analysis.py

"""
analysis.py — Full pipeline: fetch → match → analyse → charts
=============================================================

Reproduces every numerical claim in EUVD_KEV_Paper_revised.md.

Data sources:
  CISA KEV: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
  EUVD:     https://euvdservices.enisa.europa.eu/api/search?exploited=true

Outputs:
  data/kev_raw.json         — full KEV catalogue
  data/euvd_exploited.json  — all EUVD exploited records (deduplicated)
  data/merged.json          — merged dataset with delay fields and OT flags
  charts/fig1_histogram.png — histogram of post-launch delays
  charts/fig2_cumulative.png — CDF of post-launch delays
  charts/fig3_monthly.png   — monthly timeliness stacked bar
  charts/fig4_coverage.png  — coverage overlap bar chart

Requirements:
  pip install requests pandas matplotlib numpy
"""

import json
import os
import statistics
import time
from collections import defaultdict
from datetime import datetime, timezone

import matplotlib
matplotlib.use("Agg")
import matplotlib.pyplot as plt
import matplotlib.ticker as mticker
import numpy as np
import requests

# ── Config ────────────────────────────────────────────────────────────────────

KEV_URL     = "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json"
EUVD_API    = "https://euvdservices.enisa.europa.eu/api"
HEADERS     = {"Accept": "application/json", "User-Agent": "academic-research/1.0"}
EUVD_LAUNCH = datetime(2025, 5, 13, tzinfo=timezone.utc)

DATA_DIR   = "data"
CHARTS_DIR = "charts"

# Colour palette
BLUE  = "#1F3864"
LBLUE = "#4472C4"
GOLD  = "#D4A017"
RED   = "#C00000"
LGREY = "#E8EEF4"

plt.rcParams.update({"font.family": "DejaVu Sans", "font.size": 10})

# OT vendor / product classification
OT_VENDOR_KEYWORDS = {
    "Siemens":             ["siemens"],
    "Schneider Electric":  ["schneider electric"],
    "Rockwell Automation": ["rockwell"],
    "Delta Electronics":   ["delta electronics"],
    "Unitronics":          ["unitronics"],
    "Trihedral":           ["trihedral"],
    "OpenPLC/ScadaBR":     ["openplc", "scadabr"],
    "Honeywell":           ["honeywell"],
    "ABB":                 [" abb "],
    "Mitsubishi Electric": ["mitsubishi"],
    "Moxa":                ["moxa"],
    "Beckhoff":            ["beckhoff"],
    "Yokogawa":            ["yokogawa"],
    "Omron":               ["omron"],
    "AVEVA":               ["aveva", "wonderware"],
}

OT_PRODUCT_KEYWORDS = [
    "scada", " plc", " hmi", "vision plc", "vtscada",
    "wincc", "step 7", "tia portal", "rslogix", "factory talk",
    "melsec", "melsoft",
]


# ── Helpers ───────────────────────────────────────────────────────────────────

def parse_date(s):
    """Parse EUVD or KEV date strings to UTC datetime. Returns None on failure."""
    if not s:
        return None
    fmts = [
        "%b %d, %Y, %I:%M:%S %p",
        "%b %d, %Y, %I:%M %p",
        "%Y-%m-%d",
        "%Y-%m-%dT%H:%M:%S",
        "%Y-%m-%dT%H:%M:%SZ",
    ]
    for fmt in fmts:
        try:
            return datetime.strptime(s.strip(), fmt).replace(tzinfo=timezone.utc)
        except ValueError:
            continue
    return None


def classify_ot(vendor, product):
    """Return OT vendor label or None."""
    vl = (vendor or "").lower()
    pl = (product or "").lower()
    for label, keywords in OT_VENDOR_KEYWORDS.items():
        if any(kw in vl for kw in keywords):
            return label
    for kw in OT_PRODUCT_KEYWORDS:
        if kw in pl or kw in vl:
            return "Other OT"
    return None


def pct(a, b):
    return f"{100*a/b:.1f}%" if b else "N/A"


def fetch_with_retry(url, params=None, retries=3, delay=5):
    """GET with retry on transient failures."""
    for attempt in range(1, retries + 1):
        try:
            r = requests.get(url, params=params, headers=HEADERS, timeout=30)
            r.raise_for_status()
            return r.json()
        except Exception as e:
            if attempt == retries:
                raise
            print(f"  [retry {attempt}/{retries}] {e}")
            time.sleep(delay)


