Point-in-Time Vulnerability Data: Reproducibility Materials for Historical Vulnerability Reconstruction

Description

Point-in-Time Vulnerability Data v1.0.0 This is the first archived release of the reproducibility materials accompanying the MethodsX article: A Method for Reconstructing Historical Vulnerability Data for Prospective Exploitation Prediction Release scope This release provides code, configuration, schemas, synthetic examples, provenance documentation, and validation evidence for reconstructing vulnerability information as it was available at simulated decision dates and for constructing prospective exploitation outcomes without retrospective predictor backfill. Frozen study design Data freeze: 2026-08-06 Primary training window: 2023-03-29 through 2023-12-31 Validation window: 2024-01-01 through 2024-12-31 Primary held-out 365-day test window: 2025-01-01 through 2025-07-31 Primary outcome: future CISA KEV inclusion within 365 days Index rule: first historical EPSS observation on or after official CVE publication, retained when lag is 0 to 3 calendar days Reproduced publication counts Partition CVEs Future KEV within 365 days Training 22,258 71 Validation 36,498 94 Held-out test 27,419 84 Total 86,175 249 The final production temporal audit completed 25 checks with zero violations. Reproducibility safeguards Historical CVE records are reconstructed from Git history. Current CVE records are not backfilled into earlier decision dates. CVEs already in CISA KEV at or before the index date are excluded from prospective outcome construction. Negatives are assigned only when the complete forecast horizon is observable by the frozen data date. Explicit exploitation-status text is separated from the strict prospective text representation. Primary evaluation uses chronological partitions. Third-party source archives are not redistributed. Release commit The audited GitHub commit for this release is: 67012ecdd8c6720f93e957e3e9c37bb643687b80 Repository: https://github.com/akbak1-dot/point-in-time-vulnerability-data License Repository-authored software is released under the MIT License. Third-party source data retain their original provider terms and are not relicensed or redistributed by this release.

Steps to reproduce

Download the archived v1.0.0 release or clone the GitHub repository akbak1-dot/point-in-time-vulnerability-data and check out tag v1.0.0. Create the Python environment using either: conda env create -f environment.yml and activate point-in-time-vulnerability-data, or install the packages listed in requirements.txt. Retrieve the required third-party source data from their original providers. Full source archives are not redistributed with this dataset: CVE List V5 from the CVE Program historical FIRST EPSS data CISA Known Exploited Vulnerabilities catalog NVD and VulnCheck data are optional for supplementary checks and external validation. Clone the official CVE List V5 Git repository into data/source/cvelistV5. Retain the complete Git history because historical CVE states are reconstructed from commits available at each decision date. Place historical EPSS files in data/source/epss/ and the CISA KEV catalog in data/source/kev/. Extract official CVE publication dates from the frozen CVE List state using: python code/00_extract_publication_dates.py Assign each vulnerability its decision index date using the first historical EPSS observation on or after official CVE publication, retaining observations only when the lag is between 0 and 3 calendar days: python code/02_assign_index_dates.py Reconstruct the historical CVE record using the most recent CVE List V5 Git commit available by 23:59:59 UTC on the index date: python code/03_reconstruct_cve_history.py Do not use current CVE records to fill fields that were unavailable historically. Attach the historical EPSS value corresponding to the index date: python code/04_attach_historical_epss.py Construct the strict prospective text representation, which removes complete sentences explicitly reporting active or observed exploitation while preserving the full historical text separately: python code/05_build_strict_text.py Construct the 30-, 90-, 180-, and 365-day future KEV outcomes: python code/06_construct_outcomes.py --freeze-date 2026-08-06 Exclude CVEs already present in KEV on or before the index date. Assign a negative outcome only when the complete forecast horizon is observable by the frozen data date. Create the chronological analytical partitions: Training: March 29, 2023 to December 31, 2023 Validation: January 1, 2024 to December 31, 2024 Held-out 365-day test: January 1, 2025 to July 31, 2025 Run: python code/07_create_temporal_splits.py Run the temporal-integrity and leakage checks: python code/08_run_validation_checks.py Compare the reconstructed analytical sample with the frozen publication counts: python code/09_compare_publication_counts.py

Institutions

• Morgan State University

  Maryland, Baltimore

Categories

Licence