supplied inputs.
  3. [Section 8.4] The missing-evidence test appears to be a single realization of a 10% mask (90 cells), yielding a single set of counts (63 records lose a factor; 47 intervals cross a band boundary). Repeating the mask many times would show whether these counts are stable or a chance draw; a single realization is not a stress test in the same sense as the 30,000 weight draws. Please report a distribution over repeated masks (for example, median and 90% interval for the number of evidence-limited records), and note clearly that only uniform missingness is covered.
minor comments (5)
  1. [Section 8.2 and Table 6] Context-lite is a reweighted five-factor subset of PECR's own factors, so labeling it a 'stronger five-factor context-lite comparator' in the abstract and Table 6 is potentially misleading; it is an ablation, not an independent baseline. The paper's prose in Section 8.2 is transparent about this, but the abstract and table caption should use 'ablation' or 'feature-subset comparator' to avoid the impression of independent validation.
  2. [Section 8.4] The phrase 'median interval width' appears to be a median over records for one mask, not a median over mask realizations. Clarify this in the text so readers do not confuse it with a distribution over missingness patterns.
  3. [Section 5.1] The AHP consistency ratio is reported (0.0023), but the reciprocal matrix itself is not shown in the text; since independent implementation requires the exact matrix, consider including it in an appendix or explicitly referencing the artifact if the artifact were available.
  4. [Section 10] The acknowledged overlap between F7 and F9 in centralized environments could be quantified; a correlation or redundancy analysis for these two factors on the primary cohort would help readers understand the incremental information contributed by F7.
  5. [Section 8.5] The 30-seed replication tests seed variation within one generator family only; the text acknowledges this, but the phrase 'repeatability across seeds' should not be read as robustness to alternative data-generating models.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the paper makes no predictive accuracy claim, and its internal ablation (context-lite) is a transparent nested comparison rather than a fitted-input validation.

full rationale

The derivation chain is a specification plus synthetic stress test, not a predictive model. The closest comparator, context-lite, is a deliberately reweighted subset of PECR's own factors, but this is an ablation, not a circular validation: the Kendall tau between the two orders is an empirical quantity that depends on the synthetic cohort and the chosen subset weights, and the paper explicitly frames the result as evidence of incremental differentiation ('That is evidence of incremental differentiation, not superiority'). The external comparators (CVSS, EPSS, KEV, CVSS×EPSS) are independent signals and are not fitted to PECR. The sampling of F6/F7 instead of executing the graph procedure is disclosed as a limitation ('The study samples F6 and F7; it does not validate the graph-construction algorithm itself'), not presented as a validation of the graph algorithm. The AHP weight vector is acknowledged to establish only internal coherence, not consensus or optimum. No predictive accuracy, avoided-loss, or production-effectiveness claim is made, so no fitted parameter is renamed as a prediction. The paper's own stated limits are consistent with the actual evidence. Therefore no load-bearing step reduces to its own inputs by construction.

Assumptions & free parameters 4 free parameters · 4 assumptions · 0 invented entities

No new physical entities, forces, particles, or dimensions are introduced. PECR, the C-BOM queue, and PQC-URGENT are decision artifacts, not empirical entities, and the paper provides no independent falsifiable handle for them beyond the synthetic behavior described.

free parameters (4)
  • AHP weight vector w_i = Table 3: F1 0.100493, F2 0.195021, F3 0.100493, F4 0.195021, F5 0.100493, F6 0.100493, F7 0.053848, F8 0.105843, F9…
    Author-elicited reciprocal matrix sets the nine factor weights; all score and queue results depend on this vector. Sensitivity analysis explores perturbations but never validates the vector against outcomes.
  • Synthetic generator coefficients = Beta(1.7,3.0), CVSS 3+5.5*Beta(2.2,1.7)+Normal(0,0.55), EPSS logistic(-5.1+0.38*CVSS+3z), KEV…
    Hand-chosen parameters in Section 8.1 generate the cohort that produces every queue-comparison and sensitivity number. The shared latent threat z couples EPSS and exploit evidence by construction.
  • Band thresholds and E1 floor = Critical 85, High 70, Medium 50, Low 30; E1 sets final band at least High when F2=1 and F4=1
    Policy choices determine band counts and which records are evidence-limited. The paper notes the Critical band is unpopulated and thresholds are not calibrated to outcomes.
  • C-BOM migration weights and PQC-URGENT thresholds = g(d)=0.25c1+0.25c2+0.20c3+0.10c4+0.10c5+0.10c6; PQC-URGENT when c2=1 and c3>=0.67
    Hand-set weights and cut-offs govern the separate migration queue, which is specified and illustrated but not empirically evaluated.
assumptions (4)
  • domain assumption The defender possesses a scanner, asset inventory, threat feeds, flow/log sources, and a human change-control process (Section 3.1).
    PECR's factor values cannot be populated without these inputs; the method's scope is defined by their availability.
  • domain assumption The directed graph G(t) built from effective policy and observed paths correctly represents reachability, and BFS from untrusted origins gives the shortest valid path and two-hop blast radius (Section 4.2).
    F6 and F7 depend on graph correctness, but the validation samples them from profiles rather than executing the graph procedure, as Section 8.1 acknowledges.
  • domain assumption EPSS probability is a meaningful modeled 30-day exploitation likelihood and is usable as a factor input (Table 3, Section 2.1).
    EPSS is a model output, not ground truth; PECR treats it as evidence, and the paper acknowledges this in Section 10.
  • domain assumption The evidence pipeline's security model holds that an adversary cannot forge an uncompromised source credential or alter an append-only decision record (Section 3.2, Table 5).
    The security analysis is a design argument conditional on these assumptions; authentication proves source identity, not truth.

