Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

A Relevance Model for Threat-Centric Ranking of Cybersecurity Vulnerabilities

Corren McCoy, Ross Gore, Michael L. Nelson, Michele C. Weigle

TL;DR

The paper tackles the problem that CVSS-based vulnerability prioritization often misaligns with real exploitation risk. It introduces a threat-centric ranking framework built on a knowledge graph that links vulnerabilities to adversary tactics (MITRE ATT&CK, CAPEC) and sector targets, integrating diverse public data (CWE/CVE/CVSS, CAPEC, ExploitDB, KEV, EPSS, NVD). Four ranking policies are defined and evaluated using $nDCG$, revealing substantial improvements over CVSS-only prioritization, with notable patch-cost savings (approximately 23.3%–25.6%) and a case study showing improved prioritization of known-exploit CVEs. The approach demonstrates end-to-end, automated vulnerability management powered by semantic data integration and threat intelligence, offering practical ROI and a scalable path for organization-specific remediation strategies.

Abstract

The relentless process of tracking and remediating vulnerabilities is a top concern for cybersecurity professionals. The key challenge is trying to identify a remediation scheme specific to in-house, organizational objectives. Without a strategy, the result is a patchwork of fixes applied to a tide of vulnerabilities, any one of which could be the point of failure in an otherwise formidable defense. Given that few vulnerabilities are a focus of real-world attacks, a practical remediation strategy is to identify vulnerabilities likely to be exploited and focus efforts towards remediating those vulnerabilities first. The goal of this research is to demonstrate that aggregating and synthesizing readily accessible, public data sources to provide personalized, automated recommendations for organizations to prioritize their vulnerability management strategy will offer significant improvements over using the Common Vulnerability Scoring System (CVSS). We provide a framework for vulnerability management specifically focused on mitigating threats using adversary criteria derived from MITRE ATT&CK. We test our approach by identifying vulnerabilities in software associated with six universities and four government facilities. Ranking policy performance is measured using the Normalized Discounted Cumulative Gain (nDCG). Our results show an average 71.5% - 91.3% improvement towards the identification of vulnerabilities likely to be targeted and exploited by cyber threat actors. The return on investment (ROI) of patching using our policies results in a savings of 23.3% - 25.5% in annualized costs. Our results demonstrate the efficacy of creating knowledge graphs to link large data sets to facilitate semantic queries and create data-driven, flexible ranking policies.

A Relevance Model for Threat-Centric Ranking of Cybersecurity Vulnerabilities

TL;DR

The paper tackles the problem that CVSS-based vulnerability prioritization often misaligns with real exploitation risk. It introduces a threat-centric ranking framework built on a knowledge graph that links vulnerabilities to adversary tactics (MITRE ATT&CK, CAPEC) and sector targets, integrating diverse public data (CWE/CVE/CVSS, CAPEC, ExploitDB, KEV, EPSS, NVD). Four ranking policies are defined and evaluated using , revealing substantial improvements over CVSS-only prioritization, with notable patch-cost savings (approximately 23.3%–25.6%) and a case study showing improved prioritization of known-exploit CVEs. The approach demonstrates end-to-end, automated vulnerability management powered by semantic data integration and threat intelligence, offering practical ROI and a scalable path for organization-specific remediation strategies.

Abstract

The relentless process of tracking and remediating vulnerabilities is a top concern for cybersecurity professionals. The key challenge is trying to identify a remediation scheme specific to in-house, organizational objectives. Without a strategy, the result is a patchwork of fixes applied to a tide of vulnerabilities, any one of which could be the point of failure in an otherwise formidable defense. Given that few vulnerabilities are a focus of real-world attacks, a practical remediation strategy is to identify vulnerabilities likely to be exploited and focus efforts towards remediating those vulnerabilities first. The goal of this research is to demonstrate that aggregating and synthesizing readily accessible, public data sources to provide personalized, automated recommendations for organizations to prioritize their vulnerability management strategy will offer significant improvements over using the Common Vulnerability Scoring System (CVSS). We provide a framework for vulnerability management specifically focused on mitigating threats using adversary criteria derived from MITRE ATT&CK. We test our approach by identifying vulnerabilities in software associated with six universities and four government facilities. Ranking policy performance is measured using the Normalized Discounted Cumulative Gain (nDCG). Our results show an average 71.5% - 91.3% improvement towards the identification of vulnerabilities likely to be targeted and exploited by cyber threat actors. The return on investment (ROI) of patching using our policies results in a savings of 23.3% - 25.5% in annualized costs. Our results demonstrate the efficacy of creating knowledge graphs to link large data sets to facilitate semantic queries and create data-driven, flexible ranking policies.
Paper Structure (32 sections, 2 equations, 8 figures, 14 tables)

This paper contains 32 sections, 2 equations, 8 figures, 14 tables.

Table of Contents

  1. Introduction
  2. Data and Methods
  3. Data
  4. Software Weaknesses Dataset
  5. Vulnerability Dataset
  6. Vendor Product Dataset
  7. Attack Pattern Dataset
  8. Exploit Dataset
  9. Adversary Tactics and Techniques Dataset
  10. Synthesizing Data Sources Into A Knowledge Graph
  11. Leveraging the Knowledge Graph to Link Vulnerabilities to Sector Specific Threat Actors
  12. Defining a Standard Set of Sectors
  13. Defining Standard Locations
  14. Assigning Attributes to Adversary Groups
  15. Where Attacks Originate
  16. ...and 17 more sections

Figures (8)

  • Figure 1: Software vulnerability lifecycle phases and their relationships to our public data sources.
  • Figure 2: The entities of the knowledge graph.
  • Figure 3: Graph schema representing the type of entities via color in the knowledge graph and the relationship between them.
  • Figure 4: Vulnerabilities by month and year for CVE-IDs between 2019 and 2021 for government facilities (left) and education (right) sectors.
  • Figure 5: Average value of nDCG at different rank levels (K) for CVSS Base Score versus APT Threat policy for the ODU, REGENT, and WM organizations.
  • ...and 3 more figures