VEST: A system for vulnerability exploit scoring & timing

Haipeng Chen; Jing Liu; Rui Liu; Noseong Park; V. S. Subrahmanian

doi:10.24963/ijcai.2019/937

VEST: A system for vulnerability exploit scoring & timing

Haipeng Chen, Jing Liu, Rui Liu, Noseong Park, V. S. Subrahmanian

Graduate School

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution

11 Citations (Scopus)

Abstract

Knowing if/when a cyber-vulnerability will be exploited and how severe the vulnerability is can help enterprise security officers (ESOs) come up with appropriate patching schedules. Today, this ability is severely compromised: our study of data from MITRE and NIST shows that on average there is a 132 day gap between the announcement of a vulnerability by MITRE and the time NIST provides an analysis with severity score estimates and 8 important severity attributes. Many attacks happen during this very 132-day window. We present Vulnerability Exploit Scoring & Timing (VEST), a system for (early) prediction and visualization of if/when a vulnerability will be exploited, and its estimated severity attributes and score.

Original language	English
Title of host publication	Proceedings of the 28th International Joint Conference on Artificial Intelligence, IJCAI 2019
Editors	Sarit Kraus
Publisher	International Joint Conferences on Artificial Intelligence
Pages	6503-6505
Number of pages	3
ISBN (Electronic)	9780999241141
DOIs	https://doi.org/10.24963/ijcai.2019/937
Publication status	Published - 2019
Event	28th International Joint Conference on Artificial Intelligence, IJCAI 2019 - Macao, China Duration: 2019 Aug 10 → 2019 Aug 16

Publication series

Name	IJCAI International Joint Conference on Artificial Intelligence
Volume	2019-August
ISSN (Print)	1045-0823

Conference

Conference	28th International Joint Conference on Artificial Intelligence, IJCAI 2019
Country/Territory	China
City	Macao
Period	19/8/10 → 19/8/16

Bibliographical note

Funding Information:
This work is supported by ONR grants N00014-18-1-2670 and N00014-16-1-2896 and ARO grant W911NF-13-1-0421.

Publisher Copyright:
© 2019 International Joint Conferences on Artificial Intelligence. All rights reserved.

All Science Journal Classification (ASJC) codes

Artificial Intelligence

Access to Document

10.24963/ijcai.2019/937

Cite this

Chen, H., Liu, J., Liu, R., Park, N., & Subrahmanian, V. S. (2019). VEST: A system for vulnerability exploit scoring & timing. In S. Kraus (Ed.), Proceedings of the 28th International Joint Conference on Artificial Intelligence, IJCAI 2019 (pp. 6503-6505). (IJCAI International Joint Conference on Artificial Intelligence; Vol. 2019-August). International Joint Conferences on Artificial Intelligence. https://doi.org/10.24963/ijcai.2019/937

@inproceedings{8ee464b5b8d74f7fb51e1a4b732fcf18,

title = "VEST: A system for vulnerability exploit scoring & timing",

abstract = "Knowing if/when a cyber-vulnerability will be exploited and how severe the vulnerability is can help enterprise security officers (ESOs) come up with appropriate patching schedules. Today, this ability is severely compromised: our study of data from MITRE and NIST shows that on average there is a 132 day gap between the announcement of a vulnerability by MITRE and the time NIST provides an analysis with severity score estimates and 8 important severity attributes. Many attacks happen during this very 132-day window. We present Vulnerability Exploit Scoring & Timing (VEST), a system for (early) prediction and visualization of if/when a vulnerability will be exploited, and its estimated severity attributes and score.",

author = "Haipeng Chen and Jing Liu and Rui Liu and Noseong Park and Subrahmanian, {V. S.}",

note = "Funding Information: This work is supported by ONR grants N00014-18-1-2670 and N00014-16-1-2896 and ARO grant W911NF-13-1-0421. Publisher Copyright: {\textcopyright} 2019 International Joint Conferences on Artificial Intelligence. All rights reserved.; 28th International Joint Conference on Artificial Intelligence, IJCAI 2019 ; Conference date: 10-08-2019 Through 16-08-2019",

year = "2019",

doi = "10.24963/ijcai.2019/937",

language = "English",

series = "IJCAI International Joint Conference on Artificial Intelligence",

publisher = "International Joint Conferences on Artificial Intelligence",

pages = "6503--6505",

editor = "Sarit Kraus",

booktitle = "Proceedings of the 28th International Joint Conference on Artificial Intelligence, IJCAI 2019",

