Vulnerability Forecasting: In theory and practice

12/07/2020
by   Éireann Leverett, et al.
0

Why wait for zero-days when you could predict them in advance? It is possible to predict the volume of CVEs released in the NVD as much as a year in advance. This can be done within 3 percent of the actual value, and different predictive algorithms perform well at different lookahead values. It is also possible to estimate the proportions of that total volumn belonging to specific vendors, software, CVSS scores, or vulnerability types. Strategic patch management should become much easier, with this uncertainty reduction.

READ FULL TEXT

Please sign up or login with your details

Forgot password? Click here to reset