Volume 19 • Issue 1 • PP: 16–34 • 2027
Intelligent Early Warning for IoT Software Supply Chains: Self-Exciting Point-Process and Hierarchical Bayesian Modelling of Open-Source Security Advisories
Open Access & Copyright
© 2027 The Author(s). Published by ASPG. This article is licensed under the Creative Commons Attribution 4.0 International License (CC BY 4.0).
View PDF Abstract
Internet of Things gateways, edge controllers and smart-home hubs run on open-source packages, so the advisories published for those packages are the signal that intelligent vulnerability-monitoring systems must interpret. We model that signal as a stochastic process, using every reviewed advisory in the GitHub Advisory Database as of 31 July 2026 across eight package ecosystems. Binary segmentation places a regime change in February 2026, after which monthly volume rose almost fivefold, driven by maintainer-written advisories that now usually precede the National Vulnerability Database. A modulated Hawkes process, estimated by expectation–maximisation, separates batch release from triggering and finds that nearly half of advisories arrive in same-hour batches, while self-excitation between batches is weak (branching ratio 0.05, half-life eight hours). Risk is concentrated. Advisories per package are heavy-tailed (exponent 2.14), and a beta-binomial empirical Bayes model concentrates the 12% of unpatched entries in a small set of packages. IoT-related packages carry more Critical advisories (22% against 13%) and more unpatched entries (18% against 12%). An adaptive early-warning score derived from the fitted process anticipates follow-up disclosures within seven days with an AUC of 0.75, equal to the strongest heuristic and interpretable, although its probabilities run low during the surge.
Keywords
References
[1] D. Wermke, N. Wöhler, J. H. Klemmer, M. Fourné, M. Acar, and S. Fahl, “Committed to trust: A qualitative study on secu-rity & trust in open source software projects,” in Proceedings of the 2022 IEEE Symposium on Security and Privacy, pp. 1880–1896, 2022.
[2] M. Antonakakis, T. April, M. Bailey, M. Bernhard, E. Bursztein, J. Cochran, Z. Durumeric, J. A. Halderman, L. Invernizzi, M. Kallitsis, D. Kumar, C. Lever, Z. Ma, J. Ma-son, D. Menscher, C. Seaman, N. Sullivan, K. Thomas, and Y. Zhou, “Understanding the Mirai botnet,” in Proceedings of the 26th USENIX Security Symposium, pp. 1093–1110, 2017.
[3] N. Neshenko, E. Bou-Harb, J. Crichigno, G. Kaddoum, and N. Ghani, “Demystifying IoT security: An exhaustive survey on IoT vulnerabilities and a first empirical look on Internet-scale IoT exploitations,” IEEE Communications Surveys & Tutorials, vol. 21, no. 3, pp. 2702–2733, 2019.
[4] O. Alrawi, C. Lever, M. Antonakakis, and F. Monrose, “SoK: Security evaluation of home-based IoT deployments,” in Pro-ceedings of the 2019 IEEE Symposium on Security and Pri-vacy, pp. 1362–1380, 2019.
[5] Executive Office of the President, “Improving the nation’s cybersecurity (Executive Order 14028),” Federal Register, vol. 86, no. 93, pp. 26633–26647, 2021.
[6] N. Imtiaz, S. Thorne, and L. Williams, “A comparative study of vulnerability reporting by software composition analysis tools,” in Proceedings of the 15th ACM/IEEE International Symposium on Empirical Software Engineering and Measure-ment, Art. no. 5, 2021.
[7] Open Source Security Foundation, “OSV schema: Open Source Vulnerability format,” version 1.7.0, 2025.
[8] C. Segal, P. Segal, C. E. de Schuller Banjar, F. Paixão, H. S. Borges, P. Silveira Neto, E. S. de Almeida, J. C. S. Santos, A. Kocheturov, G. K. Srivastava, and D. S. Menasché, “Charac-terizing and modeling the GitHub Security Advisories review pipeline,” in Proceedings of the 23rd ACM/IEEE International Conference on Mining Software Repositories, pp. 311–322, 2026.
[9] U.S. Department of Commerce, Office of Inspector General, “Evaluation of NIST’s Management of the National Vulnera-bility Database,” Report No. OIG-26-020-I, May 26, 2026.
[10] National Institute of Standards and Technology, “NIST Up-dates NVD Operations to Address Record CVE Growth,” Apr. 15, 2026.
[11] M. Ohm, H. Plate, A. Sykosch, and M. Meier, “Backstabber’s knife collection: A review of open source software supply chain attacks,” in Detection of Intrusions and Malware, and Vulnerability Assessment (DIMVA 2020), Springer, pp. 23–43, 2020.
[12] P. Ladisa, H. Plate, M. Martinez, and O. Barais, “SoK: Tax-onomy of attacks on open-source software supply chains,” in Proceedings of the 2023 IEEE Symposium on Security and Privacy, pp. 1509–1526, 2023.
[13] A. Decan, T. Mens, and E. Constantinou, “On the impact of security vulnerabilities in the npm package dependency network,” in Proceedings of the 15th International Conference on Mining Software Repositories, pp. 181–191, 2018.
[14] M. Alfadel, D. E. Costa, and E. Shihab, “Empirical analysis of security vulnerabilities in Python packages,” Empirical Software Engineering, vol. 28, no. 3, Art. no. 59, 2023.
[15] G. A. A. Prana, A. Sharma, L. K. Shar, D. Foo, A. E. Santosa, A. Sharma, and D. Lo, “Out of sight, out of mind? How vulnerable dependencies affect open-source projects,” Empirical Software Engineering, vol. 26, no. 4, Art. no. 59, 2021.
