Predicting and quantifying weaponization of software weaknesses
A method and/or computer software for estimating the probability that a software weakness will be used in an exploit and/or malware and the probability that the developed exploit and/or malware will result in a compromise.
1. A method for providing a likelihood that a software weakness will be used in a future compromise, the method comprising:
generating one or more covariates by performing a first preprocessing transformation on modeling data;
inputting training group data into a first prediction program to create a model that predicts whether a software weakness will be integrated into one or both of an exploit and malware;
applying a second preprocessing transformation program to the output of the first prediction program, the modeling data, and a simulated compromise covariate;
performing a second statistical sampling function to an output of the second preprocessing transformation program; and
applying a second predictive program to an output of the second statistical sampling function to, wherein an output of the second predictive program provides indicia of a probability that a software weakness will be used in a future compromise.
2. The method of claim 1 , wherein:
the modeling data comprises an aggregation of two or more items of data selected from software weakness data, exploit data, malware data, and compromise data;
the software weakness comprises code that causes local code execution, remote code execution, denial of service, unauthorized reading of data; unintentional reading of data; or unauthorized modification of data; and
the exploit or the malware comprises code that uses the software weakness and that causes one or more or a combination of denial of service, unauthorized read of a program running code with the software weakness, unauthorized write of a program running code with the software weakness, and performance of an operation desired by an entity using the exploit or the malware.
3. The method of claim 1 , further comprising splitting the modeling data into at least three groups of data, wherein the at least three groups of data comprise the training group data, a testing group data, and a validation group data.
4. The method of claim 3 , further comprising:
inputting the training group data into the first prediction program to create one or more preliminary models that are able to predict whether a software weakness is integrated in the exploit or the malware;
testing prediction accuracy metrics of the preliminary models using the testing group data, the prediction accuracy metrics including false positive, true negative, false negative, and true positive rates; and
selecting one of the preliminary models as the model based on prediction accuracy metrics.
5. The method of claim 4 , further comprising repeating the testing a predetermined number of times, wherein the predetermined number of times is based on a classification accuracy of the preliminary models, a running time of the preliminary models, or a scalability of the preliminary models.
6. The method of claim 1 , further comprising performing a first statistical sampling function on the one or more covariates.
7. The method of claim 6 , wherein the first statistical sampling function includes one or more or a combination of:
splitting the modeling data apart,
reordering entries of the modeling data, and
randomly shuffle the modeling data.
8. The method of claim 6 , wherein the first statistical sampling function performs one or both of an upsampling technique and a downsampling technique.
9. A non-transitory computer-readable medium comprising computer software for providing a likelihood that a software weakness will be used in a future compromise comprising:
code for generating one or more covariates by performing a first preprocessing transformation on modeling data;
code for inputting training group data into a first prediction program to create a model that predicts whether a software weakness will be integrated into one or both of an exploit and malware;
code for applying a second preprocessing transformation program to the output of the first prediction program, the modeling data, and a simulated compromise covariate;
code for performing a second statistical sampling function to an output of the second preprocessing transformation program; and
code for applying a second predictive program to an output of the second statistical sampling function, wherein an output of the second predictive program provides indicia of a probability that a software weakness will be used in a future compromise.
10. The method of claim 1 , wherein the simulated compromise covariate includes a number of a particular hardware or a software platform running on an organization's computing resource that were successfully abused by a cyber weapon.
11. The method of claim 1 , wherein:
the output of the second predictive program is used with risk and prioritization metrics to specify a policy having an action to be taken when a specific software weakness is present in a computing environment of an organization; and
the action includes a prioritize patching of the software weakness or prioritizing a firewall fix to block access to specific computing resources.
12. The non-transitory computer-readable medium of claim 9 , further comprising code for splitting the modeling data into at least three groups of data, wherein the at least three groups of data comprise the training group data, a testing group data, and a validation group data.
13. The non-transitory computer-readable medium of claim 12 , further comprising:
code for inputting the training group data into the first prediction program to create one or more preliminary models that are able to predict whether a software weakness is integrated in the exploit or the malware;
code for testing prediction accuracy metrics of the preliminary models using the testing group data, the prediction accuracy metrics including false positive, true negative, false negative, and true positive rates; and
code for selecting one of the preliminary models as the model based on prediction accuracy metrics.
14. The non-transitory computer-readable medium of claim 13 , further comprising code for repeating the testing a predetermined number of times, wherein the predetermined number of times is based on a classification accuracy of the preliminary models, a running time of the preliminary models, or a scalability of the preliminary models.
15. The non-transitory computer-readable medium of claim 9 , further comprising code for performing a first statistical sampling function on the one or more covariates.
16. The non-transitory computer-readable medium of claim 15 , wherein the code for the first statistical sampling function comprises code that is configured to perform one or more or a combination of:
splitting the modeling data apart,
reordering entries of the modeling data, and
randomly shuffle the modeling data.
17. The non-transitory computer-readable medium of claim 15 , wherein the code for the first statistical sampling function comprises code for performing one or both of an upsampling technique and a downsampling technique.
18. The non-transitory computer-readable medium of claim 9 , wherein the simulated compromise covariate includes a number of a particular hardware or a software platform running on an organization's computing resource that were successfully abused by a cyber weapon.
19. The non-transitory computer-readable medium of claim 9 , wherein:
the output of the second predictive program is used with risk and prioritization metrics to specify a policy having an action to be taken when a specific software weakness is present in a computing environment of an organization; and
the action includes a prioritize patching of the software weakness or prioritizing a firewall fix to block access to specific computing resources.