## 6 Discussion and Future Work
### Quality of Information in VARIoT Versus Other Databases  
As shown earlier, the VARIoT database contains information on a much larger number of vulnerabilities than other databases. Importantly is that the quality of those data (in terms of completeness and correctness) is also higher than in any other database. The average length of a vulnerability description in the NVD database [30] is about 200-300 words; in the VARIoT database, it is 500-600 words. Obviously, a longer description is not necessarily better; however, in the VARIoT database, a vulnerability description is created by an NLP method (Word Mover's Distance [56]) which tries to preserve only the information that brings additional value to the remaining sentences. Because of that, it can be stated that descriptions in the VARIoT database contain more potentially helpful information. The advantage of the VARIoT applies not only to the NVD database but also to other databases. After all, this was the purpose of the VARIoT database--to aggregate data from various sources but not duplicate them unnecessarily--also at the level of the vulnerability description. It is also worth noting that, even in the NVD database (which is the de facto standard and is perceived as the most comprehensive, so, in our case, we also take it as a reference), there are gaps in some of the information, especially for new vulnerabilities that have not been fully analysed yet. Lacking elements include the vulnerability criticality assessment in line with the CVSS (such gaps affect above 10% of vulnerabilities released in 2024, including information provided by other databases and aggregated in the VARIoT--state actual on 15 October 2024); for newer vulnerabilities, this percentage is even higher. In the case of the VARIoT database, information is much more complete (due to aggregation from many sources), and, even in the case where no source provides a criticality assessment of a given vulnerability, a vulnerability assessment tool based on ML methods is automatically used (which is briefly described in Section 3.3). Thanks to this, 100% of vulnerabilities have a criticality assessment in the VARIoT database. Another advantage of the VARIoT database compared to other databases is the timeline of vulnerabilities. In most databases, the date of publishing the information is provided. However, only a few of them have additional data about the history of the vulnerability (e.g., date of first seen, date of reporting, date of confirmation). The ZDI database [34] should be distinguished in that context as it provides comprehensive information related to the timeline but contains a relatively small number of vulnerabilities. The VARIoT, on its own, of course, could not provide all of those dates. However, due to the aggregation of information from many sources, it contains a broader view of the timeline of the vulnerability (e.g., it could indicate when and in which database information about the vulnerability was provided first). As the VARIoT database is built as an aggregator of other databases (listed in Section 3), it contains more information about vulnerabilities both in terms of width (more vulnerabilities) and in terms of depth (more information related to a specific vulnerability) than any other single database. As some databases (for example, Vulners [9]) contain information from various sources, it does not try to aggregate information about specific vulnerabilitiesfrom many sources but presents it in the original form. Instead, the VARIoT presents the most comprehensive information possible about a specific vulnerability in a very useful format and deduplicates the same information. Various mechanisms (such as identifier matching or other means of correlation) are used to identify which database entries correspond to the same vulnerability or exploit. An entire detailed description of the process of aggregation, correlation, and deduplication without loss of relevant information while maintaining the integrity of data from multiple sources is described in [17].