Abstract:Black hat hackers use malicious exploits to circumvent security controls and take advantage of system vulnerabilities worldwide, costing the global economy over $450 billion annually. While many organizations are increasingly turning to cyber threat intelligence (CTI) to help prioritize their vulnerabilities, extant CTI processes are often criticized as being reactive to known exploits. One promising data source that can help develop proactive CTI is the vast and ever-evolving Dark Web. In this study, we adopted the computational design science paradigm to design a novel deep learning (DL)- based exploit-vulnerability attention deep structured semantic model (EVA-DSSM) that includes bidirectional processing and attention mechanisms to automatically link exploits from the Dark Web to vulnerabilities. We also devised a novel device vulnerability severity metric (DVSM) that incorporates the exploit post date and vulnerability severity to help cybersecurity professionals with their device prioritization and risk management efforts. We rigorously evaluated the EVA-DSSM against state-of-theart non-DL and DL-based methods for short text matching on 52,590 exploit-vulnerability linkages across four testbeds: web application, remote, local, and denial of service. Results of these evaluations indicate that the proposed EVA-DSSM achieves precision at 1 scores 20% - 41% higher than non-DL approaches and 4% - 10% higher than DL-based approaches. We demonstrated the EVA-DSSM’s and DVSM’s practical utility with two CTI case studies: openly accessible systems in the top eight U.S. hospitals and over 20,000 Supervisory Control and Data Acquisition (SCADA) systems worldwide. A complementary user evaluation of the case study results indicated that 45 cybersecurity professionals found the EVADSSM and DVSM results more useful for exploit-vulnerability linking and risk prioritization activities than those produced by prevailing approaches. Given the rising cost of cyberattacks, the EVA-DSSM and DVSM have important implications for analysts in security operations centers, incident response teams, and cybersecurity vendors.

Towards More Practical Automation of Vulnerability Assessment

Unveil the Mystery of Critical Software Vulnerabilities

Categorizing and Predicting Invalid Vulnerabilities on Common Vulnerabilities and Exposures

Combining Software Metrics and Text Features for Vulnerable File Prediction

Vulnerability Assessment of Electrical Cyber-Physical Systems Against Cyber Attacks

Automated Unearthing of Dangerous Issue Reports.

Towards prompt tuning-based software vulnerability assessment with continual learning

Enhancing Vulnerability Prioritization: Data-Driven Exploit Predictions with Community-Driven Insights

A multi-target approach to estimate software vulnerability characteristics and severity scores

SAFE: Advancing Large Language Models in Leveraging Semantic and Syntactic Relationships for Software Vulnerability Detection

Automated Software Vulnerability Assessment with Concept Drift

Linking Exploits from the Dark Web to Known Vulnerabilities for Proactive Cyber Threat Intelligence: An Attention-Based Deep Structured Semantic Model

An OVAL-based Active Vulnerability Assessment System for Enterprise Computer Networks.

SecScore: Enhancing the CVSS Threat Metric Group with Empirical Evidences

Automated CVE Analysis for Threat Prioritization and Impact Prediction

Exploit Prediction Scoring System (EPSS)

Analysis and implementation of semi-automatic model for vulnerability exploitations of threat agents in NIST databases

Early and Realistic Exploitability Prediction of Just-Disclosed Software Vulnerabilities: How Reliable Can It Be?

Automotive Cybersecurity Vulnerability Assessment Using the Common Vulnerability Scoring System and Bayesian Network Model

On the Use of Fine-grained Vulnerable Code Statements for Software Vulnerability Assessment Models

Bridging the Gap: A Study of AI-based Vulnerability Management between Industry and Academia