Abstract:Proactive security plays a vital role in preventing the attack before entering active mode. In the modern information environment, it depends on the vulnerability management practitioners of an organization in which the critical factor is the prioritization of threats. The existing models and methodology follow the traditional approaches of a Common Vulnerability Scoring System (CVSS) to prioritize threats and vulnerabilities. The CVSS is not able to provide effectiveness to the security of the business of an organization. In contrast, the vulnerability analysis needs a model which can give significance to the prioritization policies. The model depends on the CVSS score of threats and compares various features of vulnerability like threat vectors, inputs, environments used by threat agent's groups, and potential outputs of threat agents. Therefore, the research aims to design a semi-automatic model for vulnerability analysis of threats for the National Institute of Standards and Technology (NIST) database of cyber-crime. We have developed a semi-automatic model that simulates the CVE (Common Vulnerabilities and Exposures) list of the NIST database between 1999 and 2021, concerning the resources used by the threat agents, pre-requisites input, attack vectors, and dormant results. The semi-automatic approach of the model to perform the vulnerability analysis of threat agent groups identified in a network makes the model more efficient and effective to addresses the profiling of threat agents and evaluating the CTI (Critical Threat intelligence feed). Our experimental results imply that the semi-automatic model implements the vulnerability prioritization based on the CVSS score and uses the comparative analysis based on the threat agent's vectors identified. It also provides potency and optimized complexity to an organization's business to mitigate the vulnerability identified in a network.

Quantitative Security Risk Evaluation using CVSS Metrics by Estimation of Frequency and Maturity of Exploit

Towards More Practical Automation of Vulnerability Assessment

Predictive Cyber-security Analytics Framework: A non-homogenous Markov model for Security Quantification

Computer Network System Security Assessment Method.

Analysis and implementation of semi-automatic model for vulnerability exploitations of threat agents in NIST databases

Model-Based Quantitative Network Security Metrics: A Survey

A Model for Android and iOS Applications Risk Calculation: CVSS Analysis and Enhancement Using Case-Control Studies

Estimating Security Risk for Web Applications Using Security Vectors

Cybersecurity: A Stochastic Predictive Model to Determine Overall Network Security Risk Using Markovian Process

Security Rating Metrics for Distributed Wireless Systems

SecScore: Enhancing the CVSS Threat Metric Group with Empirical Evidences

Multiple behavior information fusion based quantitative threat evaluation

Quantifying the Effects of Operational Technology or Industrial Control System based Cybersecurity Controls via CVSS Scoring

Quantifiable Network Security Measurement - A Study Based on an Index System.

A Quantitative Method for Evaluating Network Security Based on Attack Graph.

Study of Security Metrics of Software System for Comparative Evaluation

Multi-dimensional Network Security Situation Assessment

Quantitative Evaluation Technology of Computer System Security Based on Probability and Statistics

My Software has a Vulnerability, should I worry?

Quantitative Hierarchical Threat Evaluation Model for Network Security

Assessment method of automatic optimizing CVSS v20 vulnerability indi-cator s