how reviews work

0 comments
Cite this review

Pith. "Pith review of PECR: A Reproducible Specification and Synthetic Stress Test of Telemetry-Informed Vulnerability Prioritization for SD-WAN." pith.science (2026). https://pith.science/paper/P6HIJRIY

@misc{pith2026260803110,
  author       = {Pith},
  title        = {Pith review of: PECR: A Reproducible Specification and Synthetic Stress Test of Telemetry-Informed Vulnerability Prioritization for SD-WAN},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/P6HIJRIY}},
  note         = {Machine review of arXiv:2608.03110}
}
abstract

Software-defined wide-area networking concentrates operational authority in controllers, orchestrators, and Internet-facing edges, but severity-only remediation queues do not represent current exposure or evidence quality. This paper specifies Predictive Exposure and Cryptographic Readiness (PECR), a decision-support method that combines nine normalized severity, threat, reachability, and consequence factors while reporting confidence and score intervals separately. Cryptographic dependencies enter an independent migration queue. The evaluation uses 100 role- and zone-conditioned synthetic vulnerability-asset records over 62 role-consistent assets, plus 30 independent generator replications. Against the operational PECR order, CVSS-only, EPSS-only, KEV-first, and CVSS x EPSS queues yield Kendall $\tau$ values of 0.196, 0.221, 0.301, and 0.234; a stronger five-factor context-lite comparator yields 0.755. Across 30,000 joint Dirichlet weight draws, median $\tau$ is 0.836, 0.893, and 0.924 under broad, moderate, and narrow perturbations. Masking 10% of factor cells labels 47 records as evidence-limited because their intervals cross a decision boundary. The study establishes executable specification, synthetic queue differentiation, and stress-test robustness. It does not establish predictive accuracy, avoided loss, or production effectiveness because no real outcome labels are used.

Figures

Figures reproduced from arXiv: 2608.03110 by the authors.

Figure 1
Figure 1. PECR evidence flow and separation of remediation from cryptographic migration. [PITH_FULL_IMAGE:figures/full_fig_p006_1.png] view at source ↗
Figure 2
Figure 2. Corrected validation summary for queue agreement, joint-weight sensitivity, and band [PITH_FULL_IMAGE:figures/full_fig_p013_2.png] view at source ↗

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

42 extracted references · 17 canonical work pages

  1. [1]

    MEF Forum. 2023. SD-WAN Service Attributes and Service Framework. MEF 70.2. Available from mef.net/resources/mef-70-2-sd-wan-service-attributes-and-service-framework/

    work page 2023

  2. [2]

    Cybersecurity and Infrastructure Security Agency. 2026. Emergency Directive 26-03: Mitigate Vulnerabilities in Cisco SD-WAN Systems. 25 February 2026. Available from cisa.gov/news-events/directives/ed-26-03-mitigate-vulnerabilities- cisco-sd-wan-systems

    work page 2026

  3. [3]

    Cybersecurity and Infrastructure Security Agency. 2026. Supplemental Direction ED 26-03: Hunt and Hardening Guidance for Cisco SD-WAN Systems

    work page 2026

  4. [4]

    FIRST. 2023. Common Vulnerability Scoring System Version 4.0: Specification Document. Available from first.org/cvss/v4-0/

    work page 2023

  5. [5]

    Exploit Prediction Scoring System: The EPSS Model

    FIRST. Exploit Prediction Scoring System: The EPSS Model. Accessed 29 July 2026. Available from first.org/epss/model

    work page 2026

  6. [6]

    Jay Jacobs, Sasha Romanosky, Benjamin Edwards, Michael Roytman, and Idris Adjerid. 2021. Exploit Prediction Scoring System (EPSS). Digital Threats: Research and Practice 2, 3. doi:10.1145/3436242

    doi:10.1145/3436242 2021

  7. [7]

