## 3 Databases Creation  
Our analysis included more than 100 different sources, both structured and unstructured. We divided sources into three groups, including one broad group for unstructured sources, a second group for national vulnerability databases, and a third group for other structured sources, such as security advisories and independent vulnerability databases. Finally, information from 16 structured sources (4 of which are no longer active) was used for the work. The database creation process is shown in Figure 1.  
The entire process of creating the IoT vulnerability and exploit database, which we prepared during the VARIoT project (see Figure 1), can be presented in several phases. In the first, the identification and selection of valuable sources of information related to vulnerabilities and exploits was carried out. The objects of interest here are structured sources (from which it is easier to retrieve data) and unstructured sources, such as blogs or individual websites (from which retrieving data is usually more complicated, but which may provide information ahead of official databases or contain unique data). In the second stage, we collected information from these sources, and this information was then standardized; in the third stage, information from different sources on a given vulnerability or exploit was correlated and aggregated. The fourth stage involved enriching and selecting the most reliable information about each vulnerability and exploit. We prepared dictionaries of information on vendors, models and types of devices, as well as on types of vulnerabilities. These dictionaries were used as keywords for text searches and training datasets for other methods. The trust evaluation aims to select the most reliable and informative part of the information, assess the reliability of the information, and identify IoT-related vulnerabilities and exploits. This is conducted based on the source's reputation, the convergence of information from different sources, the method of aggregation and classification, and additional searches. The database created as described above can then be shared and used by various entities. The search for information related to the IoT is also carried out through filtering at various levels using the IoT device taxonomy we have created, an internal IoT device catalogue, and a filtering mechanism based on keywords, for example. A detailed description of the process can be found in [17].  
The following sections outline some unique features of the vulnerability and exploit databases that we are still working on. The first unique property is the ability to have a database with such a wide range of information about IT and also IoT vulnerabilities. Figure 2 shows the most common vendors in our database. As far as authors are aware, the information contained in the databases is the most complete compared to other publicly available databases. The sheer number of vulnerabilities present shows how much effort goes into finding and aggregating them. The second important element regarding the uniqueness of our database is the development of an automatic way of calculating the severity of vulnerabilities using AI. The third challenge we have taken on is to categorize devices, i.e., assign categories based on the data available in the database for each vulnerable product, i.e., vendors, models, and versions.  
Figure 1: Vulnerability database creation process (all trademarks, logos, and brand names are the property of their respective owners. All company, product, and service names used in this paper are for identification purposes only).