Skip to content

Commit 8b97dc4

Browse files
CrashedmindCrashedmind
committed
Deployed 1818e69 with MkDocs version: 1.5.3
1 parent 0dc665b commit 8b97dc4

File tree

5 files changed

+80
-60
lines changed

5 files changed

+80
-60
lines changed

‎epss/LEV/index.html‎

Lines changed: 17 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -2005,8 +2005,8 @@ <h2 id="what-is-lev">What is LEV?<a class="headerlink" href="#what-is-lev" title
20052005
CSWP 41. <a href="https://doi.org/10.6028/NIST.CSWP.41">https://doi.org/10.6028/NIST.CSWP.41</a> </p>
20062006
<h2 id="why-lev-matters">Why LEV Matters<a class="headerlink" href="#why-lev-matters" title="Permanent link">&para;</a></h2>
20072007
<div class="admonition tip">
2008-
<p class="admonition-title"><strong>KEY INSIGHT: The Three-Dimensional View of Vulnerability <abbr title="The likelihood of a vulnerability being exploited and the potential impact of such an exploit on an organization.">Risk</abbr></strong></p>
2009-
<p>LEV fills a critical gap by looking backward in time, complementing forward-looking and current exploitation data:</p>
2008+
<p class="admonition-title"><strong>KEY INSIGHT: LEV gives an additional View of Vulnerability <abbr title="The likelihood of a vulnerability being exploited and the potential impact of such an exploit on an organization.">Risk</abbr></strong></p>
2009+
<p>LEV fills a gap by looking backward in time, complementing forward-looking and current exploitation data:</p>
20102010
<table>
20112011
<thead>
20122012
<tr>
@@ -2172,7 +2172,10 @@ <h3 id="misunderstanding-of-epss">Misunderstanding of <abbr title="Exploit Predi
21722172
<h3 id="lev2-approximation">LEV2 Approximation<a class="headerlink" href="#lev2-approximation" title="Permanent link">&para;</a></h3>
21732173
<div class="admonition warning">
21742174
<p class="admonition-title"><strong>Invalid Probability Division</strong></p>
2175-
<p>The "Small Probability" approximation is not valid for higher <abbr title="Exploit Prediction Scoring System">EPSS</abbr> scores (the scores of interest).</p>
2175+
<p>The "Small Probability" approximation is not valid for higher <abbr title="Exploit Prediction Scoring System">EPSS</abbr> scores (the scores of interest), and is not necessary if the computation is optimized per the <a href="https://github.com/RiskBasedPrioritization/LEV/">Source Code</a> provided here.</p>
2176+
<ul>
2177+
<li>Rigorous vs NIST approximation time ratio: 2.23x</li>
2178+
</ul>
21762179
</div>
21772180
<p>LEV handles <abbr title="Exploit Prediction Scoring System">EPSS</abbr> scores as covering only a single day by dividing them by 30: <span class="arithmatex">\(P_1 \approx P_{30}/30\)</span></p>
21782181
<p>Dividing a 30-day probability by 30 to get a 1-day probability generally <strong>does not make sense</strong> in a rigorous probabilistic context.</p>
@@ -2202,9 +2205,12 @@ <h3 id="lev2-approximation">LEV2 Approximation<a class="headerlink" href="#lev2-
22022205
<div class="admonition tip">
22032206
<p class="admonition-title">Tip</p>
22042207
<p>Using standard concurrent processing per the source code, the approximation is not required on a standard computer.</p>
2208+
<p>The code to calculate LEV (both approximation and rigorous), and the composite probability (both approximation and rigorous) completes in less than 30 minutes on a standard computer. </p>
22052209
<ul>
2206-
<li>the code completes in minutes </li>
2210+
<li>The approximation calculations are not required but in the code for comparison.</li>
2211+
<li>See example log file: <a href="https://github.com/RiskBasedPrioritization/LEV/blob/main/logs/20250531_180156.log">https://github.com/RiskBasedPrioritization/LEV/blob/main/logs/20250531_180156.log</a></li>
22072212
</ul>
2213+
<p>Calculations for new days (new runs) can be very fast if the code is optimized to use existing calculations from previous runs (it isn't currently).</p>