    Cybersecurity and Infrastructure Security Agency. 2021. Known Exploited Vulnerabilities Catalog and Binding Operational Directive 22-01. Available from cisa.gov/known-exploited-vulnerabilities-catalog

    work page 2021

  8. [8]

    Spring, Eric Hatleback, Allen Householder, Art Manion, and Deana Shick

    Jonathan M. Spring, Eric Hatleback, Allen Householder, Art Manion, and Deana Shick. 2019/2021. Prioritizing Vulnerability Response: A Stakeholder-Specific Vulnerability Categorization, version 2.0. Carnegie Mellon University Software Engineering Institute

    work page 2019

Show all 42 references
  1. [9]

    Luca Allodi and Fabio Massacci. 2014. Comparing vulnerability severity and exploits using case-control studies. ACM Transactions on Information and System Security 17, 1. doi:10.1145/2630069

    2014 doi

  2. [10]

    E. H. Tan, I. E. Unal, S. Rhea, and U. Tatar. 2025. Analysis of vulnerability severity and exploit probability scoring frameworks: CVSS and EPSS. In Proceedings of SIEDS. doi:10.1109/SIEDS65500.2025.11021216

    2025

  3. [11]

    Viktoria Koscinski, Mark Nelson, Ahmet Okutan, Robert Falso, and Mehdi Mirakhorli. 2025. Conflicting scores, confusing signals: An empirical study of vulnerability scoring systems. In Proceedings of the 2025 ACM SIGSAC Conference on Computer and Communications Security. doi:10...

    2025

  4. [12]

    Luca Allodi, Marco Cremonini, Fabio Massacci, and Woohyun Shim. 2020. Measuring the accuracy of software vulnerability assessments: Experiments with students and professionals. Empirical Software Engineering 25, 2, 1063–

    2020

  5. [13]

    Emanuele Iannone, Giulia Sellitto, Emanuele Iaccarino, Filomena Ferrucci, Andrea De Lucia, and Fabio Palomba. 2024. Early and realistic exploitability prediction of just-disclosed software vulnerabilities: How reliable can it be? ACM Transactions on Software Engineering and Me...

    2024 doi

  6. [14]

    Yuning Jiang, Nay Oo, Qiaoran Meng, Hoon Wei Lim, and Biplab Sikdar. 2025. A Survey on Vulnerability Prioritization: Taxonomy, Metrics, and Research Challenges. arXiv:2502.11070. doi:10.48550/arXiv.2502.11070

    2025 doi arXiv

  7. [15]

    Shimizu and M

    N. Shimizu and M. Hashimoto. 2026. Vulnerability management chaining: An integrated framework for efficient cybersecurity risk prioritization. IEEE Access 14, 31407–31424. doi:10.1109/ACCESS.2026.3665768

    2026

  8. [16]

    Vida Ahmadi Mehri, Patrik Arlos, and Emiliano Casalicchio. 2022. Automated context-aware vulnerability risk management for patch prioritization. Electronics 11, 21, Article 3580. doi:10.3390/electronics11213580

    2022 doi

  9. [17]

    Oleg Sheyner, Joshua Haines, Somesh Jha, Richard Lippmann, and Jeannette M. Wing. 2002. Automated generation and analysis of attack graphs. In Proceedings of the IEEE Symposium on Security and Privacy, 273–284. doi:10.1109/SECPRI.2002.1004377

    2002 arXiv

  10. [18]

    Xinming Ou, Sudhakar Govindavajhala, and Andrew W. Appel. 2005. MulVAL: A Logic-Based Network Security Analyzer. In Proceedings of the 14th USENIX Security Symposium, 113–128

    2005

  11. [19]

    Harjinder Singh Lallie, Kurt Debattista, and Jay Bal. 2020. A review of attack graph and attack tree visual syntax in cyber security. Computer Science Review 35, Article 100219. doi:10.1016/j.cosrev.2019.100219

    2020

  12. [20]

    C. Fu, B. Wang, and W. Wang. 2024. Software-defined wide area networks (SD-WANs): A survey. Electronics 13, 15, Article 3011. doi:10.3390/electronics13153011

    2024 doi

  13. [21]

    M. A. Ouamri, T. Alharbi, D. Singh, and S. Zenadji. 2025. A comprehensive survey on software-defined wide area network (SD-WAN): Principles, opportunities and future challenges. The Journal of Supercomputing 81, Article 291. doi:10.1007/s11227-024-06718-1

    2025 doi

  14. [22]