# ── Step 1: Data collection ────────────────────────────────────────────────────

def fetch_kev():
    print("[KEV] Fetching catalogue...")
    data = fetch_with_retry(KEV_URL)
    vulns = data["vulnerabilities"]
    print(f"[KEV] {len(vulns)} entries retrieved.")
    os.makedirs(DATA_DIR, exist_ok=True)
    with open(f"{DATA_DIR}/kev_raw.json", "w") as f:
        json.dump(data, f, indent=2)
    return vulns


def fetch_euvd_exploited():
    """
    Paginate EUVD /search?exploited=true.

    NOTE: The EUVD API has a known pagination overlap that causes some records
    to appear on two consecutive pages. We deduplicate by EUVD record ID before
    returning. In practice this affects 3 records (EUVD-2013-4655,
    EUVD-2016-8058, EUVD-2025-6318).
    """
    print("[EUVD] Fetching exploited vulnerabilities (paginated)...")
    seen_ids = set()
    all_items = []
    page = 0
    size = 100

    while True:
        data = fetch_with_retry(
            f"{EUVD_API}/search",
            params={"exploited": "true", "size": size, "page": page},
        )
        items = data.get("items", [])
        total = data.get("total", 0)
        new_items = []
        for item in items:
            eid = item.get("id")
            if eid not in seen_ids:
                seen_ids.add(eid)
                new_items.append(item)
        all_items.extend(new_items)
        print(f"  Page {page}: {len(items)} raw, {len(new_items)} new "
              f"(cumulative unique: {len(all_items)}/{total})")
        if len(all_items) >= total or not items:
            break
        page += 1
        time.sleep(0.5)

    print(f"[EUVD] Unique exploited records: {len(all_items)} "
          f"(raw API total: {total})")
    with open(f"{DATA_DIR}/euvd_exploited.json", "w") as f:
        json.dump(all_items, f, indent=2)
    return all_items, total


# ── Step 2: Build CVE lookup and matching ─────────────────────────────────────

def build_cve_lookup(euvd_items):
    """
    Index EUVD records by CVE alias.
    Where a CVE appears in multiple records (e.g. listed in two different EUVD
    entries), keep the one with the earliest datePublished.
    """
    cve_to_euvd = {}
    for item in euvd_items:
        aliases = item.get("aliases", "")
        for alias in aliases.strip().split("\n"):
            alias = alias.strip().upper()
            if not alias.startswith("CVE-"):
                continue
            if alias not in cve_to_euvd:
                cve_to_euvd[alias] = item
            else:
                existing_date = cve_to_euvd[alias].get("datePublished", "9999")
                new_date = item.get("datePublished", "9999")
                if new_date < existing_date:
                    cve_to_euvd[alias] = item

    print(f"[MATCH] Unique CVEs indexed from EUVD: {len(cve_to_euvd)}")
    with open(f"{DATA_DIR}/cve_to_euvd.json", "w") as f:
        json.dump(cve_to_euvd, f, indent=2)
    return cve_to_euvd


