## 2 Materials and Methods
### Vulnerability Impact Estimation  
Once the vulnerability management framework has determined the list of vulnerabilities present in the software, the next step is to estimate the impact that each of these vulnerabilities will have on the IoT platform. Recall (from Section 2.4) that the list of vulnerabilities contains, for each vulnerability, a reference to the SonarQube security rule that triggered the vulnerability flagging. This information is exploited by the vulnerability management framework to compute an estimate of the vulnerability impact, according to the following process:  
1. The rule is looked up in the SonarQube rules database ([[https://rules.sonarsource.co](https://rules.sonarsource.co)]([https://rules.sonarsource.co](https://rules.sonarsource.co)) m/, accessed on 14 May 2023) and its full record is retrieved. This record includes:  
* _Common weakness enumeration (CWE) identifiers._ CWE identifiers are codes assigned to typical security-related code anti-patterns, i.e., patterns of code that are known to lead to vulnerabilities. For instance the _java/RSPEC-6437 SonarQube security rule ([[https://rules.sonarsource.com/java/RSPEC-6437](https://rules.sonarsource.com/java/RSPEC-6437)]([https://rules.sonarsource.com/java/RSPEC-6437](https://rules.sonarsource.com/java/RSPEC-6437)), accessed on 14 May 2023) is linked to the _CWE-798--use of hard-coded credentials_ ([[https://cwe.mitre.org/data/definitions/798.html](https://cwe.mitre.org/data/definitions/798.html)]([https://cwe.mitre.org/data/definitions/798.html](https://cwe.mitre.org/data/definitions/798.html)), accessed on 14 May 2023) and the _CWE-259--of hard-coded password weaknesses_ ([[https://cwe.mitre.org/data/definitions/259.html](https://cwe.mitre.org/data/definitions/259.html)]([https://cwe.mitre.org/data/definitions/259.html](https://cwe.mitre.org/data/definitions/259.html)), accessed on 14 May 2023). These identifiers are saved and used in the vulnerability impact estimation, as described below. * _A detailed description of the vulnerability_, including an explanation of the mechanics of the code anti-pattern, a substantiation of why the anti-pattern leads to vulnerabilities, and recommendations on how the code can be transformed to eliminate the vulnerability. This information is saved, to be presented to software security experts and to assist them in their vulnerability remediation tasks. 2. Subsequently, the vulnerability management framework applies a statistical approach to compute an estimate of the security issue. More specifically, the vulnerability management framework utilizes the information present in the common vulnerability enumeration (CVE) database ([[https://cve.mitre.org/data/downloads/](https://cve.mitre.org/data/downloads/)]([https://cve.mitre.org/data/downloads/](https://cve.mitre.org/data/downloads/)), accessed on 14 May 2023) to identify known vulnerabilities that owed to the exact same code anti-patterns to which the current security issue is associated to. This database will be denoted as \(VulDB\). For each vulnerability \(vul\in VulDB\), the following fields are retrieved: * \(id(vul)\), which corresponds to the id of the vulnerability * \(weak(vul)\), which denotes the set of common weaknesses to which the vulnerability is associated. For instance, for the vulnerability with an ID equal to \(CVE\)-2009-0003 it holds that \(weak(CVE\)-2009-0003) = \(CWE\)-119, i.e., vulnerability \(CVE\)-2009-0003 is associated with the CWE having an ID equal to \(CWE\)-119, corresponding to the anti-pattern of improper restriction of operations within the bounds of a memory buffer ([[https://cwe.mitre.org/data/definitions/119.html](https://cwe.mitre.org/data/definitions/119.html)]([https://cwe.mitre.org/data/definitions/119.html](https://cwe.mitre.org/data/definitions/119.html)), accessed on 14 May 2023), commonly referred to as _buffer overflow_.