Introducing abstraction to vulnerability analysis