Research Artifacts for VIRTUE: Vulnerability-to-Requirement Traceability for Model-Based Cybersecurity Engineering

This record contains the computational research artifacts supporting the manuscript “Vulnerability-to-Requirement Traceability for Model-Based Cybersecurity Engineering.” The archive supports the controlled evaluation of VIRTUE, a model-based cybersecurity engineering framework that translates vulnerability intelligence into traceable security requirements, design guidance, control mappings, and audit evidence. The deposited materials include the enriched vulnerability candidate set, the final 27-CVE evaluation set, case-system mappings, score-derivation audit tables, priority-weight configurations, tie-aware ranking outputs, document-coverage sensitivity results, formula records, execution logs, data documentation, and analysis scripts. The quantitative workflow is computationally reproducible from the retained machine-readable inputs, mappings, configuration values, formulas, and code. The resulting priority scores, ranks, summary statistics, sensitivity measures, tables, and figures can therefore be independently recomputed. The archive distinguishes computational reproducibility from semantic judgment. CVE selection, alternative CWE interpretation, case-system component mapping, system relevance, exposure, and ordinal document-coverage assessments include researcher-reviewed decisions. These documented judgments are available for inspection but should not be interpreted as evidence of independent expert validation or inter-reviewer agreement. This Zenodo record is maintained as a private draft during manuscript peer review. The artifacts will be provided to the journal editors or reviewers upon reasonable request. The record and its files will be made publicly accessible upon acceptance and publication of the associated article. Data and documentation are licensed under the Creative Commons Attribution 4.0 International license. Source code and analysis scripts are licensed under the MIT License, as specified in the LICENSE file included in the archive.