}

Chen, H, Liu, J, Liu, R, Park, N & Subrahmanian, VS 2019, VEST: A system for vulnerability exploit scoring & timing. in S Kraus (ed.), Proceedings of the 28th International Joint Conference on Artificial Intelligence, IJCAI 2019. IJCAI International Joint Conference on Artificial Intelligence, vol. 2019-August, International Joint Conferences on Artificial Intelligence, pp. 6503-6505, 28th International Joint Conference on Artificial Intelligence, IJCAI 2019, Macao, China, 19/8/10. https://doi.org/10.24963/ijcai.2019/937

VEST: A system for vulnerability exploit scoring & timing. / Chen, Haipeng; Liu, Jing; Liu, Rui et al.
Proceedings of the 28th International Joint Conference on Artificial Intelligence, IJCAI 2019. ed. / Sarit Kraus. International Joint Conferences on Artificial Intelligence, 2019. p. 6503-6505 (IJCAI International Joint Conference on Artificial Intelligence; Vol. 2019-August).

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution

TY - GEN

T1 - VEST

T2 - 28th International Joint Conference on Artificial Intelligence, IJCAI 2019

AU - Chen, Haipeng

AU - Liu, Jing

AU - Liu, Rui

AU - Park, Noseong

AU - Subrahmanian, V. S.

N1 - Funding Information: This work is supported by ONR grants N00014-18-1-2670 and N00014-16-1-2896 and ARO grant W911NF-13-1-0421. Publisher Copyright: © 2019 International Joint Conferences on Artificial Intelligence. All rights reserved.

PY - 2019

Y1 - 2019

N2 - Knowing if/when a cyber-vulnerability will be exploited and how severe the vulnerability is can help enterprise security officers (ESOs) come up with appropriate patching schedules. Today, this ability is severely compromised: our study of data from MITRE and NIST shows that on average there is a 132 day gap between the announcement of a vulnerability by MITRE and the time NIST provides an analysis with severity score estimates and 8 important severity attributes. Many attacks happen during this very 132-day window. We present Vulnerability Exploit Scoring & Timing (VEST), a system for (early) prediction and visualization of if/when a vulnerability will be exploited, and its estimated severity attributes and score.

AB - Knowing if/when a cyber-vulnerability will be exploited and how severe the vulnerability is can help enterprise security officers (ESOs) come up with appropriate patching schedules. Today, this ability is severely compromised: our study of data from MITRE and NIST shows that on average there is a 132 day gap between the announcement of a vulnerability by MITRE and the time NIST provides an analysis with severity score estimates and 8 important severity attributes. Many attacks happen during this very 132-day window. We present Vulnerability Exploit Scoring & Timing (VEST), a system for (early) prediction and visualization of if/when a vulnerability will be exploited, and its estimated severity attributes and score.

UR - http://www.scopus.com/inward/record.url?scp=85074931386&partnerID=8YFLogxK

UR - http://www.scopus.com/inward/citedby.url?scp=85074931386&partnerID=8YFLogxK

U2 - 10.24963/ijcai.2019/937

DO - 10.24963/ijcai.2019/937

M3 - Conference contribution

AN - SCOPUS:85074931386

T3 - IJCAI International Joint Conference on Artificial Intelligence

SP - 6503

EP - 6505

BT - Proceedings of the 28th International Joint Conference on Artificial Intelligence, IJCAI 2019

A2 - Kraus, Sarit

PB - International Joint Conferences on Artificial Intelligence

Y2 - 10 August 2019 through 16 August 2019

ER -

Chen H, Liu J, Liu R, Park N, Subrahmanian VS. VEST: A system for vulnerability exploit scoring & timing. In Kraus S, editor, Proceedings of the 28th International Joint Conference on Artificial Intelligence, IJCAI 2019. International Joint Conferences on Artificial Intelligence. 2019. p. 6503-6505. (IJCAI International Joint Conference on Artificial Intelligence). doi: 10.24963/ijcai.2019/937

VEST: A system for vulnerability exploit scoring & timing

Abstract

Publication series

Conference

Bibliographical note

All Science Journal Classification (ASJC) codes

Access to Document

Other files and links

Fingerprint

Cite this