[16] N. Imtiaz, A. Khanom, and L. Williams, “Open or sneaky?Fast or slow? Light or heavy?: Investigating security releases of open source packages,” IEEE Transactions on Software Engineering, vol. 49, no. 4, pp. 1540–1560, 2023.
[17] M. Zimmermann, C.-A. Staicu, C. Tenny, and M. Pradel, “Small world with high risks: A study of security threats in the npm ecosystem,” in Proceedings of the 28th USENIX Security Symposium, USENIX Association, pp. 995–1010, 2019.
[18] C. Yang-Smith and A. Abdellatif, “Tracing vulnerabilities in Maven: A study of CVE lifecycles and dependency networks,” arXiv:2502.04621, 2025.
[19] R. G. Kula, D. M. German, A. Ouni, T. Ishio, and K. Inoue, “Do developers update their library dependencies? An em-pirical study on the impact of security advisories on library migration,” Empirical Software Engineering, vol. 23, no. 1, pp. 384–417, 2018.
[20] I. Pashchenko, H. Plate, S. E. Ponta, A. Sabetta, and F. Mas-sacci, “Vulnerable open source dependencies: Counting those that matter,” in Proceedings of the 12th ACM/IEEE Interna-tional Symposium on Empirical Software Engineering and Measurement, Art. no. 42, 2018.
[21] A. G. Hawkes, “Spectra of some self-exciting and mutually exciting point processes,” Biometrika, vol. 58, no. 1, pp. 83–90, 1971.
[22] T. Ozaki, “Maximum likelihood estimation of Hawkes’ self-exciting point processes,” Annals of the Institute of Statistical Mathematics, vol. 31, no. 1, pp. 145–155, 1979.
[23] Y. Ogata, “Statistical models for earthquake occurrences and residual analysis for point processes,” Journal of the American Statistical Association, vol. 83, no. 401, pp. 9–27, 1988.
[24] A. Veen and F. P. Schoenberg, “Estimation of space–time branching process models in seismology using an EM-type algorithm,” Journal of the American Statistical Association, vol. 103, no. 482, pp. 614–624, 2008.
[25] E. N. Brown, R. Barbieri, V. Ventura, R. E. Kass, and L. M. Frank, “The time-rescaling theorem and its application to neural spike train data analysis,” Neural Computation, vol. 14, no. 2, pp. 325–346, 2002.
[26] A. Clauset, C. R. Shalizi, and M. E. J. Newman, “Power-law distributions in empirical data,” SIAM Review, vol. 51, no. 4, pp. 661–703, 2009.
[27] Q. H. Vuong, “Likelihood ratio tests for model selection and non-nested hypotheses,” Econometrica, vol. 57, no. 2, pp. 307–333, 1989.
[28] J. Alstott, E. Bullmore, and D. Plenz, “powerlaw: A Python package for analysis of heavy-tailed distributions,” PLOS ONE, vol. 9, no. 1, Art. no. e85777, 2014.
[29] D. A. Williams, “The analysis of binary responses from toxico-logical experiments involving reproduction and teratogenicity,” Biometrics, vol. 31, no. 4, pp. 949–952, 1975.
[30] B. Efron and C. Morris, “Data analysis using Stein’s estimator and its generalizations,” Journal of the American Statistical Association, vol. 70, no. 350, pp. 311–319, 1975.
[31] J. Lin, “Divergence measures based on the Shannon entropy,” IEEE Transactions on Information Theory, vol. 37, no. 1, pp. 145–151, 1991.
[32] D. M. Endres and J. E. Schindelin, “A new metric for probabil-ity distributions,” IEEE Transactions on Information Theory, vol. 49, no. 7, pp. 1858–1860, 2003.
[33] R. R. Sokal and C. D. Michener, “A statistical method for evaluating systematic relationships,” University of Kansas Science Bulletin, vol. 38, pp. 1409–1438, 1958.
[34] A. J. Scott and M. Knott, “A cluster analysis method for grouping means in the analysis of variance,” Biometrics, vol. 30, no. 3, pp. 507–512, 1974.
[35] R. Killick, P. Fearnhead, and I. A. Eckley, “Optimal detection of changepoints with a linear computational cost,” Journal of the American Statistical Association, vol. 107, no. 500, pp. 1590–1598, 2012.
[36] A. C. Cameron and P. K. Trivedi, Regression Analysis of Count Data, 2nd ed. Cambridge, U.K.: Cambridge University Press, 2013.
[37] J. Cohen, “Weighted kappa: Nominal scale agreement provi-sion for scaled disagreement or partial credit,” Psychological Bulletin, vol. 70, no. 4, pp. 213–220, 1968.
[38] Forum of Incident Response and Security Teams, “Common Vulnerability Scoring System version 3.1: Specification docu-ment,” 2019.
[39] Forum of Incident Response and Security Teams, “Common Vulnerability Scoring System version 4.0: Specification docu-ment,” 2023.
[40] Cybersecurity and Infrastructure Security Agency, “Binding Operational Directive 22-01: Reducing the significant risk of known exploited vulnerabilities,” U.S. Department of Home-land Security, 2021.
Cite This Article
Choose your preferred format
Publisher's Note
The statements, opinions, and data presented in this article are solely those of the author(s) and do not necessarily represent those of ASPG, the journal, or its editors. ASPG and the editors disclaim responsibility for any harm arising from the use of any ideas, methods, instructions, or products described in this article, to the fullest extent permitted by applicable law.