Predicting and quantifying weaponization of software weaknesses
A method and/or computer software for estimating the probability that a software weakness will be used in an exploit and/or malware and the probability that the developed exploit and/or malware will result in a compromise.
1 . A method of future compromise prediction caused by a software weakness and policy specification to mitigate the future compromise, the method comprising:
generating one or more covariates by performing a first preprocessing transformation on modeling data, wherein the one or more covariates include a static covariate, a simulated compromise covariate, and a derived covariate that is produced by applying a statistical operation to the static covariate;
statistically sampling the covariates, wherein the statistical sampling creates a set of covariate data that approaches an actual population of covariate statistics;
splitting the modeling data into training data, testing data, and validation data;
inputting training data into a first prediction program to create one or more preliminary models that predict whether a software weakness will be integrated into an exploit or a malware;
testing prediction accuracy of the one or more preliminary models using the testing data;
selecting one of the preliminary models based on its prediction accuracy;
validating the selected preliminary model by applying a second predictive program to the selected preliminary model along with the validation data;
applying a second preprocessing transformation program to a validated model that is output from the second predictive program along with the simulated compromise covariate and the modeling data to generate an output including indicia of a probability that a software weakness will be used in a future compromise; and
using the output to specify an additional policy to implement when the software weakness is present in a computing environment, wherein the additional policy includes prioritized patching of the software weakness or a firewall fix to block access to a computing resource that contains the software weakness.
2 . The method of claim 1 , wherein the modeling data includes an aggregation of two or more of of software weakness data, exploit data, malware data, and compromise data.
3 . The method of claim 1 , wherein the software weakness includes code that causes:
a local code execution,
a remote code execution,
a denial of service,
an unauthorized reading of data or instructions of a program,
an unauthorized modification of data or instructions of a program,
an unintentional reading of data or instructions of a program, or
an unintentional modification of data or instructions of a program.
4 . The method of claim 1 , wherein the exploit or the malware includes code that uses the software weakness to cause:
code execution,
a denial of service,
an unauthorized read of a program running code with the software weakness,
an unauthorized write of a program running code with the software weakness, or
performance of an operation desired by an entity using the exploit or the malware.
5 . The method of claim 1 , further comprising performing a second statistical sampling function to the output of the second preprocessing transformation program.
6 . The method of claim 1 , wherein the statistical sampling of the covariates includes one or more or a combination of: splitting the modeling data apart, reordering entries of the modeling data, and randomly shuffle the modeling data.
7 . The method of claim 1 , wherein the statistical sampling of the covariates includes one or both of upsampling and downsampling techniques.
8 . The method of claim 1 , wherein the one or more covariates include a time covariate, a frequency covariate, and an organizational covariate that is specific to a particular organization.
9 . A non-transitory computer-readable medium comprising computer software operations for future compromise prediction caused by a software weakness and policy specification to mitigate the future compromise, the operations comprising:
generating one or more covariates by performing a first preprocessing transformation on modeling data, wherein the one or more covariates include a static covariate, a simulated compromise covariate, and a derived covariate that is produced by applying a statistical operation to the static covariate;
statistically sampling the covariates, wherein the statistical sampling creates a set of covariate data that approaches an actual population of covariate statistics;
splitting the modeling data into training data, testing data, and validation data; and
inputting training data into a first prediction program to create one or more preliminary models that predict whether a software weakness will be integrated into an exploit or a malware;
testing prediction accuracy of the one or more preliminary models using the testing data;
selecting one of the preliminary models based on its prediction accuracy;
validating the selected preliminary model by applying a second predictive program to the selected preliminary model along with the validation data;
applying a second preprocessing transformation program to a validated model that is output from the second predictive program along with the simulated compromise covariate and the modeling data to generate an output including indicia of a probability that a software weakness will be used in a future compromise; and
using the output to specify an additional policy to implement when the software weakness is present in a computing environment, wherein the additional policy includes prioritized patching of the software weakness or a firewall fix to block access to a computing resource that contains the software weakness.
10 . The non-transitory computer-readable medium of claim 9 , wherein the operations further comprise performing a second statistical sampling function to the output of the second preprocessing transformation program.
11 . The non-transitory computer-readable medium of claim 9 , wherein the statistical sampling of the covariates includes one or more or a combination of: splitting the modeling data apart, reordering entries of the modeling data, and randomly shuffle the modeling data.
12 . The non-transitory computer-readable medium of claim 9 , wherein the statistical sampling of the covariates includes code for upsampling and downsampling techniques.
13 . The non-transitory computer-readable medium of claim 9 , wherein the one or more covariates include a time covariate, a frequency covariate, and an organizational covariate that is specific to a particular organization.
14 . The non-transitory computer-readable medium of claim 9 , wherein the modeling data includes an aggregation of two or more of: software weakness data, exploit data, malware data, and compromise data.
15 . The non-transitory computer-readable medium of claim 9 , wherein the software weakness includes code that causes:
a local code execution,
a remote code execution,
a denial of service,
an unauthorized reading of data or instructions of a program,
an unauthorized modification of data or instructions of a program,
an unintentional reading of data or instructions of a program, or
an unintentional modification of data or instructions of a program.
16 . The non-transitory computer-readable medium of claim 9 , wherein the exploit or the malware includes code that uses the software weakness to cause:
code execution,
a denial of service,
an unauthorized read of a program running code with the software weakness,
an unauthorized write of a program running code with the software weakness, or
performance of an operation desired by an entity using the exploit or the malware.