# ── Step 3: Merge datasets ────────────────────────────────────────────────────

def build_merged(kev_vulns, cve_to_euvd):
    rows = []
    for entry in kev_vulns:
        cve         = entry["cveID"].strip().upper()
        vendor      = entry.get("vendorProject", "")
        product     = entry.get("product", "")
        kev_date_s  = entry.get("dateAdded", "")
        kev_dt      = parse_date(kev_date_s)

        euvd_rec    = cve_to_euvd.get(cve)
        euvd_found  = euvd_rec is not None
        post_launch = bool(kev_dt and kev_dt >= EUVD_LAUNCH)

        euvd_pub_s   = ""
        euvd_exp_s   = ""
        delay_pub    = None
        delay_exploit = None
        euvd_id      = ""
        euvd_epss    = None

        if euvd_rec:
            euvd_pub_s    = euvd_rec.get("datePublished", "")
            euvd_exp_s    = euvd_rec.get("exploitedSince", "")
            euvd_id       = euvd_rec.get("id", "")
            euvd_epss     = euvd_rec.get("epss")
            euvd_pub_dt   = parse_date(euvd_pub_s)
            euvd_exp_dt   = parse_date(euvd_exp_s)

            if kev_dt and euvd_pub_dt:
                # positive = EUVD later; negative = EUVD earlier (already tracked CVE)
                delay_pub = (euvd_pub_dt - kev_dt).days
            if kev_dt and euvd_exp_dt:
                delay_exploit = (euvd_exp_dt - kev_dt).days

        ot_label = classify_ot(vendor, product)

        rows.append({
            "cve":                  cve,
            "vendor":               vendor,
            "product":              product,
            "vuln_name":            entry.get("vulnerabilityName", ""),
            "ransomware":           entry.get("knownRansomwareCampaignUse", ""),
            "kev_date":             kev_date_s,
            "euvd_found":           euvd_found,
            "euvd_id":              euvd_id,
            "euvd_published":       euvd_pub_s,
            "euvd_exploited_since": euvd_exp_s,
            "euvd_epss":            euvd_epss,
            "delay_pub_days":       delay_pub,
            "delay_exploit_days":   delay_exploit,
            "is_ot":                ot_label is not None,
            "ot_label":             ot_label or "",
            "post_launch":          post_launch,
        })

    with open(f"{DATA_DIR}/merged.json", "w") as f:
        json.dump(rows, f, indent=2)
    return rows


# ── Step 4–6: Statistics ──────────────────────────────────────────────────────

def print_all_stats(rows, euvd_raw_count, cve_to_euvd):
    kev_cves    = {r["cve"] for r in rows}
    matched     = [r for r in rows if r["euvd_found"]]
    unmatched   = [r for r in rows if not r["euvd_found"]]
    pre_launch  = [r for r in rows if not r["post_launch"]]
    post_launch = [r for r in rows if r["post_launch"]]
    post_match  = [r for r in post_launch if r["euvd_found"]]
    ot_rows     = [r for r in rows if r["is_ot"]]

    euvd_only   = [cve for cve in cve_to_euvd if cve not in kev_cves]
    euvd_unique = len(cve_to_euvd)
    total_kev   = len(rows)

    print("\n" + "═"*60)
    print("STEP 2 — MATCHING SUMMARY")
    print("═"*60)
    print(f"  Total KEV entries              : {total_kev}")
    print(f"  EUVD raw API records           : {euvd_raw_count}")
    print(f"  EUVD pagination duplicates     : {euvd_raw_count - euvd_unique}")
    print(f"  EUVD unique records            : {euvd_unique}")
    print(f"  Matched (in both)              : {len(matched)} ({pct(len(matched), total_kev)})")
    print(f"  KEV-only (not in EUVD)         : {len(unmatched)}")
    print(f"  EUVD-only (not in KEV)         : {len(euvd_only)}")
    print(f"  Math check — matched+KEV-only  : {len(matched)+len(unmatched)} = {total_kev} ✓"
          if len(matched)+len(unmatched) == total_kev else "  Math check FAILED")
    print(f"  Math check — matched+EUVD-only : {len(matched)+len(euvd_only)} = {euvd_unique} ✓"
          if len(matched)+len(euvd_only) == euvd_unique else "  Math check FAILED")

