From Patching Delays to Infection Symptoms: Using Risk Profiles for an Early Discovery of Vulnerabilities Exploited in the Wild
summary
Compares ISP-level patch-deployment risk profiles (from host software footprints tied to NVD CVEs) against symptom communities derived from spam blacklists, using community detection to see if similar-risk ISPs also share infection symptoms. Trains random forests on 56 exploited labels and other CVEs, using 10-day post-disclosure windows to flag active exploitation, achieving about 90% TPR / 10% FPR (AUC ~0.96 with all features, community-only AUC ~0.76) and surfacing some zero-day evidence.
AI-written summary · about
chapters (19)
- 0:00Intro
- 2:50Realworld measurements
- 3:36Methodology overview
- 5:02Simple heuristic
- 6:35Risk Behavior Signals
- 7:11Ground Truth Signals
- 7:35Data Processing
- 8:20Weighted Graphs
- 8:44Methodology
- 10:28Example
- 12:51Intrinsic Attributes
- 13:24Results
- 15:57Post Disclosure Data
- 16:18Case Studies
- 17:24Practical Utility
- 17:50Our Methodology
- 18:46Conclusion
- 19:22Future Directions
- 19:54Questions
related talks
58mNothing to Risk but Risk Itself: Expanding Vulnerability Risk with Internet-Scale Data
57mSeeing the Vulnerable Forest Through the Exploited Trees
54mTowards Real World Cyber Risk (Panel)
58mWhy Can't We All Just Get Along? Bridging the Gap in Vulnerability Prioritization Standards
29mYou've Got Vulnerability: Exploring Effective Vulnerability Notifications
27mExploited CVEs of 2024: Lessons for Vendors and Defenders
01h 23mEPSS: Challenges and Opportunities Going Forward + EPSS AMA
51mWhen it Comes to Managing Risk, Context is King