## 3 Results
### Experiments for the Commonly Used IoT Technologies  
In this subsection we present our experiments concerning a configuration which comprises the five most widely used technologies in the IoT. As reported by [41], the five most widely used technologies in IoT networks are:  
1. The _advanced message-queuing protocol_ (AMQP), an open standard protocol used for message exchange, including publish/subscribe and point-to-point, as well as queues [43],
2. _Bluetooth and Bluetooth low-energy_ (BLE), a short-range communication protocol and its low-energy variant [44],
3. _Cellular communications_, i.e., implementation of communication through cellular telephony netowrks (2G, 3G, 4G/LTE, and 5G),
4. The _constrained application protocol_ (CoAP) [45], a specialized internet protocol for devices with constrained resources (e.g., wireless sensors), which enables both (a) pairs or groups of devices running CoAP and (b) devices running CoAP and the internet. 5. The _data distribution service_ for real-time systems (DDS) [46], a networking middleware for realtime systems specified by the object management group (OMG), realizing data-centric publish-subscribe mechanisms which can be easily integrated in the application layer. Following these data, an IoT system configuration was formulated, running instances of software implementing the above listed technologies as follows:  
* AMQP was implemented using RabbitMQ v. 3.4.0 ([[https://github.com/rabbitmq/rabbitmq-server/tree/rabbitmq_v3](https://github.com/rabbitmq/rabbitmq-server/tree/rabbitmq_v3)]([https://github.com/rabbitmq/rabbitmq-server/tree/rabbitmq_v3](https://github.com/rabbitmq/rabbitmq-server/tree/rabbitmq_v3))\(4\)0, accessed on 14 May 2023),
* Bluetooth/Bluetooth LE was implemented using the Android 13 drivers ([[https://andr.oid.googlesource.com/kernel/msm/+/refs/tags/android-13.0.0_r0.1/drivers/bluetooth/](https://andr.oid.googlesource.com/kernel/msm/+/refs/tags/android-13.0.0_r0.1/drivers/bluetooth/)]([https://andr.oid.googlesource.com/kernel/msm/+/refs/tags/android-13.0.0_r0.1/drivers/bluetooth/](https://andr.oid.googlesource.com/kernel/msm/+/refs/tags/android-13.0.0_r0.1/drivers/bluetooth/)), accessed on 14 May 2023)
* Cellular communications were implemented using Open5 GS v. 2.1.3 ([[https://github.com/open5](https://github.com/open5) gs/open5 gs/releases/tag/v2.1.3]([https://github.com/open5](https://github.com/open5) gs/open5 gs/releases/tag/v2.1.3), accessed on 14 May 2023)
* CoAP was implemented using the CoAP library in Arm Mbed OS 5.14.0 ([[https://github.com/ARMmbed/mbed-os/releases/tag/mbed-os-5.14.0](https://github.com/ARMmbed/mbed-os/releases/tag/mbed-os-5.14.0)]([https://github.com/ARMmbed/mbed-os/releases/tag/mbed-os-5.14.0](https://github.com/ARMmbed/mbed-os/releases/tag/mbed-os-5.14.0)), accessed on 14 May 2023)
* DDS was implemented using OpenDDS v. 3.16.1 ([[https://github.com/OpenDDS/OpenDDS/releases/tag/DDS-3.16.1](https://github.com/OpenDDS/OpenDDS/releases/tag/DDS-3.16.1)]([https://github.com/OpenDDS/OpenDDS/releases/tag/DDS-3.16.1](https://github.com/OpenDDS/OpenDDS/releases/tag/DDS-3.16.1)), accessed on 14 May 2023)  
The software listed above was analyzed and was found to entail 47 vulnerabilities, accounting for a total technical debt of 967 min, with an overall risk equal to 273.34. In the prioritization experiments we considered the security budget values of 50, 125, 250, and 500 min. Table 2 lists indicative results from applying the security issue prioritization method described in Section 2.6 to the identified security issues. As shown in Table 3, the recommendation in all cases consumes (almost) all the available budget, and manages to effectively direct the available budget to the mitigation of the issues having the highest impact, since the percentage of the total impact mitigated in the recommendation list is consistently higher than the ratio of the available budget to the total technical debt.