A Statistical Approach to Severity Aware Vulnerability Prioritization

Patch management is a critical aspect of securing systems and networks against attacks. There is a balance between applying patches earlier or later, in which applying too early could mean introducing instability or downtime, while delaying too long may expose the system to security vulnerabilities. In this paper, we present measurements and models for dynamic severity assessment, to assist in patch management decisions. Building on top of CVSS scores, we propose a methodology to combine historical data on vulnerability weaponization into CVSS scores, to provide both explanatory and predictive insight into how severity evolves over time. The proposed methodology combines a classifier with statistical inference, and is flexible to account for different aspects of the vulnerability lifecycle.