Automatic CVSS-Based Vulnerability Prioritization and Response with Context Information and Machine Learning
Source abstract
Abstract
In the context of vulnerability management for data communication networks, determining which vulnerabilities to address first is of paramount importance. While identifying vulnerabilities using network scanners is relatively straightforward, efficiently prioritizing them for mitigation remains a significant challenge. Previously, our team developed a machine learning-based converter to translate CVSS v2.0 base scores into CVSS v3.x base scores, specifically to enable the use of the CVSS v3.x environmental score. The central question of this research is whether leveraging these converter-enabled CVSS v3.x environmental scores leads to a measurably improved vulnerability prioritization process compared to traditional methods, often reliant solely on CVSS v2.0 base scores. The environmental score potentially offers a more refined, context-specific perspective on vulnerability impact within specific systems. To evaluate this approach, we will test the converter’s performance in real-world environments and assess its impact on network administrator decision-making and workflows. Performance improvement will be measured by analyzing changes in mitigation times, potential threat exposure reduction, and overall vulnerability management efficiency. The ultimate goal is to determine if the proposed machine learning based methodology delivers practical benefits, enhancing organizational security through more accurate and effective vulnerability prioritization.Experimental results demonstrate that CVSS v3.x environmental scoring resolves critical v2.0 imprecision issues, enabling more accurate vulnerability prioritization. Our approach achieves measurable efficiency gains, reducing estimated remediation work hours by up to 8% compared to CVSS v2.0 methods. The study confirms that the proposed methodology delivers practical benefits, enhancing organizational security through more accurate and effective vulnerability prioritization.
Source: crossref · Quality: baseline
Research context
OpenAlex topics: Network Security and Intrusion Detection · Information and Cyber Security · Web Application Security Vulnerabilities
SciVX discovery tags are terminology-based. OpenAlex topics are source-provided classifications.
Affiliations
Faculty of Information and Communication Technology, Wrocław University of Science and Technology, Wyb. Wyspianskiego 27, 50-370 Wroclaw, Poland
Funding
Polish Ministry of Education and Science
References (56)
Show source-provided references
1. Booth, H., Rike, D., and Witte, G.A. (2013). The National Vulnerability Database (NVD): Overview, National Institute of Standards and Technology.
2. (2023, December 20). Vulnerability and Threat Trends; Technical Report 2020. Available online: https://lp.skyboxsecurity.com/rs/440-MPQ-510/images/Skybox_Report_2020-VT_Trends.pdf.
3. (2023, December 20). Vulnerability and Threat Trends; Technical Report 2021. Available online: https://lp.skyboxsecurity.com/rs/440-MPQ-510/images/Skybox-Security-vulnerability-and-threat-trends-report-2021.pdf.
4. (2023, December 20). Vulnerability and Threat Trends; Technical Report 2023. Available online: https://www.skyboxsecurity.com/resources/report/vulnerability-threat-trends-report-2023/.
5. Walkowski, M., Oko, J., and Sujecki, S. (2021). Vulnerability Management Models Using a Common Vulnerability Scoring System. Appl. Sci., 11.10.3390/app11188735 ↗
6. Nowak, M., Walkowski, M., and Sujecki, S. (2021). Machine Learning Algorithms for Conversion of CVSS Base Score from 2.0 to 3.x, Springer.10.1007/978-3-030-77967-2_21 ↗
7. Walkowski, M., Oko, J., and Sujecki, S. (2021, January 23–25). Conversion of CVSS Base Score from 2.0 to 3.1. Proceedings of the 2021 International Conference on Software, Telecommunications and Computer Networks (SoftCOM), Split, Croatia.10.23919/SoftCOM52868.2021.9559092 ↗
8. Balsam, A., Walkowski, M., Nowak, M., Jacek, O., and Sujecki, S. (2023, January 21–23). Automated Calculation of CVSS v3.1 Temporal Score Based on Apache Log4j 2021 Vulnerabilities. Proceedings of the 2023 International Conference on Software, Telecommunications and Computer Networks (SoftCOM), Split, Croatia.10.23919/SoftCOM58365.2023.10271671 ↗
9. OWASP (2025, May 25). OWASP Vulnerability Management Center 1.0.2. Available online: https://github.com/owasp/www-project-vulnerability-management-center.