    Zhang, J

    Y. Zhang, J. Tourrilhes, Z.-L. Zhang, and P. Sharma. 2021. Improving SD-WAN resilience: From vertical handoff to WAN-aware MPTCP. IEEE Transactions on Network and Service Management 18, 1, 347–361. doi:10.1109/TNSM.2021.3052471

    2021

  15. [23]

    Altheide, S

    F. Altheide, S. Buttgereit, and M. Rossberg. 2024. Increasing resilience of SD-WAN by distributing the control plane [extended version]. IEEE Transactions on Network and Service Management 21, 3, 2569–2581. doi:10.1109/TNSM.2024.3386962

    2024

  16. [24]

    Pei Zhang, Fangzhou He, Han Zhang, Jiankun Hu, Xiaohong Huang, Jilong Wang, Xia Yin, Huahong Zhu, and Yahui Li

  17. [25]

    National Institute of Standards and Technology. 2024. Module-Lattice-Based Key-Encapsulation Mechanism Standard. FIPS 203. doi:10.6028/NIST.FIPS.203

    2024 doi

  18. [26]

    National Institute of Standards and Technology. 2024. Module-Lattice-Based Digital Signature Standard. FIPS 204. doi:10.6028/NIST.FIPS.204

    2024 doi

  19. [27]

    National Institute of Standards and Technology. 2024. Stateless Hash-Based Digital Signature Standard. FIPS 205. doi:10.6028/NIST.FIPS.205

    2024 doi

  20. [28]

    Dustin Moody, Ray Perlner, Andrew Regenscheid, Angela Robinson, and David Cooper. 2024. Transition to Post- Quantum Cryptography Standards. NIST IR 8547, Initial Public Draft. doi:10.6028/NIST.IR.8547.ipd

    2024 doi

  21. [29]

    OWASP Foundation. 2024. CycloneDX v1.6; standardized as ECMA-424. Available from cyclonedx.org/news/cyclonedx- v1.6-released/

    2024

  22. [30]

    Michele Mosca. 2018. Cybersecurity in an era with quantum computers: Will we be ready? IEEE Security & Privacy 16, 5, 38–41. doi:10.1109/MSP.2018.3761723

    2018

  23. [31]

    Elaine Barker, Lily Chen, David Cooper, Dustin Moody, Andrew Regenscheid, Murugiah Souppaya, William Newhouse, Russ Housley, Sean Turner, William Barker, and Karen Kent. 2026. Considerations for Achieving Crypto Agility: Strategies and Practices. NIST CSWP 39 Update 1. doi:10....

    2026 doi

  24. [32]

    Executive Order 14412. 2026. Securing the Nation Against Advanced Cryptographic Attacks. June 2026

    2026

  25. [33]

    Office of Management and Budget. 2026. Execution of the Migration to Post-Quantum Cryptography. OMB M-26-15. June 2026

    2026

  26. [34]

    Benoit Claise, Brian Trammell, and Paul Aitken. 2013. Specification of the IP Flow Information Export (IPFIX) Protocol. RFC 7011. doi:10.17487/RFC7011

    2013 doi

  27. [35]

    Rainer Gerhards. 2009. The Syslog Protocol. RFC 5424. doi:10.17487/RFC5424

    2009 doi

  28. [36]

    David Mills, Jim Martin, Jack Burbank, and William Kasch. 2010. Network Time Protocol Version 4: Protocol and Algorithms Specification. RFC 5905. doi:10.17487/RFC5905

    2010 doi

  29. [37]

    Thomas L. Saaty. 1990. How to make a decision: The analytic hierarchy process. European Journal of Operational Research 48, 1, 9–26. doi:10.1016/0377-2217(90)90057-I

    1990 doi

  30. [38]

    Andrea Saltelli and Paola Annoni. 2010. How to avoid a perfunctory sensitivity analysis. Environmental Modelling & Software 25, 12, 1508–1517. doi:10.1016/j.envsoft.2010.04.012

    2010 doi

  31. [39]

    John Aitchison. 1982. The statistical analysis of compositional data. Journal of the Royal Statistical Society Series B 44, 2, 139–160. doi:10.1111/j.2517-6161.1982.tb01195.x

    1982

  32. [40]

    National Institute of Standards and Technology. 2024. The NIST Cybersecurity Framework (CSF) 2.0. doi:10.6028/NIST.CSWP.29

    2024 doi

  33. [1094]

    doi:10.1007/s10664-019-09797-4

    doi

  34. [2023]

    IEEE Transactions on Information Forensics and Security 18, 2076–2090

    Real-time malicious traffic detection with online isolation forest over SD-WAN. IEEE Transactions on Information Forensics and Security 18, 2076–2090. doi:10.1109/TIFS.2023.3262121

    2023

Pith tools

Reviewed August 8, 2026 · model on record in the stance chip above.