Exploit prediction based on machine learning
Generation of one or more models is caused based on selecting training data comprising a plurality of features including a prevalence feature for each vulnerability of a first plurality of vulnerabilities. The one or more models enable predicting whether an exploit will be developed for a vulnerability and/or whether the exploit will be used in an attack. The one or more models are applied to input data comprising the prevalence feature for each vulnerability of a second plurality of vulnerabilities. Based on the application of the one or more models to the input data, output data is received. The output data indicates a prediction of whether an exploit will be developed for each vulnerability of the second plurality. Additionally or alternatively, the output data indicates, for each vulnerability of the second plurality, a prediction of whether an exploit that has yet to be developed will be used in an attack.
1. A device, comprising:
one or more processors; and
one or more computer-readable non-transitory storage media coupled to the one or more processors and comprising instructions that, when executed by the one or more processors, cause the device to perform operations comprising:
receiving input data comprising one or more features for each software vulnerability of a plurality of software vulnerabilities;
causing application of a prediction model to the input data; and
generating, based on the application of the prediction model to the input data, output data, wherein:
the output data indicates a prediction of whether an exploit will be developed for each software vulnerability of the plurality of software vulnerabilities; and
the one or more features indicate a number of copies of software affected by each software vulnerability of the plurality of software vulnerabilities.
2. The device of claim 1 , the operations further comprising generating the prediction model using machine learning.
3. The device of claim 1 , wherein the prediction is used to adjust a risk score of one or more of the plurality of software vulnerabilities.
4. The device of claim 1 , wherein the prediction of whether the exploit will be developed for each software vulnerability of the plurality of software vulnerabilities comprises a prediction of whether the exploit will be developed for each software vulnerability of the plurality of software vulnerabilities within a particular number of days.
5. The device of claim 1 , wherein the output data indicates, for each software vulnerability of the plurality of software vulnerabilities, a prediction of a number of days that will elapse between publication of each software vulnerability and development of the exploit for each software vulnerability.
6. The device of claim 1 , wherein the output data indicates, for each software vulnerability of the plurality of software vulnerabilities, a probability that the exploit will be developed for each software vulnerability of the plurality of software vulnerabilities and used in an attack.
7. A method, comprising:
receiving input data comprising one or more features for each software vulnerability of a plurality of software vulnerabilities;
causing application of a prediction model to the input data; and
generating, based on the application of the prediction model to the input data, output data, wherein:
the output data indicates a prediction of whether an exploit will be developed for each software vulnerability of the plurality of software vulnerabilities, and
the one or more features indicate a number of copies of software affected by each software vulnerability of the plurality of software vulnerabilities.
8. The method of claim 7 , further comprising generating the prediction model using machine learning.
9. The method of claim 7 , wherein the prediction is used to adjust a risk score of one or more of the plurality of software vulnerabilities.
10. The method of claim 7 , wherein the prediction of whether the exploit will be developed for each software vulnerability of the plurality of software vulnerabilities comprises a prediction of whether the exploit will be developed for each software vulnerability of the plurality of software vulnerabilities within a particular number of days.
11. The method of claim 7 , wherein the output data indicates, for each software vulnerability of the plurality of software vulnerabilities, a prediction of a number of days that will elapse between publication of each software vulnerability and development of the exploit for each software vulnerability.
12. The method of claim 7 , wherein the output data indicates, for each software vulnerability of the plurality of software vulnerabilities, a probability that the exploit will be developed for each software vulnerability of the plurality of software vulnerabilities and used in an attack.
13. One or more computer-readable non-transitory storage media embodying instructions that, when executed by a processor, cause the processor to perform operations comprising:
receiving input data comprising one or more features for each software vulnerability of a plurality of software vulnerabilities;
causing application of a prediction model to the input data; and
generating, based on the application of the prediction model to the input data, output data, wherein:
the output data indicates a prediction of whether an exploit will be developed for each software vulnerability of the plurality of software vulnerabilities; and
the one or more features indicate a number of copies of software affected by each software vulnerability of the plurality of software vulnerabilities.
14. The one or more computer-readable non-transitory storage media of claim 13 , the operations further comprising generating the prediction model using machine learning.
15. The one or more computer-readable non-transitory storage media of claim 13 , wherein the prediction is used to adjust a risk score of one or more of the plurality of software vulnerabilities.
16. The one or more computer-readable non-transitory storage media of claim 13 , wherein the prediction of whether the exploit will be developed for each software vulnerability of the plurality of software vulnerabilities comprises a prediction of whether the exploit will be developed for each software vulnerability of the plurality of software vulnerabilities within a particular number of days.
17. The one or more computer-readable non-transitory storage media of claim 13 , wherein the output data indicates, for each software vulnerability of the plurality of software vulnerabilities, a prediction of a number of days that will elapse between publication of each software vulnerability and development of the exploit for each software vulnerability.
18. The one or more computer-readable non-transitory storage media of claim 13 , wherein the output data indicates, for each software vulnerability of the plurality of software vulnerabilities, a probability that the exploit will be developed for each software vulnerability of the plurality of software vulnerabilities and used in an attack.