Predicting Exploitation of Disclosed Software Vulnerabilities Using Open-source Data

摘要: Each year, thousands of software vulnerabilities are discovered and reported to the public. Unpatched known a significant security risk. It is imperative that vendors quickly provide patches once users install those as soon they available. However, most never actually exploited. Since writing, testing, installing can involve considerable resources, it would be desirable prioritize remediation likely Several published research studies have moderate success in applying machine learning techniques task predicting whether vulnerability will These approaches typically use features derived from databases (such summary text describing vulnerability) or social media posts mention by name. these prior share multiple methodological shortcomings inflate predictive power approaches. We replicate key portions work, compare their approaches, show how selection training test data critically affect estimated performance models. The results this study point important considerations should taken into account so reflect real-world utility.