    print(f"\n  KEV-only entries:")
    for r in unmatched:
        print(f"    {r['cve']:20s} | {r['vendor']:25s} | KEV: {r['kev_date']}")

    print(f"\n  EUVD-only CVEs:")
    for cve in sorted(euvd_only):
        rec = cve_to_euvd[cve]
        print(f"    {cve:20s} | exploitedSince: {rec.get('exploitedSince','')}")

    print("\n" + "═"*60)
    print("STEP 3 — TEMPORAL SEGMENTATION")
    print("═"*60)
    print(f"  EUVD launch date               : 2025-05-13")
    print(f"  Pre-launch KEV entries         : {len(pre_launch)}")
    print(f"  Pre-launch matched in EUVD     : {sum(1 for r in pre_launch if r['euvd_found'])} "
          f"({pct(sum(1 for r in pre_launch if r['euvd_found']), len(pre_launch))})")
    print(f"  Pre-launch NOT in EUVD         : {sum(1 for r in pre_launch if not r['euvd_found'])}")
    print(f"  Post-launch KEV entries        : {len(post_launch)}")
    print(f"  Post-launch matched in EUVD    : {len(post_match)}")
    print(f"  Post-launch NOT in EUVD        : {len(post_launch) - len(post_match)}")
    if len(post_launch) - len(post_match):
        unmatched_post = [r for r in post_launch if not r["euvd_found"]]
        for r in unmatched_post:
            print(f"    → {r['cve']} ({r['vendor']}, KEV: {r['kev_date']})")

    print("\n" + "═"*60)
    print("STEP 4 — exploitedSince MIRROR CHECK")
    print("═"*60)
    exploit_delays = [r["delay_exploit_days"] for r in matched
                      if r["delay_exploit_days"] is not None]
    same_kev = sum(1 for d in exploit_delays if d == 0)
    exceptions = [(r["cve"], r["delay_exploit_days"], r["kev_date"], r["euvd_exploited_since"])
                  for r in matched if r.get("delay_exploit_days") not in (None, 0)]
    print(f"  Records with exploitedSince    : {len(exploit_delays)}")
    print(f"  exploitedSince == KEV dateAdded: {same_kev} ({pct(same_kev, len(exploit_delays))})")
    print(f"  exploitedSince EARLIER (<0d)   : {sum(1 for d in exploit_delays if d < 0)}")
    print(f"  exploitedSince LATER  (>0d)    : {sum(1 for d in exploit_delays if d > 0)}")
    print(f"  Exceptions (non-zero):")
    for cve, diff, kev_d, euvd_d in sorted(exceptions, key=lambda x: x[1]):
        print(f"    {cve}: {diff:+d}d  (KEV: {kev_d} | EUVD exploitedSince: {euvd_d})")

    print("\n" + "═"*60)
    print("STEP 5 — POST-LAUNCH DELAY ANALYSIS")
    print("═"*60)
    delays = [r["delay_pub_days"] for r in post_match
              if r["delay_pub_days"] is not None]
    delays_s = sorted(delays)
    n = len(delays_s)
    mean   = sum(delays_s) / n
    median = statistics.median(delays_s)
    stdev  = statistics.stdev(delays_s) if n > 1 else 0
    neg    = sum(1 for d in delays_s if d < 0)
    zero   = sum(1 for d in delays_s if d == 0)
    pos17  = sum(1 for d in delays_s if 1 <= d <= 7)
    pos7p  = sum(1 for d in delays_s if d > 7)

    print(f"  n (post-launch matched)        : {n}")
    print(f"  Median delay                   : {median:+.0f} days")
    print(f"  Mean delay                     : {mean:+.1f} days")
    print(f"  Stdev                          : {stdev:.0f} days")
    print(f"  Min                            : {min(delays_s)} days")
    print(f"  Max                            : {max(delays_s)} days")
    print(f"  EUVD earlier (<0)              : {neg} ({pct(neg, n)})")
    print(f"  Same day (0)                   : {zero} ({pct(zero, n)})")
    print(f"  EUVD 1–7 days later            : {pos17} ({pct(pos17, n)})")
    print(f"  EUVD >7 days later             : {pos7p} ({pct(pos7p, n)})")

