Exploitability prediction of software vulnerabilities

Abstract

The number of security failure discovered and disclosed publicly are increasing at a pace like never before. Wherein, a small fraction of vulnerabilities encountered in the operational phase are exploited in the wild. It is difficult to find vulnerabilities during the early stages of software development cycle, as security aspects are often not known adequately. To counter these security implications, firms usually provide patches such that these security flaws are not exploited. It is a daunting task for a security manager to prioritize patches for vulnerabilities that are likely to be exploitable. This paper fills this gap by applying different machine learning techniques to classify the vulnerabilities based on previous exploit‐history. Our work indicates that various vulnerability characteristics such as severity, type of vulnerabilities, different software configurations, and vulnerability scoring parameters are important features to be considered in judging an exploit. Using such methods, it is possible to predict exploit‐prone vulnerabilities with an accuracy >85%. Finally, with this experiment, we conclude that supervised machine learning approach can be a useful technique in predicting exploit‐prone vulnerabilities.

A Survey on Data-driven Software Vulnerability Assessment and Prioritization

“…Specifically, these authors pre-trained a DL model, BERT [42], on massive non-SV sources (e.g., text on Book Corpus [211] and Wikipedia [60]) and then fine-tuned this pre-trained model on SV data using additional pooling and dense layers. Bhatt et al [14] also suggested that incorporating the types of SVs (e.g., SQL injection) into ML models can further enhance the predictive effectiveness. Suciu [176] empirically showed that unifying SV-related sources used in prior work (e.g., SV databases [20], social media [159], SV-related discussions [179] and PoC code in ExploitDB [84]) supports more effective and timely prediction of functional exploits [58].…”

“…However, the LDA topics/keywords did not agree well (< 40%) with the OWASP descriptions, probably because 10 topics did not cover all the underlying patterns of SV descriptions. Aljedaani et al [3] again used LDA to identify 10 types of SVs reported in the bug tracking system of Chromium 14 and found memory-related issues were the most prevalent topics.…”

“…18 The latter case would require techniques in the CWE sub-theme (see section 6.1). 14 https://bugs.chromium.org/p/chromium/issues/list 15 1. Buffer errors, 2.…”

“…The metadata about SVs can also complement the missing information in descriptions or code for SV assessment and prioritization. For example, prediction of exploits and their characteristics have been enhanced using CVSS metrics [5], CPE [2] and SV types [14] on NVD. Additionally, Twitter-related statistics (e.g., number of followers, likes and retweets) have been shown to increase the performance of predicting SV exploitation, impact and severity [30,159].…”

Time Lag-Based Modelling for Software Vulnerability Exploitation Process

“…Later, Sabottke et al [17] developed an exploit prediction model using a dataset acquired from Twitter having links to CVE-IDs and from Symantec threat signatures for the positive labels. Of late, Almukaynizi et al [18] deduced a model that considers data from various sources to predict the likelihood of exploitation, and Bhatt et al [19] developed an exploit prediction framework and claimed it a highly effective approach for the exploit that could be seen in the wild.…”