@inproceedings{0c1be08a3ef144e6894828aa332f64c6,
title = "Exploring the clustering of software vulnerability disclosure notifications across software vendors",
abstract = "This exploratory empirical paper investigates annual time delays between vulnerability disclosure notifications and acknowledgments by means of network analysis. These delays are approached through a potential clustering effect of vulnerabilities across software vendors. The analysis is based on a projection from bipartite vendor-vulnerability structures to one-mode vendor-vendor networks, while the hypothesized clustering effect is approached with a conventional community detection algorithm. According to the results, (a) vulnerabilities cluster across vendors, (b) which also explains a portion of the time delays, although (c) the clustering is not stable annually. The computed network (d) clusters can be also interpreted by reflecting these against common software security attack surfaces. The results can be used to contemplate (e) practical means with which the efficiency of vulnerability disclosure could be improved.",
author = "Jukka Ruohonen and Johannes Holvitie and Sami Hyrynsalmi and Ville Lepp{\"a}nen",
year = "2017",
month = jun,
day = "12",
doi = "10.1109/AICCSA.2016.7945696",
language = "English",
series = "ACS/IEEE INTERNATIONAL CONFERENCE ON COMPUTER SYSTEMS AND APPLICATIONS",
publisher = "IEEE",
pages = "1--8",
booktitle = "2016 IEEE/ACS 13th International Conference on Computer Systems and Applications (AICCSA)",
address = "United States",
note = "ACS/IEEE International Conference of Computer Systems and Applications ; Conference date: 28-08-2017",
}