Machine learned model for generating opinionated threat assessments of security vulnerabilities
Disclosed herein are methods, systems, processes, and machine learned models for performing opinionated threat assessments for cybersecurity vulnerabilities. An opinionated threat assessment system is implemented that obtains a training dataset that includes a codified opinionated threat assessment for security vulnerabilities. The codified opinionated threat assessment in the training dataset includes intrinsic attributes for the security vulnerabilities and subject attributes about the security vulnerabilities. The opinionated threat assessment system trains an opinionated threat assessment model using the training dataset and according to a machine learning technique where the training tunes the opinionated threat assessment model to generate a machined learned opinionated threat assessment for a new security vulnerability based on new intrinsic attributes associated with the new security vulnerability.
1. A computer-implemented method, comprising:
performing, by one or more hardware processors with associated memory that implement an opinionated threat assessment system:
obtaining a training dataset comprising a codified opinionated threat assessment for each of one or more security vulnerabilities, wherein
each codified opinionated threat assessment in the training dataset comprises one or more intrinsic attributes and one or more subjective attributes for each of the one or more security vulnerabilities;
training an opinionated threat assessment model using the training dataset and according to a machine learning technique, wherein
the training tunes the opinionated threat assessment model to generate a machine learned opinionated threat assessment for a new security vulnerability based on one or more new intrinsic attributes associated with the new security vulnerability;
receiving, from an intrinsic attribute collection system, a first dataset comprising one or more sterile inputs indicative of the one or more intrinsic attributes;
receiving, from a human curation system, a second dataset comprising one or more user-generated inputs indicative of the one or more subjective attributes; and
generating the codified opinionated threat assessment for the training dataset by combining the first dataset and the second dataset using a common matching key for each of the one or more security vulnerabilities.
2. The computer-implemented method of claim 1 , wherein
the intrinsic attribution collection system is a Common Vulnerability Scoring System (CVSS), and
the one or more intrinsic attributes comprise at least one of attack vector, age, complexity, or user interaction.
3. The computer-implemented method of claim 1 , wherein
the human curation system is an attacker knowledge base (AttackerKB) service, and
the one or more subjective attributes comprise at least an attacker value and an exploitability value for each of the one or more security vulnerabilities.
4. The computer-implemented method of claim 1 , wherein
the machine learning technique trains a regression model.
5. The computer-implemented method of claim 1 , wherein
the opinionated threat assessment model generates a quantified output comprising a new attacker value and a new exploitability value for the new security vulnerability based only on the one or more new intrinsic attributes associated with the new security vulnerability without requiring one or more new subjective attributes for the new security vulnerability.
6. The computer-implemented method of claim 1 , wherein
training the opinionated threat assessment model comprises extrapolating one or more implicit relationships between the one or more intrinsic attributes and one or more user-defined values for each of the one or more security vulnerabilities that comprise at least one user-generated input.
7. A non-transitory computer readable storage medium comprising program instructions executable to:
perform, by one or more hardware processors with associated memory that implement an opinionated threat assessment system:
obtain a training dataset comprising a codified opinionated threat assessment for each of one or more security vulnerabilities, wherein
each codified opinionated threat assessment in the training dataset comprises one or more intrinsic attributes and one or more subjective attributes for each of the one or more security vulnerabilities;
train an opinionated threat assessment model using the training dataset and according to a machine learning technique, wherein
the training tunes the opinionated threat assessment model to generate a machine learned opinionated threat assessment for a new security vulnerability based on one or more new intrinsic attributes associated with the new security vulnerability;
receive, from an intrinsic attribute collection system, a first dataset comprising one or more sterile inputs indicative of the one or more intrinsic attributes;
receive, from a human curation system, a second dataset comprising one or more user-generated inputs indicative of the one or more subjective attributes; and
generate the codified opinionated threat assessment for the training dataset by combining the first dataset and the second dataset using a common matching key for each of the one or more security vulnerabilities.
8. The non-transitory computer readable storage medium of claim 7 , wherein
the intrinsic attribution collection system is a Common Vulnerability Scoring System (CVSS),
the one or more intrinsic attributes comprise at least one of attack vector, age, complexity, or user interaction,
the human curation system is an attacker knowledge base (AttackerKB) service, and
the one or more subjective attributes comprise at least an attacker value and an exploitability value for each of the one or more security vulnerabilities.
9. The non-transitory computer readable storage medium of claim 7 , wherein
the machine learning technique trains a regression model, and
the trained regression model generates a quantified output comprising a new attacker value and a new exploitability value for the new security vulnerability based only on the one or more new intrinsic attributes associated with the new security vulnerability without requiring one or more new subjective attributes for the new security vulnerability.
10. The non-transitory computer readable storage medium of claim 7 , wherein
training the opinionated threat assessment model comprises extrapolating one or more implicit relationships between the one or more intrinsic attributes and one or more user-defined values for each of the one or more security vulnerabilities that comprise at least one user-generated input.
11. An opinionated threat assessment system comprising:
one or more processors; and
a memory coupled to the one or more processors, wherein the memory stores program instructions executable by the one or more processors to:
perform, by one or more processors with associated memory that implement the opinionated threat assessment system:
obtain a training dataset comprising a codified opinionated threat assessment for each of one or more security vulnerabilities, wherein
each codified opinionated threat assessment in the training dataset comprises one or more intrinsic attributes and one or more subjective attributes for each of the one or more security vulnerabilities;
train an opinionated threat assessment model using the training dataset and according to a machine learning technique, wherein
the training tunes the opinionated threat assessment model to generate a machine learned opinionated threat assessment for a new security vulnerability based on one or more new intrinsic attributes associated with the new security vulnerability;
receive, from an intrinsic attribute collection system, a first dataset comprising one or more sterile inputs indicative of the one or more intrinsic attributes;
receive, from a human curation system, a second dataset comprising one or more user-generated inputs indicative of the one or more subjective attributes; and
generate the codified opinionated threat assessment for the training dataset by combining the first dataset and the second dataset using a common matching key for each of the one or more security vulnerabilities.
12. The system of claim 11 , wherein
the intrinsic attribution collection system is a Common Vulnerability Scoring System (CVSS),
the one or more intrinsic attributes comprise at least one of attack vector, age, complexity, or user interaction,
the human curation system is an attacker knowledge base (AttackerKB) service, and
the one or more subjective attributes comprise at least an attacker value and an exploitability value for each of the one or more security vulnerabilities.
13. The system of claim 11 , wherein
the machine learning technique trains a regression model as the opinionated threat assessment model,
the opinionated threat assessment model generates a quantified output comprising a new attacker value and a new exploitability value for the new security vulnerability based only on the one or more new intrinsic attributes associated with the new security vulnerability without requiring one or more new subjective attributes for the new security vulnerability, and
training the opinionated threat assessment model comprises extrapolating one or more implicit relationships between the one or more intrinsic attributes and one or more user-defined values for each of the one or more security vulnerabilities that comprise at least one user-generated input.