EXPLOIT PREDICTION BASED ON MACHINE LEARNING
Generation of one or more models is caused based on selecting training data comprising a plurality of features including a prevalence feature for each vulnerability of a first plurality of vulnerabilities. The one or more models enable predicting whether an exploit will be developed for a vulnerability and/or whether the exploit will be used in an attack. The one or more models are applied to input data comprising the prevalence feature for each vulnerability of a second plurality of vulnerabilities. Based on the application of the one or more models to the input data, output data is received. The output data indicates a prediction of whether an exploit will be developed for each vulnerability of the second plurality. Additionally or alternatively, the output data indicates, for each vulnerability of the second plurality, a prediction of whether an exploit that has yet to be developed will be used in an attack.
1 - 20 . (canceled)
21 . An apparatus, comprising:
one or more processors; and
one or more computer-readable non-transitory storage media coupled to the one or more processors and comprising instructions that, when executed by the one or more processors, cause the apparatus to perform operations comprising:
causing generation of a prediction model based on training data;
causing application of the prediction model to input data corresponding to first software vulnerabilities, wherein each of the first software vulnerabilities is associated with a first prediction that a first exploit will be developed for that particular first software vulnerability; and
receiving, based on the application of the prediction model to the input data, output data that indicates, for each of the first software vulnerabilities, a second prediction that the first exploit will also be used in an attack.
22 . The apparatus of claim 21 , wherein:
the training data corresponds to second software vulnerabilities; and
each of the second software vulnerabilities comprises a second exploit developed for that particular second software vulnerability.
23 . The apparatus of claim 22 , wherein each of the second software vulnerabilities indicates whether the second exploit was developed within a particular time period.
24 . The apparatus of claim 22 , wherein each of the second software vulnerabilities indicates whether the second exploit was used in a successful attack.
25 . The apparatus of claim 24 , wherein each of the second software vulnerabilities indicates whether the second exploit was used in the successful attack within a particular time period.
26 . The apparatus of claim 21 , wherein the second prediction is used to adjust a risk score of one or more of the first software vulnerabilities.
27 . The apparatus of claim 21 , the operations further comprising generating the prediction model using machine learning.
28 . A method, comprising:
causing generation of a prediction model based on training data;
causing application of the prediction model to input data corresponding to first software vulnerabilities, wherein each of the first software vulnerabilities is associated with a first prediction that a first exploit will be developed for that particular first software vulnerability; and
receiving, based on the application of the prediction model to the input data, output data that indicates, for each of the first software vulnerabilities, a second prediction that the first exploit will also be used in an attack.
29 . The method of claim 28 , wherein:
the training data corresponds to second software vulnerabilities; and
each of the second software vulnerabilities comprises a second exploit developed for that particular second software vulnerability.
30 . The method of claim 29 , wherein each of the second software vulnerabilities indicates whether the second exploit was developed within a particular time period.
31 . The method of claim 29 , wherein each of the second software vulnerabilities indicates whether the second exploit was used in a successful attack.
32 . The method of claim 31 , wherein each of the second software vulnerabilities indicates whether the second exploit was used in the successful attack within a particular time period.
33 . The method of claim 28 , wherein the second prediction is used to adjust a risk score of one or more of the first software vulnerabilities.
34 . The method of claim 21 , further comprising generating the prediction model using machine learning.
35 . One or more computer-readable non-transitory storage media embodying instructions that, when executed by a processor, cause the processor to perform operations comprising:
causing generation of a prediction model based on training data;
causing application of the prediction model to input data corresponding to first software vulnerabilities, wherein each of the first software vulnerabilities is associated with a first prediction that a first exploit will be developed for that particular first software vulnerability; and
receiving, based on the application of the prediction model to the input data, output data that indicates, for each of the first software vulnerabilities, a second prediction that the first exploit will also be used in an attack.
36 . The one or more computer-readable non-transitory storage media of claim 35 , wherein:
the training data corresponds to second software vulnerabilities; and
each of the second software vulnerabilities comprises a second exploit developed for that particular second software vulnerability.
37 . The one or more computer-readable non-transitory storage media of claim 36 , wherein each of the second software vulnerabilities indicates whether the second exploit was developed within a particular time period.
38 . The one or more computer-readable non-transitory storage media of claim 36 , wherein each of the second software vulnerabilities indicates whether the second exploit was used in a successful attack.
39 . The one or more computer-readable non-transitory storage media of claim 38 , wherein each of the second software vulnerabilities indicates whether the second exploit was used in the successful attack within a particular time period.
40 . The one or more computer-readable non-transitory storage media of claim 35 , wherein the second prediction is used to adjust a risk score of one or more of the first software vulnerabilities.