VAOS: Vulnerability Attribute Ontology Score Framework for Evaluating Vulnerability Databases

Abstract

Vulnerability repositories play a foundational role in enabling organizations to perform vulnerability scoring, prioritization, and threat modeling; however, they vary widely in the vulnerability attributes they define, require, and make available within their repository schemas. Although existing taxonomies describe numerous vulnerability characteristics, limited research evaluates how effectively real‑world repositories support these practical security activities. This paper introduces the Vulnerability Attribute Ontology Score (VAOS), a framework for evaluating vulnerability repositories rather than individual vulnerabilities. VAOS defines nineteen weighted attributes organized across mandatory, recommended, and optional tiers. The framework is applied to ten vulnerability repositories spanning more than five decades, revealing substantial variation in attribute coverage—particularly in contextual attributes—and demonstrating VAOS’s value for repository evaluation, selection, and integration.