A Software Vulnerability Rating Approach Based on the Vulnerability Database

CVSS is a specification for measuring the relative severity of software vulnerabilities. The performance values of the CVSS given by CVSS-SIG cannot describe the reasons for the software vulnerabilities. This approach fails to distinguish between software vulnerabilities that have the same score but different levels of severity. In this paper, a software vulnerability rating approach (SVRA) is proposed. The vulnerability database is used by SVRA to analyze the frequencies of CVSS’s metrics at different times. Then, the equations for both exploitability and impact subscores are given in terms of these frequencies. SVRA performs a weighted average of these two subscores to create an SVRA score. The score of a vulnerability is dynamically calculated at different times using the vulnerability database. Experiments were performed to validate the efficiency of the SVRA.

• Publication year

  2014

• Venue

  Journal of Applied Mathematics

• Publication date

  2014-05-29

• Fields of study

  Computer Science

• Identifiers
  DOI 10.1155/2014/932397
• External record

  Open on Semantic Scholar

• Source metadata

  Semantic Scholar

• No claims are published for this paper.

• No concepts are published for this paper.

• Анализ уязвимостей вычислительных систем на основе алгебраических структур и потоков данных National Vulnerability Database

  2013influential reference
• Dynamic Security Risk Management Using Bayesian Attack Graphs

  2012cited by this paper
• Beyond heuristics: learning to classify vulnerabilities and predict exploits

  2010cited by this paper
• An analysis of CVSS version 2 vulnerability scoring

  2009cited by this paper
• The Common Vulnerability Scoring System (CVSS)

  2007cited by this paper
• The Common Vulnerability Scoring System (CVSS) and its Applicability to Federal Agency Systems

  2007cited by this paper
• Common Vulnerability Scoring System

  2006cited by this paper

• A Survey on Software Vulnerability Exploitability Assessment

  2024influential citation
• VulDistilBERT: A CPS Vulnerability Severity Prediction Method Based on Distillation Model

  2023cites this paper
• Reusability or disposability? A network analysis of reusable Reusability or disposability? A network analysis of reusable software vulnerabilities software vulnerabilities

  2021cites this paper
• AutoCVSS: An Approach for Automatic Assessment of Vulnerability Severity Based on Attack Process

  2019cites this paper
• Vulnerability Analysis of Smart Phone and Tablet Operating Systems

  2018cites this paper
• Categorizing and Predicting Invalid Vulnerabilities on Common Vulnerabilities and Exposures

  2018cites this paper
• La Ciberseguridad: análisis político y estratégico

  2018cites this paper
• Learning to Predict Severity of Software Vulnerability Using Only Vulnerability Description

  2017cites this paper
• A dynamic cost-centric risk impact metrics development

  2015cites this paper
• A Methodology to Develop Dynamic Cost-Centric Risk Impact Metrics

  2015cites this paper