    lag_cases = sorted(
        [r for r in post_match if (r.get("delay_pub_days") or 0) > 0],
        key=lambda x: -(x["delay_pub_days"] or 0)
    )
    print(f"\n  Lag cases (EUVD later than KEV): {len(lag_cases)}")
    print(f"  {'CVE':20s} {'Vendor':20s} {'KEV Added':12s} {'EUVD Published':24s} Lag")
    print("  " + "-"*90)
    for r in lag_cases:
        print(f"  {r['cve']:20s} {r['vendor']:20s} {r['kev_date']:12s} "
              f"{r['euvd_published'][:24]:24s} +{r['delay_pub_days']}d")

    print(f"\n  Quarterly breakdown:")
    period_data = defaultdict(list)
    for r in post_match:
        kd = parse_date(r["kev_date"])
        if kd and r.get("delay_pub_days") is not None:
            period = f"{kd.year}-Q{(kd.month-1)//3+1}"
            period_data[period].append(r["delay_pub_days"])
    for period in sorted(period_data):
        pd = sorted(period_data[period])
        nn = len(pd)
        same = sum(1 for d in pd if d == 0)
        lag  = sum(1 for d in pd if d > 0)
        med  = statistics.median(pd)
        print(f"  {period}: n={nn:3d}, median={med:+5.0f}d, "
              f"same-day={same}({pct(same,nn)}), lag>0={lag}({pct(lag,nn)})")

    print("\n" + "═"*60)
    print("STEP 6 — OT VENDOR ANALYSIS")
    print("═"*60)
    print(f"  OT entries in KEV              : {len(ot_rows)} ({pct(len(ot_rows), total_kev)})")
    print(f"\n  {'CVE':20s} {'Vendor':30s} {'Product':30s} {'KEV Added':12s} "
          f"{'Pub Delay':>10s} {'ExpSince Lag':>12s}")
    print("  " + "-"*120)
    for r in sorted(ot_rows, key=lambda x: x["kev_date"]):
        pd = f"{r['delay_pub_days']:+d}d" if r["delay_pub_days"] is not None else "N/A"
        ed = f"{r['delay_exploit_days']:+d}d" if r["delay_exploit_days"] is not None else "N/A"
        print(f"  {r['cve']:20s} {r['vendor']:30s} {r['product'][:30]:30s} "
              f"{r['kev_date']:12s} {pd:>10s} {ed:>12s}")

    print("\n" + "═"*60)
    return delays_s


# ── Chart generation ──────────────────────────────────────────────────────────

def make_charts(rows, delays_s):
    os.makedirs(CHARTS_DIR, exist_ok=True)
    post_match = [r for r in rows if r["post_launch"] and r["euvd_found"]
                  and r["delay_pub_days"] is not None]
    n = len(delays_s)

    # ── Figure 1: Histogram of post-launch delays ─────────────────────────────
    fig, ax = plt.subplots(figsize=(10, 5))
    bin_edges = list(range(-100, 15, 5))
    ax.hist(delays_s, bins=bin_edges, color=LBLUE, edgecolor="white",
            linewidth=0.5, zorder=3)
    ax.axvline(0, color=RED, linestyle="--", linewidth=1.5,
               label="No lag (day 0)", zorder=4)
    med = statistics.median(delays_s)
    ax.axvline(med, color=GOLD, linestyle=":", linewidth=2,
               label=f"Median: {med:.0f} days", zorder=4)
    ax.set_xlabel(
        "Days (EUVD datePublished − KEV dateAdded)\n"
        "Negative = EUVD already published the CVE before KEV flagged exploitation",
        fontsize=10)
    ax.set_ylabel("Number of CVEs", fontsize=10)
    ax.set_title(
        f"Figure 1 — Post-Launch Publication Delay: CISA KEV vs. EUVD (n={n})\n"
        "(KEV entries added after EUVD launch: 2025-05-13 to 2026-05-07)",
        fontsize=11, fontweight="bold", color=BLUE)
    ax.set_facecolor(LGREY)
    ax.grid(axis="y", alpha=0.5, color="white", zorder=0)
    ax.legend(fontsize=10)
    p_on_time = sum(1 for d in delays_s if d <= 0) / n
    ax.text(0.01, 0.92, f"{100*p_on_time:.1f}% published same day or earlier",
            transform=ax.transAxes, fontsize=9, color=BLUE, style="italic",
            bbox=dict(boxstyle="round,pad=0.3", facecolor="white", alpha=0.7))
    plt.tight_layout()
    plt.savefig(f"{CHARTS_DIR}/fig1_histogram.png", dpi=300, bbox_inches="tight")
    plt.close()
    print(f"[CHART] fig1_histogram.png saved.")

