Binary vulnerability determination

1. A computer-implemented method of determining a severity score, comprising:

receiving, at a server, a binary;

determining, by the server, a plurality of vulnerability parameters of the binary, wherein the determining comprises:

disassembling or decompiling, by the server, the binary to generate a source code corresponding to the binary;

identifying, by the server, one or more function calls in the source code;

determining, by the server, the plurality of vulnerability parameters based on the one or more function calls; and

determining, by the server, the severity score based on the plurality of vulnerability parameters; and

generating, by the server, a report based on the plurality of vulnerability parameters.

2. The method of claim 1 , wherein the severity score is a common vulnerability scoring system (CVSS) severity score.

3. The method of claim 1 , further comprising: merging a public common vulnerability and exposures (CVE) dataset with a private CVE dataset; and based on the plurality of vulnerability parameters, using the merged public and private CVE datasets to determine a common vulnerability scoring system (CVSS) severity score.

4. The method of claim 1 , wherein the vulnerability parameters include an attack vector (AV), an attack complexity (AC), a privileges required (PR), a user interaction (UI), a scope (S), a confidentiality (C), an integrity (I), and an availability (A).

5. The method of claim 1 , wherein the vulnerability parameters include an exploit code maturity (E), a remediation level (RL), and a report confidence (RC).

6. The method of claim 1 , wherein the vulnerability parameters include a confidentiality requirement (CR), an integrity requirement (IR), an availability requirement (AR), a modified attack vector (MAV), a modified attack complexity (MAC), a modified privileges required (MPR), a modified user interaction (MUI), a modified scope (MS), a modified confidentiality (MC), a modified integrity (MI), and a modified availability (MA).

7. A server, comprising:

at least one hardware processor; and

one or more memories coupled to the at least one hardware processor and storing programming instructions for execution by the at least one hardware processor to cause the server to:

receive a binary;

determine a plurality of vulnerability parameters of the binary, wherein the programming instructions, when executed by the at least one hardware processor, cause the server to:

disassemble or decompile the binary to generate a source code corresponding to the binary;

identify one or more function calls in the source code;

determine the plurality of vulnerability parameters based on the one or more function calls; and

determine a severity score based on the plurality of vulnerability parameters; and

generate a report based on the plurality of vulnerability parameters.

8. The server of claim 7 , wherein the severity score is a common vulnerability scoring system (CVSS) severity score.

9. The server of claim 7 , wherein the programming instructions, when executed by the at least one hardware processor, cause the server to: merge a public common vulnerability and exposures (CVE) dataset with a private CVE dataset; and based on the plurality of vulnerability parameters, use the merged public and private CVE datasets to determine a common vulnerability scoring system (CVSS) severity score.

10. The server of claim 7 , wherein the vulnerability parameters include an attack vector (AV), an attack complexity (AC), a privileges required (PR), a user interaction (UI), a scope (S), a confidentiality (C), an integrity (I), and an availability (A).

11. The server of claim 7 , wherein the vulnerability parameters include an exploit code maturity (E), a remediation level (RL), and a report confidence (RC).

12. The server of claim 7 , wherein the vulnerability parameters include a confidentiality requirement (CR), an integrity requirement (IR), an availability requirement (AR), a modified attack vector (MAV), a modified attack complexity (MAC), a modified privileges required (MPR), a modified user interaction (MUI), a modified scope (MS), a modified confidentiality (MC), a modified integrity (MI), and a modified availability (MA).