10. Mann, D.E., and Christey, S.M. (1999, January 21–22). Towards a common enumeration of vulnerabilities. Proceedings of the 2nd Workshop on Research with Security Vulnerability Databases, West Lafayette, IN, USA.
11. Managing vulnerabilities in networked systems10.1109/2.963441 ↗
12. Fall, D., and Kadobayashi, Y. (2019, January 23–25). The Common Vulnerability Scoring System vs. Rock Star Vulnerabilities: Why the Discrepancy?. Proceedings of the ICISSP, Prague, Czech Republic.10.5220/0007387704050411 ↗
13. Mell, P., Hu, V., Lippmann, R., Haines, J., and Zissman, M. (2003). An Overview of Issues in Testing Intrusion Detection Systems, National Institute of Standards and Technology.10.6028/NIST.IR.7007 ↗
14. Kaya, K. (2019). A Study of Vulnerabilities and Weaknesses in Connected Cars, KTH Royal Institute of Technology.
15. Food and Drug Administration (2016). Postmarket Management of Cybersecurity in Medical Devices: Guidance for Industry and Food and Drug Administration Staff, Food and Drug Administration.
16. Wang, W., Gupta, A., and Niu, N. (2018, January 20–24). Mining security requirements from common vulnerabilities and exposures for agile projects. Proceedings of the 2018 IEEE 1st International Workshop on Quality Requirements in Agile Projects (QuaRAP), Banff, AB, Canada.10.1109/QuaRAP.2018.00007 ↗
17. IBM (2023, December 20). IBM X-Force Threat Intelligence. Available online: https://www.ibm.com/security/xforce.
18. Symantec (2023, December 20). Symantec Security Center. Available online: https://www.broadcom.com/support/security-center.
19. Microsoft (2023, December 20). Microsoft Security Response Center. Available online: https://www.microsoft.com/en-us/msrc?rtc=1.
20. Redhat (2023, December 20). Redhat Product Security Center. Available online: https://access.redhat.com/security.
21. Mozilla (2023, December 20). Mozilla Foundation Security Advisories. Available online: https://www.mozilla.org/en-US/security/advisories.
22. Secunia (2023, December 20). Secunia Research. Available online: http://secunia.com/advisories/historic/.
23. Improving VRSS-based vulnerability prioritization using analytic hierarchy process10.1016/j.jss.2012.03.057 ↗
24. Google (2023, December 20). Severity Guidelines for Security Issues. Available online: http://dev.chromium.org/developers/severity-guidelines/.
25. Common vulnerability scoring system10.1109/MSP.2006.145 ↗
26. FIRST (2023, December 20). Common Vulnerability Scoring System v2.0: Specification Document. Available online: https://www.first.org/cvss/v2/guide.
27. Eiram, C., and Martin, B. (2013). The CVSSv2 Shortcomings, Faults, and Failures Formulation, Forum of Incident Response and Security Teams (FIRST). Technical report.
28. FIRST (2023, December 20). Common Vulnerability Scoring System v3.1: Specification Document. Available online: https://www.first.org/cvss/v3.1/specification-document.
29. Spring, J., Hatleback, E., Manion, A., and Shic, D. (2018). Towards Improving CVSS, Software Engineering Institute, Carnegie Mellon University. Technical Report.
30. Chen, Y., and Boehm, B.W. (2007, January 20–26). Stakeholder value driven threat modeling for off the shelf based systems. Proceedings of the 29th International Conference on Software Engineering (ICSE’07 Companion), Washington, DC, USA.10.1109/ICSECOMPANION.2007.69 ↗
31. The Laws of Vulnerabilities: Which security vulnerabilities really matter?10.1016/j.istr.2005.09.005 ↗
32. Using the vulnerability information of computer systems to improve the network security10.1016/j.comcom.2007.03.007 ↗
33. Rieke, R. (September, January 31). Modelling and analysing network security policies in a given vulnerability setting. Proceedings of the International Workshop on Critical Information Infrastructures Security, Samos, Greece.
34. Fruhwirth, C., and Mannisto, T. (2009, January 15–16). Improving CVSS-based vulnerability prioritization and response with context information. Proceedings of the 2009 3rd International Symposium on Empirical Software Engineering and Measurement, Lake Buena Vista, FL, USA.10.1109/ESEM.2009.5314230 ↗
35. Gartner Research (2022, May 20). A Guidance Framework for Developing and Implementing Vulnerability Management. Available online: https://www.gartner.com/en/documents/3747620.
