Risk Prioritization by Leveraging Latent Vulnerability Features in a Contested Environment
Kenneth Alperin, Allan Wollaber, Dennis M. Ross, Pierre C. Trepagnier, Leslie Leonard · 2019
Cyber network defenders face an overwhelming volume of software vulnerabilities. Resource limitations preclude them mitigating all but a small number of vulnerabilities on an enterprise network, so proper prioritization of defensive actions are of paramount importance. Current methods of risk prioritization are predominantly expert-based, and many include leveraging Common Vulnerability Scoring System (CVSS) risk scores. These scores are assigned by subject matter experts according to conventional methods of qualifying risk. Vulnerability mitigation strategies are then often applied in CVSS score order. Our vulnerability assessment system, in contrast, takes a predominantly data-driven approach. In general, we associate a risk metric of vulnerabilities with existence of corresponding exploits. Our assumption is that if an entity has invested time and money to exploit a particular vulnerability, this is a critical gauge of that vulnerability's importance, and hence risk.