Abstract:Proactive security plays a vital role in preventing the attack before entering active mode. In the modern information environment, it depends on the vulnerability management practitioners of an organization in which the critical factor is the prioritization of threats. The existing models and methodology follow the traditional approaches of a Common Vulnerability Scoring System (CVSS) to prioritize threats and vulnerabilities. The CVSS is not able to provide effectiveness to the security of the business of an organization. In contrast, the vulnerability analysis needs a model which can give significance to the prioritization policies. The model depends on the CVSS score of threats and compares various features of vulnerability like threat vectors, inputs, environments used by threat agent's groups, and potential outputs of threat agents. Therefore, the research aims to design a semi-automatic model for vulnerability analysis of threats for the National Institute of Standards and Technology (NIST) database of cyber-crime. We have developed a semi-automatic model that simulates the CVE (Common Vulnerabilities and Exposures) list of the NIST database between 1999 and 2021, concerning the resources used by the threat agents, pre-requisites input, attack vectors, and dormant results. The semi-automatic approach of the model to perform the vulnerability analysis of threat agent groups identified in a network makes the model more efficient and effective to addresses the profiling of threat agents and evaluating the CTI (Critical Threat intelligence feed). Our experimental results imply that the semi-automatic model implements the vulnerability prioritization based on the CVSS score and uses the comparative analysis based on the threat agent's vectors identified. It also provides potency and optimized complexity to an organization's business to mitigate the vulnerability identified in a network.

Development of a System Vulnerability Analysis Tool for Assessment of Complex Mission Critical Systems

Technical Upgrades to and Enhancements of a System Vulnerability Analysis Tool Based on the Blackboard Architecture

Enhancing Security Testing Software for Systems that Cannot be Subjected to the Risks of Penetration Testing Through the Incorporation of Multi-threading and and Other Capabilities

Towards More Practical Automation of Vulnerability Assessment

Vulnerability Detection For Smart Grid Devices Via Static Analysis

Vulnerability Assessment of Electrical Cyber-Physical Systems Against Cyber Attacks

An OVAL-based Active Vulnerability Assessment System for Enterprise Computer Networks.

Data Driven Vulnerability Exploration for Design Phase System Analysis

Evaluating C/C++ Vulnerability Detectability of Query-Based Static Application Security Testing Tools

Analysis and implementation of semi-automatic model for vulnerability exploitations of threat agents in NIST databases

Dynamic Vulnerability Criticality Calculator for Industrial Control Systems

AutoCVSS: An Approach for Automatic Assessment of Vulnerability Severity Based on Attack Process

Dynamic vulnerability severity calculator for industrial control systems

ANDVI: Automated Network Device and Vulnerability Identification in SCADA/ICS by Passive Monitoring

LLM-based Attack Scenarios Generator with IT Asset Management and Vulnerability Information

Arm up Administrators: Automated Vulnerability Management

Development and Analysis of P2SCP: A Paradigm for Penetration Testing of Systems that Cannot be Subjected to the Risk of Penetration Testing

A Novel Vulnerability Assessment System Based on OVAL

Cross-level Monte Carlo Framework for System Vulnerability Evaluation Against Fault Attack

Software Vulnerability Analysis Using CPE and CVE

Novel Active Vulnerability Detection System