Assessing the risks of software vulnerabilities is a key process of software development and security management. This assessment requires to consider multiple factors (technical features, operational environment, involved assets, status of the vulnerability lifecycle, etc.) and may depend from the assessor’s knowledge and skills. In this work, we tackle with an important part of this problem by measuring the accuracy oftechnicalvulnerability assessments by assessors with different level and type of knowledge. We report an experiment to compare how accurately students with different technical education and security professionals are able to assess the severity of software vulnerabilities with the Common Vulnerability Scoring System (v3) industry methodology. Our results could be useful for increasing awareness about the intrinsic subtleties of vulnerability risk assessment and possibly better compliance with regulations. With respect to academic education, professional training and human resources selections our work suggests that measuring the effects of knowledge and expertise on the accuracy of software security assessments is feasible albeit not easy.

This work is aimed at studying realistic social control strategies for social networks based on the introduction of random information into the state of selected driver agents. Deliberately exposing selected agents to random information is a technique already experimented in recommender systems or search engines, and represents one of the few options for influencing the behavior of a social context that could be accepted as ethical, could be fully disclosed to members, and does not involve the use of force or of deception. Our research is based on a model of knowledge diffusion applied to a time-varying adaptive network and considers two well-known strategies for influencing social contexts: One is the selection of few influencers for manipulating their actions in order to drive the whole network to a certain behavior; the other, instead, drives the network behavior acting on the state of a large subset of ordinary, scarcely influencing users. The two approaches have been studied in terms of network and diffusion effects. The network effect is analyzed through the changes induced on network average degree and clustering coefficient, while the diffusion effect is based on two ad hoc metrics which are defined to measure the degree of knowledge diffusion and skill level, as well as the polarization of agent interests. The results, obtained through simulations on synthetic networks, show a rich dynamics and strong effects on the communication structure and on the distribution of knowledge and skills. These findings support our hypothesis that the strategic use of random information could represent a realistic approach to social network controllability, and that with both strategies, in principle, the control effect could be remarkable.

Understanding the effects of individual awareness on epidemic phenomena is important to comprehend the coevolving system dynamic, to improve forecasting, and to better evaluate the outcome of possible interventions. In previous models of epidemics on social networks, individual awareness has often been approximated as a generic personal trait that depends on social reinforcement, and used to introduce variability in state transition probabilities. A novelty of this work is to assume that individual awareness is a function of several contributing factors pooled together, different by nature and dynamics, and to study it for different epidemic categories. This way, our model still has awareness as the core attribute that may change state transition probabilities. Another contribution is to study positive and negative variations of awareness, in a contagion-behavior model. Imitation is the key mechanism that we model for manipulating awareness, under different network settings and assumptions, in particular regarding the degree of intentionality that individuals may exhibit in spreading an epidemic. Three epidemic categories are considered—disease, addiction, and rumor—to discuss different imitation mechanisms and degree of intentionality. We assume a population with a heterogeneous distribution of awareness and different response mechanisms to information gathered from the network. With simulations, we show the interplay between population and awareness factors producing a distribution of state transition probabilities and analyze how different network and epidemic configurations modify transmission patterns.

In network models of propagation processes, the individual, microscopic level perspective is the norm, with aggregations studied as possible outcomes. On the contrary, we adopted a mesoscale perspective with groups as the core element and in this sense we present a novel agent-group dynamic model of propagation in networks. In particular, we focus on ephemeral groups that dynamically form, create new links, and dissolve. The experiments simulated 160 model configurations and produced results describing cases of consecutive and non-consecutive dynamic grouping, bounded or unbounded in the number of repetitions. Results revealed the existence of complex dynamics and multiple behaviors. An efficiency metric is introduced to compare the different cases. A Null Model analysis disclosed a pattern in the difference between the group and random models, varying with the size of groups. Our findings indicate that a mesoscopic construct like the ephemeral group, based on assumptions about social behavior and absent any microscopic level change, could produce and describe complex propagation dynamics. A conclusion is that agent-group dynamic models may represent a powerful approach for modelers and a promising new direction for future research in models of coevolution between propagation and behavior in society.

Li ing social restrictions is one of the most critical decisions that public health authorities have to face during a pandemic such as COVID-. This work focuses on the risk associated with such a decision. We have called the period from the reopening decision to epidemic expiration the 'final epidemic phase', and considered the critical epidemic conditions which could possibly emerge in this phase. The factors we have considered include: the proportion of asymptomatic cases, a mitigation strategy based on testing and the average duration of infectious states. By assuming hypothetical configurations at the time of the reopening decision and the partial knowledge concerning epidemic dynamics available to public health authorities, we have analyzed the risk of the reopening decision based on possibly unreliable estimates. We have presented a discrete-time stochastic model with state-dependent transmission probabilities and multi-agent simulations. Our results show the di erent outcomes produced by di erent proportions of undetected asymptomatic cases, di erent probabilities of asymptomatic cases detected and contained, and a multivariate analysis of risk based on the average duration of asymptomatic and contained states. Finally, our analysis highlights that enduring uncertainty, typical of this pandemic, requires a risk analysis approach to complement epidemiological studies.