36. Gartner Research (2022, May 20). Gartner Peer Insights ‘Voice of the Customer’: Vulnerability Assessment. Available online: https://www.gartner.com/en/documents/4008853.
37. F-Secure (2022, May 20). Vulnerability Management Tool. Available online: https://www.withsecure.com/en/support/quick-start/elements-vulnerability-management.
38. Qualys (2022, May 20). Vulnerability Management Tool. Available online: https://www.qualys.com/apps/vulnerability-management.
39. Rapid7 (2023, December 20). Vulnerability Management Tool. Available online: https://www.rapid7.com/products/nexpose/.
40. Tenable (2023, December 20). Vulnerability Management Tool. Available online: https://www.tenable.com/products.
41. Walkowski, M., Krakowiak, M., Jaroszewski, M., Oko, J., and Sujecki, S. (2021, January 23–25). Automatic CVSS-based vulnerability prioritization and response with context information. Proceedings of the 2021 International Conference on Software, Telecommunications and Computer Networks (SoftCOM), Split, Hvar, Croatia.10.23919/SoftCOM52868.2021.9559094 ↗
42. Miura-Ko, R.A., and Bambos, N. (2007, January 24–28). SecureRank: A risk-based vulnerability management scheme for computing infrastructures. Proceedings of the 2007 IEEE International Conference on Communications, Glasgow, UK.10.1109/ICC.2007.244 ↗
43. Vulcon: A system for vulnerability prioritization, mitigation, and management
44. Security Risk Scoring Incorporating Computers’ Environment
45. CAVP: A context-aware vulnerability prioritization model10.1016/j.cose.2022.102639 ↗
46. Chen, H., Liu, J., Liu, R., Park, N., and Subrahmanian, V.S. (2019, January 10–16). VEST: A System for Vulnerability Exploit Scoring & Timing. Proceedings of the IJCAI, Macao, China.10.24963/ijcai.2019/937 ↗
47. The Center for Internet Security (2023, December 20). The CIS Security Metrics. Available online: https://learn.cisecurity.org/CIS-Controls-Measures-and-Metrics-Version-7-FINAL.pdf.
48. Wang, S., Xia, C., Gao, J., Jia, Q., and Jajodia, S. (2015, January 19–20). Vulcon: Vulnerability evaluation based on CVSS and environmental information statistics. Proceedings of the 2015 4th International Conference on Computer Science and Network Technology (ICCSNT), Harbin, China.
49. Gallon, L. (2010, January 20–22). On the impact of environmental metrics on CVSS scores. Proceedings of the 2010 IEEE Second International Conference on Social Computing, Minneapolis, MN, USA.10.1109/SocialCom.2010.146 ↗
50. A look at the time delays in CVSS vulnerability scoring10.1016/j.aci.2017.12.002 ↗
51. Walkowski, M., Krakowiak, M., Oko, J., and Sujecki, S. (2020). Efficient algorithm for providing live vulnerability assessment in corporate network environment. Appl. Sci., 10.10.3390/app10217926 ↗
52. Beale, J., Meer, H., van der Walt, C., and Deraison, R. (2004). Nessus Network Auditing: Jay Beale Open Source Security Series, Elsevier.
53. Li, H., Xi, R., and Zhao, L. (2015, January 14–16). Vulcon: Study on the distribution of CVSS environmental score. Proceedings of the 2015 IEEE 5th International Conference on Electronics Information and Emergency Communication, Beijing, China.10.1109/ICEIEC.2015.7284502 ↗
54. Bird, S., Klein, E., and Loper, E. (2009). Natural Language Processing with Python: Analyzing Text with the Natural Language Toolkit, O’Reilly Media.
55. Nowak, M.R., Zdunek, R., Plinski, E., Swiatek, P., Strzelecka, M., Malinka, W., and Plinska, S. (2019). Recognition of Pharmacological Bi-Heterocyclic Compounds by Using Terahertz Time Domain Spectroscopy and Chemometrics. Sensors, 15.10.3390/s19153349 ↗
56. FIRST (2024, February 20). Common Vulnerability Scoring System Version 4.0. Available online: https://www.first.org/cvss/v4-0/.