Understanding the hidden cost of software vulnerabilities: Measurements and predictions

Afsah Anwar, Aminollah Khormali, Dae Hun Nyang, Aziz Mohaisen

Research output: Chapter in Book/Report/Conference proceedingConference contributionpeer-review

4 Scopus citations


Vulnerabilities have a detrimental effect on end-users and enterprises, both direct and indirect; including loss of private data, intellectual property, the competitive edge, performance, etc. Despite the growing software industry and a push towards a digital economy, enterprises are increasingly considering security as an added cost, which makes it necessary for those enterprises to see a tangible incentive in adopting security. Furthermore, despite data breach laws that are in place, prior studies have suggested that only 4% of reported data breach incidents have resulted in litigation in federal courts, showing the limited legal ramifications of security breaches and vulnerabilities. In this paper, we study the hidden cost of software vulnerabilities reported in the National Vulnerability Database (NVD) through stock price analysis. Towards this goal, we perform a high-fidelity data augmentation to ensure data reliability and to estimate vulnerability disclosure dates as a baseline for estimating the implication of software vulnerabilities. We further build a model for stock price prediction using the NARX Neural Network model to estimate the effect of vulnerability disclosure on the stock price. Compared to prior work, which relies on linear regression models, our approach is shown to provide better accuracy. Our analysis also shows that the effect of vulnerabilities on vendors varies, and greatly depends on the specific software industry. Whereas some industries are shown statistically to be affected negatively by the release of software vulnerabilities, even when those vulnerabilities are not broadly covered by the media, some others were not affected at all.

Original languageEnglish
Title of host publicationSecurity and Privacy in Communication Networks - 14th International Conference, SecureComm 2018, Proceedings
EditorsYingjiu Li, Bing Chang, Sencun Zhu, Raheem Beyah
PublisherSpringer Verlag
Number of pages19
ISBN (Print)9783030017002
StatePublished - 2018
Event14th International EAI Conference on Security and Privacy in Communication Networks, SecureComm 2018 - Singapore, Singapore
Duration: 8 Aug 201810 Aug 2018

Publication series

NameLecture Notes of the Institute for Computer Sciences, Social-Informatics and Telecommunications Engineering, LNICST
ISSN (Print)1867-8211


Conference14th International EAI Conference on Security and Privacy in Communication Networks, SecureComm 2018

Bibliographical note

Funding Information:
Acknowledgement. This work is supported in part by NSF grant CNS-1809000 and NRF grant NRF-2016K1A1A2912757. Part of this work has been presented as a poster at ACM AsiaCCS 2018 [38].

Publisher Copyright:
© ICST Institute for Computer Sciences, Social Informatics and Telecommunications Engineering 2018.


  • National vulnerability database
  • Prediction
  • Vulnerability economics


Dive into the research topics of 'Understanding the hidden cost of software vulnerabilities: Measurements and predictions'. Together they form a unique fingerprint.

Cite this