Name
Abstract | ||
|---|---|---|
The Common Vulnerability Scoring System (CVSS) is a widely used and well-established standard for classifying the severity of security vulnerabilities. For instance, all vulnerabilities in the US National Vulnerability Database (NVD) are scored according to this method. As computer systems typically have multiple vulnerabilities, it is often desirable to aggregate the score of individual vulnerabilities to a system level. Several such metrics have been proposed, but their quality has not been studied. This paper presents a statistical analysis of how 18 security estimation metrics based on CVSS data correlate with the time-to-compromise of 34 successful attacks. The empirical data originates from an international cyber defense exercise involving over 100 participants and were collected by studying network traffic logs, attacker logs, observer logs, and network vulnerabilities. The results suggest that security modeling with CVSS data alone does not accurately portray the time-to-compromise of a system. However, results also show that metrics employing more CVSS data are more correlated with time-to-compromise. As a consequence, models that only use the weakest link (most severe vulnerability) to compose a metric are less promising than those that consider all vulnerabilities. |
Year | DOI | Venue |
|---|---|---|
2012 | 10.1109/TDSC.2012.66 | IEEE Trans. Dependable Sec. Comput. |
Keywords | Field | DocType |
common vulnerability scoring system,security estimation metrics,network vulnerability,actual attacks,us national vulnerability database,security modeling,empirical data,empirical analysis,computer system,network traffic log,system-level vulnerability metrics,cvss data,security vulnerability,computer and information science,natural sciences,network management,authorization,mathematical model,statistical analysis,computational modeling,risk management,network security | Data mining,CVSS,National Vulnerability Database,Computer security,Computer science,Network security,Risk management,Vulnerability management,Network management,Vulnerability,Information and Computer Science | Journal |
Volume | Issue | ISSN |
9 | 6 | 1545-5971 |
Citations | PageRank | References |
20 | 0.94 | 14 |
Authors | ||
3 | ||
Name | Order | Citations | PageRank |
|---|---|---|---|
| Hannes Holm | 1 | 191 | 14.59 |
| Mathias Ekstedt | 2 | 634 | 49.70 |
| Dennis Andersson | 3 | 38 | 4.44 |