# CVE based classification of vulnerable IoT systems

arXiv: https://arxiv.org/abs/2006.16640 · HTML: https://mlsanity.com/paper/2006.16640/

## Key facts

- Cited by 5 papers in the map (data through 7 Oct 2026).
- First posted on arXiv 30 Jun 2020.

## Built on by (most cited first, 5 of 5)

- [HW-V2W-Map: Hardware Vulnerability to Weakness Mapping Framework for Root Cause Analysis with GPT-assisted Mitigation Suggestion](https://mlsanity.com/paper/2312.13530/) (2023)
- [Automated Security Assessment for the Internet of Things](https://mlsanity.com/paper/2109.04029/) (2021)
- [Social Media Monitoring for IoT Cyber-Threats](https://mlsanity.com/paper/2109.04306/) (2021)
- [Is this IoT Device Likely to be Secure? Risk Score Prediction for IoT Devices Using Gradient Boosting Machines](https://mlsanity.com/paper/2111.11874/) (2021)
- [Towards automation of threat modeling based on a semantic model of attack patterns and weaknesses](https://mlsanity.com/paper/2112.04231/) (2021)

## Abstract (arXiv)

Common Vulnerabilities and Exposures database (CVE) is one of the largest publicly available source of software and hardware vulnerability data and reports. In this work we analyze the CVE database in the context of IoT device and system vulnerabilities. We introduce a real-world based classification of IoT systems. Then, we employ a SVM algorithm on selected subset of CVE database to classify "new" vulnerability records in this framework. The subset of interest consists of records that describe vulnerabilities of potential IoT devices of different applications, such as: home, industry, mobile controllers, networking, etc. The purpose of the classification is to develop and test an automatic system for recognition of vulnerable IoT devices and to test completes, sufficiency and reliability of CVE data in this respect.