Predicting Exploitation of Disclosed Software Vulnerabilities Using Open-source Data

by   Benjamin L. Bullough, et al.

Each year, thousands of software vulnerabilities are discovered and reported to the public. Unpatched known vulnerabilities are a significant security risk. It is imperative that software vendors quickly provide patches once vulnerabilities are known and users quickly install those patches as soon as they are available. However, most vulnerabilities are never actually exploited. Since writing, testing, and installing software patches can involve considerable resources, it would be desirable to prioritize the remediation of vulnerabilities that are likely to be exploited. Several published research studies have reported moderate success in applying machine learning techniques to the task of predicting whether a vulnerability will be exploited. These approaches typically use features derived from vulnerability databases (such as the summary text describing the vulnerability) or social media posts that mention the vulnerability by name. However, these prior studies share multiple methodological shortcomings that inflate predictive power of these approaches. We replicate key portions of the prior work, compare their approaches, and show how selection of training and test data critically affect the estimated performance of predictive models. The results of this study point to important methodological considerations that should be taken into account so that results reflect real-world utility.


page 1

page 2

page 3

page 4


Evaluating the Performance of Twitter-based Exploit Detectors

Patch prioritization is a crucial aspect of information systems security...

OutCenTR: A novel semi-supervised framework for predicting exploits of vulnerabilities in high-dimensional datasets

An ever-growing number of vulnerabilities are reported every day. Yet th...

Cheesecloth: Zero-Knowledge Proofs of Real-World Vulnerabilities

Currently, when a security analyst discovers a vulnerability in critical...

Using Sequence-to-Sequence Learning for Repairing C Vulnerabilities

Software vulnerabilities affect all businesses and research is being don...

Analyzing the Perceived Severity of Cybersecurity Threats Reported on Social Media

Breaking cybersecurity events are shared across a range of websites, inc...

The most frequent programming mistakes that cause software vulnerabilities

All computer programs have flaws, some of which can be exploited to gain...

Please sign up or login with your details

Forgot password? Click here to reset