Program Overview

Predicting vulnerability exploitation likelihood is crucial for effective risk analysis and patching prioritization. We present our work on developing an open-source system for predicting vulnerability exploitation likelihood, inspired by EPSS. Our approach offers improved interpretability and user control, allowing practitioners to train custom models for specific contexts.

Key focus areas include:

• Feature utility: We challenge the trend of using complex and uninterpretable models with unwieldy number of features. Our system enables users to train models using customized feature subsets, while also providing an evaluation of each features utility. This empowers users to make informed decisions when tailoring models to their specific needs. Data completeness: We address the issue of missing data using language models (e.g., CVSSv3 vectors or CWE information) and potential human errors in feature values by exploring methods to predict and incorporate missing information, assessing its impact on model performance.

• Model interpretability: We investigate the balance between model interpretability and performance by comparing various architectures and examining how prediction formatting affects outcomes

• Temporal relevance: addresses the problem of static models being quickly out-of-date in a rapidly evolving space. This ties into our exploration of lightweight models with refined feature sets, enabling practitioners to update their models more frequently and easily.

We will present an overview and justifications for focusing on these four components alongside preliminary results under various experimental contexts in order to stimulate a discussion and generate potential contributions from the community.

Fredrik Sætran is a researcher at mnemonic. He has 6 years of experience in security operations and incident response. For the last 5 years he has worked as a researcher, focusing on machine learning applications. .

Co-Speaker: Mark Anderson. Bio Coming Soon.