Predicting and quantifying weaponization of software weaknesses

1 . A method of future compromise prediction caused by a software weakness and policy specification to mitigate the future compromise, the method comprising:

generating one or more covariates by performing a first preprocessing transformation on modeling data, wherein the one or more covariates include a static covariate, a simulated compromise covariate, and a derived covariate that is produced by applying a statistical operation to the static covariate;

statistically sampling the covariates, wherein the statistical sampling creates a set of covariate data that approaches an actual population of covariate statistics;

splitting the modeling data into training data, testing data, and validation data;

inputting training data into a first prediction program to create one or more preliminary models that predict whether a software weakness will be integrated into an exploit or a malware;

testing prediction accuracy of the one or more preliminary models using the testing data;

selecting one of the preliminary models based on its prediction accuracy;

validating the selected preliminary model by applying a second predictive program to the selected preliminary model along with the validation data;

applying a second preprocessing transformation program to a validated model that is output from the second predictive program along with the simulated compromise covariate and the modeling data to generate an output including indicia of a probability that a software weakness will be used in a future compromise; and

using the output to specify an additional policy to implement when the software weakness is present in a computing environment, wherein the additional policy includes prioritized patching of the software weakness or a firewall fix to block access to a computing resource that contains the software weakness.

2 . The method of claim 1 , wherein the modeling data includes an aggregation of two or more of of software weakness data, exploit data, malware data, and compromise data.

3 . The method of claim 1 , wherein the software weakness includes code that causes:

a local code execution,

a remote code execution,

a denial of service,

an unauthorized reading of data or instructions of a program,

an unauthorized modification of data or instructions of a program,

an unintentional reading of data or instructions of a program, or

an unintentional modification of data or instructions of a program.

4 . The method of claim 1 , wherein the exploit or the malware includes code that uses the software weakness to cause:

code execution,

a denial of service,

an unauthorized read of a program running code with the software weakness,

an unauthorized write of a program running code with the software weakness, or

performance of an operation desired by an entity using the exploit or the malware.

5 . The method of claim 1 , further comprising performing a second statistical sampling function to the output of the second preprocessing transformation program.

6 . The method of claim 1 , wherein the statistical sampling of the covariates includes one or more or a combination of: splitting the modeling data apart, reordering entries of the modeling data, and randomly shuffle the modeling data.

7 . The method of claim 1 , wherein the statistical sampling of the covariates includes one or both of upsampling and downsampling techniques.

8 . The method of claim 1 , wherein the one or more covariates include a time covariate, a frequency covariate, and an organizational covariate that is specific to a particular organization.

9 . A non-transitory computer-readable medium comprising computer software operations for future compromise prediction caused by a software weakness and policy specification to mitigate the future compromise, the operations comprising:

generating one or more covariates by performing a first preprocessing transformation on modeling data, wherein the one or more covariates include a static covariate, a simulated compromise covariate, and a derived covariate that is produced by applying a statistical operation to the static covariate;

statistically sampling the covariates, wherein the statistical sampling creates a set of covariate data that approaches an actual population of covariate statistics;

splitting the modeling data into training data, testing data, and validation data; and

inputting training data into a first prediction program to create one or more preliminary models that predict whether a software weakness will be integrated into an exploit or a malware;

testing prediction accuracy of the one or more preliminary models using the testing data;

selecting one of the preliminary models based on its prediction accuracy;

validating the selected preliminary model by applying a second predictive program to the selected preliminary model along with the validation data;

applying a second preprocessing transformation program to a validated model that is output from the second predictive program along with the simulated compromise covariate and the modeling data to generate an output including indicia of a probability that a software weakness will be used in a future compromise; and

using the output to specify an additional policy to implement when the software weakness is present in a computing environment, wherein the additional policy includes prioritized patching of the software weakness or a firewall fix to block access to a computing resource that contains the software weakness.

10 . The non-transitory computer-readable medium of claim 9 , wherein the operations further comprise performing a second statistical sampling function to the output of the second preprocessing transformation program.

11 . The non-transitory computer-readable medium of claim 9 , wherein the statistical sampling of the covariates includes one or more or a combination of: splitting the modeling data apart, reordering entries of the modeling data, and randomly shuffle the modeling data.

12 . The non-transitory computer-readable medium of claim 9 , wherein the statistical sampling of the covariates includes code for upsampling and downsampling techniques.

13 . The non-transitory computer-readable medium of claim 9 , wherein the one or more covariates include a time covariate, a frequency covariate, and an organizational covariate that is specific to a particular organization.

14 . The non-transitory computer-readable medium of claim 9 , wherein the modeling data includes an aggregation of two or more of: software weakness data, exploit data, malware data, and compromise data.

15 . The non-transitory computer-readable medium of claim 9 , wherein the software weakness includes code that causes:

a local code execution,

a remote code execution,

a denial of service,

an unauthorized reading of data or instructions of a program,

an unauthorized modification of data or instructions of a program,

an unintentional reading of data or instructions of a program, or

an unintentional modification of data or instructions of a program.

16 . The non-transitory computer-readable medium of claim 9 , wherein the exploit or the malware includes code that uses the software weakness to cause:

code execution,

a denial of service,

an unauthorized read of a program running code with the software weakness,

an unauthorized write of a program running code with the software weakness, or

performance of an operation desired by an entity using the exploit or the malware.