Vulnerability life cycle exploitation timing modeling
According to the embodiments, a statistical model is developed to estimate the probability of being in a certain stage of a particular vulnerability in its life cycle. The methodology with the application of Markov chain theory gives the basis for calculating estimates for probabilities for different stages of a life cycle of the vulnerability considered. Using the developed method, it is possible to evaluate the risk level of a particular vulnerability at a certain time. These developments allow an advantage in taking measures to avoid exploitations and introduce patches for the vulnerability before an attacker takes the advantage of that particular vulnerability.
1. A method to develop a model for predicting exploitability, comprising:
constructing a vulnerability life cycle graph, the vulnerability life cycle graph including a plurality of state nodes each representative of a state of a vulnerability in a computing system;
determining an initial probability of at least one state node among the plurality of state nodes;
developing an absorbing transition probability matrix based on the vulnerability life cycle graph and the initial probability of the at least one state node;
evaluating a vulnerability life cycle associated with the computing system using the absorbing transition probability matrix to determine a probability of the vulnerability of the computing system being exploited at a particular time; and
developing a non-linear model to determine the probability of the vulnerability being exploited at the particular time.
2. The method according to claim 1 , wherein the evaluating comprises iterating the absorbing transition probability matrix over a number of cycles using a Markovian process until the absorbing transition probability matrix reaches a steady state.
3. The method according to claim 1 , wherein the evaluating comprises iterating the absorbing transition probability matrix over a number of cycles until the absorbing transition probability matrix reaches a steady state, wherein each of the number of cycles is representative of a period of time.
4. The method according to claim 3 , further comprising determining the probability of the vulnerability of the computing system being exploited at the particular time through the iterating.
5. The method according to claim 3 , wherein the plurality of state nodes include at least one absorbing state node and, during the iterating, the initial probability is absorbed into the at least one absorbing state node.
6. The method according to claim 5 , wherein the at least one absorbing state node comprises at least one of a patched state node or an exploited state node.
7. The method according to claim 1 , wherein determining the initial probability of the at least one state node comprises calculating a probability estimate for the at least one state node for at least one category of the Common Vulnerability Scoring System (CVSS) framework.
8. The method according to claim 1 , wherein determining the initial probability of the at least one state node comprises calculating a probability estimate for the at least one state node as a proportion of a cumulative number of vulnerabilities in the computing system over a number of years.
9. The method according to claim 1 , wherein determining the initial probability of the at least one state node comprises identifying a probability estimate for the at least one state node from a reference dataset.
10. The method according to claim 1 , further comprising calculating the probability of the vulnerability being exploited or a probability of the vulnerability being patched based on the non-linear model.
11. The method according to claim 10 , further comprising communicating the particular time, the probability of the vulnerability being exploited, or the probability of the vulnerability being patched to an information technology specialist to take remedial measures.
12. A system to develop a model for predicting exploitability, comprising:
a memory device configured to store computer-readable instructions thereon; and
at least one processing device directed, through execution of the computer-readable instructions, to:
construct a vulnerability life cycle graph, the vulnerability life cycle graph including a plurality of state nodes each representative of a state of a vulnerability in a computing system;
determine an initial probability of at least one state node among the plurality of state nodes;
develop an absorbing transition probability matrix based on the vulnerability life cycle graph and the initial probability of the at least one state node;
evaluate a vulnerability life cycle associated with the computing system using the absorbing transition probability matrix to determine a probability of the vulnerability of the computing system being exploited at a particular time; and
develop a non-linear model to determine the probability of the vulnerability being exploited at the particular time.
13. The system according to claim 12 , wherein the at least one processing device is further configured to iterate the absorbing transition probability matrix over a number of cycles using a Markovian process until the absorbing transition probability matrix reaches a steady state.
14. The system according to claim 12 , wherein the at least one processing device is further configured to iterate the absorbing transition probability matrix over a number of cycles until the absorbing transition probability matrix reaches a steady state, wherein each of the number of cycles is representative of a period of time.
15. The system according to claim 12 , wherein the at least one absorbing state node comprises at least one of a patched state node or an exploited state node.
16. A method to develop a model for predicting exploitability, comprising:
constructing a vulnerability life cycle graph, the vulnerability life cycle graph including a plurality of state nodes each representative of a state of a vulnerability in a computing system;
determining an initial probability of at least one state node among the plurality of state nodes;
developing an absorbing transition probability matrix based on the vulnerability life cycle graph and the initial probability of the at least one state node;
iterating the absorbing transition probability matrix over a number of cycles until the absorbing transition probability matrix reaches a steady state; and
developing a non-linear model to determine a probability of the vulnerability of the computing system being exploited at a particular time.
17. The method according to claim 16 , wherein the iterating provides a probability metric of the vulnerability being exploited as a function of time and a probability metric of the vulnerability being patched as a function of time.
18. The method according to claim 16 , wherein determining the initial probability of the at least one state node comprises calculating a probability estimate for the at least one state node for at least one category of the Common Vulnerability Scoring System (CVSS) framework.