Challenges on prioritizing software patching

The prioritization of software security patches is an important demand of all modern institutions due to the amount of vulnerabilities reported daily and the complexity required to solve them. The state of the art patch prioritization mechanisms focus exclusively on the severity of the reported vulnerabilities. They do not take important factors, such as the likelihood of a vulnerability being exploited, into consideration. In this paper we present an open-source software that uses machine learning techniques to prioritize the application of software security updates based on several factors. Our solution can estimate the probability of exploitation of public vulnerabilities, to complement the risk analysis. This is accomplished using interconnected artificial neural networks optimized by genetic algorithms. Our model was trained with a large amount of data that we have collected from public web sources. We also make this database publicly available to be used in other projects. We ran experiments composed of 20 evaluations, from 2000 to 2020. Our results present a higher F1-Score than all strategies based on CVSS+, proving that the usual procedure of focusing on the severity of vulnerabilities is not the best strategy to guide the prioritization of security patches.