Predicting the Discovery Pattern of Publically Known Exploited Vulnerabilities

Vulnerabilities with publically known exploits typically form 2–7 percent of all vulnerabilities reported for a given software version. With a smaller number of known exploited vulnerabilities compared with the total number of vulnerabilities, it is more difficult to model and predict when a vulnerability with a known exploit will be reported. In this article, we introduce an approach for predicting the discovery pattern of publically known exploited vulnerabilities using all publically known vulnerabilities reported for a given software. Eight commonly used vulnerability discovery models (VDMs) and one neural network model (NNM) were utilized to evaluate the prediction capability of our approach. We compared their predictions results with the scenario when only exploited vulnerabilities were used for prediction. Our results show that, in terms of prediction accuracy, out of eight software we analyzed, our approach led to more accurate results in seven cases. Only in one case, the accuracy of our approach was worse by 1.6 percent.

1 Introduction

Researchers have used data from various vulnerability databases to study trends of discovery of new vulnerabilities, used various models for fitting the vulnerability discovery process, and predicting the number of new vulnerabilities that may be discovered for a given product [1]–[6]. Estimating the number of new vulnerabilities over time is useful both for vendors of these products as well as the end-users as it can help them with resource allocation.