    # ── Figure 2: Cumulative distribution ────────────────────────────────────
    fig, ax = plt.subplots(figsize=(10, 5))
    y = np.arange(1, n + 1) / n
    ax.plot(delays_s, y, color=BLUE, linewidth=2.5,
            label=f"Post-launch entries (n={n})")
    ax.axvline(0, color=RED, linestyle="--", linewidth=1.2, label="Zero lag")
    ax.axhline(0.5, color=GOLD, linestyle=":", linewidth=1.2,
               label="50th percentile")
    ax.fill_betweenx([0, 1], 0.5, max(delays_s) + 1, alpha=0.07, color=RED,
                     label="EUVD lag window (1–6d)")
    ax.set_xlabel("Days (EUVD datePublished − KEV dateAdded)", fontsize=10)
    ax.set_ylabel("Cumulative proportion of CVEs", fontsize=10)
    ax.set_title(
        "Figure 2 — Cumulative Distribution of Publication Delay\n"
        "Post-EUVD-launch entries only (2025-05-13 to 2026-05-07)",
        fontsize=11, fontweight="bold", color=BLUE)
    ax.set_facecolor(LGREY)
    ax.grid(alpha=0.4, color="white")
    ax.legend(fontsize=9)
    ax.set_xlim(-100, max(delays_s) + 3)
    ax.yaxis.set_major_formatter(mticker.PercentFormatter(xmax=1))
    p_zero = sum(1 for d in delays_s if d <= 0) / n
    ax.annotate(
        f"{100*p_zero:.1f}% same-day or faster",
        xy=(0, p_zero), xytext=(-85, p_zero - 0.09),
        arrowprops=dict(arrowstyle="->", color=BLUE), fontsize=9, color=BLUE)
    plt.tight_layout()
    plt.savefig(f"{CHARTS_DIR}/fig2_cumulative.png", dpi=300, bbox_inches="tight")
    plt.close()
    print(f"[CHART] fig2_cumulative.png saved.")

    # ── Figure 3: Monthly timeliness (renumbered from old Fig 4) ─────────────
    month_data = defaultdict(lambda: {"lag": 0, "same": 0, "early": 0})
    for r in post_match:
        kd = parse_date(r["kev_date"])
        if not kd:
            continue
        ym = kd.strftime("%Y-%m")
        d  = r["delay_pub_days"]
        if d > 0:
            month_data[ym]["lag"] += 1
        elif d == 0:
            month_data[ym]["same"] += 1
        else:
            month_data[ym]["early"] += 1

    months = sorted(month_data)
    earls  = [month_data[m]["early"] for m in months]
    sames  = [month_data[m]["same"]  for m in months]
    lags   = [month_data[m]["lag"]   for m in months]
    x      = range(len(months))

