Automated CVE Analysis for Threat Prioritization and Impact Prediction Article Swipe

MAKE IMPACT

Ehsan Aghaei , Ehab Al‐Shaer , Waseem Shadid , Xi Niu · YOU? · · 2023 · Open Access · · DOI: https://doi.org/10.48550/arxiv.2309.03040

The Common Vulnerabilities and Exposures (CVE) are pivotal information for proactive cybersecurity measures, including service patching, security hardening, and more. However, CVEs typically offer low-level, product-oriented descriptions of publicly disclosed cybersecurity vulnerabilities, often lacking the essential attack semantic information required for comprehensive weakness characterization and threat impact estimation. This critical insight is essential for CVE prioritization and the identification of potential countermeasures, particularly when dealing with a large number of CVEs. Current industry practices involve manual evaluation of CVEs to assess their attack severities using the Common Vulnerability Scoring System (CVSS) and mapping them to Common Weakness Enumeration (CWE) for potential mitigation identification. Unfortunately, this manual analysis presents a major bottleneck in the vulnerability analysis process, leading to slowdowns in proactive cybersecurity efforts and the potential for inaccuracies due to human errors. In this research, we introduce our novel predictive model and tool (called CVEDrill) which revolutionizes CVE analysis and threat prioritization. CVEDrill accurately estimates the CVSS vector for precise threat mitigation and priority ranking and seamlessly automates the classification of CVEs into the appropriate CWE hierarchy classes. By harnessing CVEDrill, organizations can now implement cybersecurity countermeasure mitigation with unparalleled accuracy and timeliness, surpassing in this domain the capabilities of state-of-the-art tools like ChaptGPT.

Type

preprint

Language

en

Landing Page

http://arxiv.org/abs/2309.03040

PDF

https://arxiv.org/pdf/2309.03040

OA Status

green

Cited By

3

Related Works

10

OpenAlex ID

https://openalex.org/W4386556345

Raw OpenAlex JSON

OpenAlex ID

https://openalex.org/W4386556345

Canonical identifier for this work in OpenAlex

DOI

https://doi.org/10.48550/arxiv.2309.03040

Digital Object Identifier

Title

Automated CVE Analysis for Threat Prioritization and Impact Prediction

Work title

Type

preprint

OpenAlex work type

Language

en

Primary language

Publication year

2023

Year of publication

Publication date

2023-09-06

Full publication date if available

Authors

Ehsan Aghaei, Ehab Al‐Shaer, Waseem Shadid, Xi Niu

List of authors in order

Landing page

https://arxiv.org/abs/2309.03040

Publisher landing page

PDF URL

https://arxiv.org/pdf/2309.03040

Direct link to full text PDF

Open access

Yes

Whether a free full text is available

OA status

green

Open access status per OpenAlex

OA URL

https://arxiv.org/pdf/2309.03040

Direct OA link when available

Concepts

Computer science, Computer security, Prioritization, Vulnerability assessment, Vulnerability (computing), Identification (biology), Risk analysis (engineering), Process (computing), Countermeasure, Exploit, Process management, Engineering, Business, Biology, Operating system, Psychological resilience, Aerospace engineering, Psychotherapist, Botany, Psychology

Top concepts (fields/topics) attached by OpenAlex

Cited by

3

Total citation count in OpenAlex

Citations by year (recent)

2025: 1, 2024: 2

Per-year citation counts (last 5 years)

Related works (count)

10

Other works algorithmically related by OpenAlex

Full payload