Download to read offline
![Classifier = Will a vulnerability have an exploit
written and published?
[YES OR NO]](https://image.slidesharecdn.com/predictingexploitability-final-oreilly-171031235602/85/O-Reilly-Security-New-York-Predicting-Exploitability-Final-17-320.jpg)
Uploaded byMichael Roytman
O'Reilly Security New York - Predicting Exploitability Final
The document discusses methods for predicting the exploitability of vulnerabilities through retrospective, real-time, and predictive analyses, highlighting the challenges of managing numerous vulnerabilities. It emphasizes the need for data-driven approaches, utilizing machine learning models to classify if vulnerabilities will have exploits, and outlines various models that consider factors such as CVSS scores and patch existence. The ultimate goal is to enhance vulnerability management by effectively predicting which vulnerabilities to prioritize for remediation.
More Related Content
Similar to O'Reilly Security New York - Predicting Exploitability Final
O'Reilly Security New York - Predicting Exploitability Final
- 1.
- 2. “Prediction is verydifficult, especially about the future.” -Niels Bohr
- 3. 3 Types of“Data-Driven” Retrospective Analysis & Reporting Here-and-now Real-time processing & dashboards Predictions To enable smart applications
- 4. Too many vulnerabilities. Howdo we derive risk from vulnerability in a data-driven manner? Problem
- 5.
- 6. 1. RETROSPECTIVE 2. REAL-TIME 3.PREDICTIVE Exploitability
- 7. Analyst Input Vulnerability Management ProgramsAugmenting Data Retrospective - Model: CVSS Temporal Score Estimation Vulnerability Researchers
- 8. 1. RETROSPECTIVE 2. REAL-TIME 3.PREDICTIVE Exploitability
- 9. Real-Time - TheData Vulnerability Scans (Qualys, Rapid7, Nessus, etc): • 7,000,000 Assets (desktops, servers, urls, ips, macaddresses) • 1,400,000,000 Vulnerabilities (unique asset/CVE pairs) Exploit Intelligence - Successful Exploitations • ReversingLabs’ backend metadata •Hashes for each CVE •Number of found pieces of malware corresponding to each hash • Alienvault Backdoor •“attempted exploits” correlated with open vulnerabilities
- 10. ATTACKERS ARE FAST Cumulative Probabilityof Exploitation
- 12. 0 5 1015 20 25 30 35 40 CVSS*10 EDB MSP EDB+MSP Breach*Probability*(%) Positive Predictive Value of remediating a vulnerability with property X:
- 13. Q: “Of mycurrent vulnerabilities, which ones should I remediate?” A: Old ones with stable, weaponized exploits Data of Future Past
- 14. Q: “A newvulnerability was just released. Do we scramble?” A: Future of Data Past
- 15. 1. RETROSPECTIVE 2. REAL-TIME 3.PREDICTIVE Exploitability
- 17. Classifier = Willa vulnerability have an exploit written and published? [YES OR NO]
- 18.
- 19. N = 81303AllCVE. Described By: 1. National Vulnerability Database 2. Common Platform Enumeration 3. Occurrences in Kenna Scan Data Labelled as Exploited/Not Exploited: 1. Exploit DB 2. Metasploit 3. D2 Elliot 4. Canvas 5. Blackhat Exploit Kits Predictive - The Data
- 20. 70% Training, 30%Evaluation Split N = 81303 L2 regularizer 1 gb 100 passes over the data Receiver operating characteristics for comparisons All Models
- 21. Distribution is notuniform. 77% of dataset is not exploited 1. Accuracy of 77% would be bad Precision matters more than Recall 1. No one would use this model absent actual exploit available data. 2. False Negatives matter less than false positives - wasted effort Predictive - The Expectations We are not modeling when something will be exploited, just IF 1. Could be tomorrow or in 6 months. Re-run the model every day
- 22. Model 1: Baseline -CVSSBase -CVSS Temporal -Remote Code Execution -Availability -Integrity -Confidentiality -Authentication -Access Complexity -Access Vector -Publication Date
- 23.
- 24. Moar Simple? Sample BadChart Sample Good Chart
- 25. Model 2: Patches -CVSSBase -CVSS Temporal -Remote Code Execution -Availability -Integrity -Confidentiality -Authentication -Access Complexity -Access Vector -Publication Date -Patch Exists
- 26. Model 3: AffectedSoftware -CVSS Base -CVSS Temporal -Remote Code Execution -Availability -Integrity -Confidentiality -Authentication -Access Complexity -Access Vector -Publication Date -Patch Exists -Vendors -Products
- 27. Model 4: Words! -CVSSBase -CVSS Temporal -Remote Code Execution -Availability -Integrity -Confidentiality -Authentication -Access Complexity -Access Vector -Publication Date -Patch Exists -Vendors -Products -Description, Ngrams 1-5
- 28. Model 5: VulnerabilityPrevalence -CVSS Base -CVSS Temporal -Remote Code Execution -Availability -Integrity -Confidentiality -Authentication -Access Complexity -Access Vector -Publication Date -Patch Exists -Vendors -Products -Description, Ngrams 1-5 -Vulnerability Prevalence -Number of References
- 29. Model 6: OverfittingFixes -2015 onward -Exclude: “in the wild” “as seen” “exploited”
- 30.
- 31. -Track Predictions vs. RealExploits -Integrate 20+ BlackHat Exploit Kits - FP reduction? -Find better vulnerability descriptions - mine advisories for content? FN reduction? -Predict Breaches, not Exploits -Attempt Models by Vendor Future Work
- 32. Too many vulnerabilities. Howdo we derive risk from vulnerability in a data-driven manner? Problem
- 33. 1. Gather dataabout known successful attack paths 2. Issue forecasts where data is lacking in order to predict new exploits 3. Gather MORE data about known successful attack paths Solution
- 34. These will haveexploits in 2017… CVE-2016-0959 Released: 6/28/2017 No Exploit in ExploitDB, Metasploit, or Canvas Flash buffer overflow, predicted that an exploit will be released
- 36.