    fig, ax = plt.subplots(figsize=(12, 5))
    ax.bar(x, earls, label="EUVD earlier (CVE known before KEV exploit flag)",
           color=LBLUE, edgecolor="white")
    ax.bar(x, sames, bottom=earls,
           label="Same day", color=GOLD, edgecolor="white")
    ax.bar(x, lags,
           bottom=[e + s for e, s in zip(earls, sames)],
           label="EUVD later (lag 1–6d)", color=RED, edgecolor="white")
    ax.set_xticks(list(x))
    ax.set_xticklabels([m[2:] for m in months], rotation=45, ha="right", fontsize=9)
    ax.set_xlabel("Month (YY-MM)", fontsize=10)
    ax.set_ylabel("KEV entries added", fontsize=10)
    ax.set_title(
        "Figure 3 — Monthly Distribution of EUVD Timeliness Post-Launch\n"
        "(relative to CISA KEV dateAdded; post-launch entries only)",
        fontsize=11, fontweight="bold", color=BLUE)
    ax.set_facecolor(LGREY)
    ax.grid(axis="y", alpha=0.4, color="white")
    ax.legend(fontsize=9, loc="upper left")
    plt.tight_layout()
    plt.savefig(f"{CHARTS_DIR}/fig3_monthly.png", dpi=300, bbox_inches="tight")
    plt.close()
    print(f"[CHART] fig3_monthly.png saved.")

    # ── Figure 4: Coverage overlap bar (renumbered from old Fig 3) ───────────
    total_kev = len(rows)
    matched_n = sum(1 for r in rows if r["euvd_found"])
    kev_only  = total_kev - matched_n
    euvd_only = 4  # confirmed from data

    fig, ax = plt.subplots(figsize=(9, 4))
    cats   = ["Only in CISA KEV", "In both KEV & EUVD", "Only in EUVD"]
    vals   = [kev_only, matched_n, euvd_only]
    colors = [RED, LBLUE, GOLD]
    bars   = ax.barh(cats, vals, color=colors, edgecolor="white", height=0.45)
    for bar, val in zip(bars, vals):
        label = (f"{val:,} ({100*val/total_kev:.1f}%)"
                 if val != euvd_only else f"{val} CVEs")
        ax.text(bar.get_width() + 5,
                bar.get_y() + bar.get_height() / 2,
                label, va="center", fontsize=10)
    ax.set_xlabel("Number of CVEs", fontsize=10)
    ax.set_title(
        "Figure 4 — Coverage Overlap Between CISA KEV and EUVD Exploited Lists\n"
        f"(Data collected 2026-05-07 | KEV: {total_kev:,} | EUVD unique: {len({r['cve'] for r in rows if r['euvd_found']} | set()):,})",
        fontsize=11, fontweight="bold", color=BLUE)
    ax.set_facecolor(LGREY)
    ax.grid(axis="x", alpha=0.4, color="white")
    ax.set_xlim(0, total_kev * 1.18)
    plt.tight_layout()
    plt.savefig(f"{CHARTS_DIR}/fig4_coverage.png", dpi=300, bbox_inches="tight")
    plt.close()
    print(f"[CHART] fig4_coverage.png saved.")


# ── Entry point ───────────────────────────────────────────────────────────────

def main():
    os.makedirs(DATA_DIR, exist_ok=True)
    os.makedirs(CHARTS_DIR, exist_ok=True)

    # Step 1 — collect
    kev_vulns            = fetch_kev()
    euvd_items, euvd_raw = fetch_euvd_exploited()

    # Step 2 — match
    cve_to_euvd = build_cve_lookup(euvd_items)

    # Step 3 — merge
    rows = build_merged(kev_vulns, cve_to_euvd)

    # Steps 4–6 — statistics
    delays_s = print_all_stats(rows, euvd_raw, cve_to_euvd)

    # Charts
    make_charts(rows, delays_s)

    print("\n[DONE] All outputs saved.")
    print(f"  Data    → {DATA_DIR}/")
    print(f"  Charts  → {CHARTS_DIR}/")
    print(f"  Paper   → EUVD_KEV_Paper_revised.md")


if __name__ == "__main__":
    main()