22082214
</div>
22092215
<h3 id="independent-events-assumption">Independent Events Assumption<a class="headerlink" href="#independent-events-assumption" title="Permanent link">&para;</a></h3>
22102216
<div class="admonition warning">
@@ -2221,15 +2227,19 @@ <h3 id="independent-events-assumption">Independent Events Assumption<a class="he
22212227
</ul>
22222228
<p>The <strong>Independent Events Assumption</strong> is not valid because:</p>
22232229
<ul>
2224-
<li>The <abbr title="Exploit Prediction Scoring System">EPSS</abbr> data shows that signature detections do have patterns and are not entirely independent events. See <a href="https://www.cyentia.com/epss-study/">detailed analysis of exploitation patterns over time</a></li>
2230+
<li>The <abbr title="Exploit Prediction Scoring System">EPSS</abbr> data shows that signature detections do have patterns and are not entirely independent events. See <a href="https://www.cyentia.com/epss-study/">detailed analysis of exploitation patterns over time</a>.</li>
22252231
<li>Attacks driven by people have patterns e.g., a persistent threat, periodic probing of targets</li>
22262232
</ul>
22272233
<h3 id="epss-scores-as-lower-bounds-rationale"><abbr title="Exploit Prediction Scoring System">EPSS</abbr> Scores as Lower Bounds Rationale<a class="headerlink" href="#epss-scores-as-lower-bounds-rationale" title="Permanent link">&para;</a></h3>
22282234
<div class="admonition warning">
22292235
<p class="admonition-title"><strong>Rationale is lacking for <abbr title="Exploit Prediction Scoring System">EPSS</abbr> Scores as Lower Bounds</strong></p>
22302236
<p>"While <abbr title="Exploit Prediction Scoring System">EPSS</abbr> scores assume that a vulnerability has not been observed to be exploited in the past".</p>
2231-
<p>The <abbr title="Exploit Prediction Scoring System">EPSS</abbr> model or score is not making this assumption.</p>
2232-
<p>This is not the same as the <abbr title="Exploit Prediction Scoring System">EPSS</abbr> model not using past exploitation data directly to feed the model.</p>
2237+
<ul>
2238+
<li>The <abbr title="Exploit Prediction Scoring System">EPSS</abbr> model or score is not making this assumption.</li>
2239+
<li>This is not the same as the <abbr title="Exploit Prediction Scoring System">EPSS</abbr> model not using past exploitation data directly to feed the model.</li>
2240+
</ul>
2241+
<p>The "<abbr title="Exploit Prediction Scoring System">EPSS</abbr> Scores as Lower Bounds" rationale from the NIST CSWP 41 paper basically says:
2242+
"If the <abbr title="Exploit Prediction Scoring System">EPSS</abbr> IDS data sees an actual attack attempt (so true positive in the validation data), the <abbr title="Exploit Prediction Scoring System">EPSS</abbr> score is not set to 1 for that day. So the <abbr title="Exploit Prediction Scoring System">EPSS</abbr> score on that day is an under-estimate."</p>
22332243
</div>
22342244
<h2 id="takeaways">Takeaways<a class="headerlink" href="#takeaways" title="Permanent link">&para;</a></h2>
22352245
<div class="admonition success">

‎print_page/index.html‎

Lines changed: 17 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -4608,8 +4608,8 @@ <h2 id="epss-lev-what-is-lev">What is LEV?<a class="headerlink" href="#epss-lev-
46084608
CSWP 41. <a href="https://doi.org/10.6028/NIST.CSWP.41">https://doi.org/10.6028/NIST.CSWP.41</a> </p>
46094609
<h2 id="epss-lev-why-lev-matters">Why LEV Matters<a class="headerlink" href="#epss-lev-why-lev-matters" title="Permanent link">&para;</a></h2>
46104610
<div class="admonition tip">
4611-
<p class="admonition-title"><strong>KEY INSIGHT: The Three-Dimensional View of Vulnerability <abbr title="The likelihood of a vulnerability being exploited and the potential impact of such an exploit on an organization.">Risk</abbr></strong></p>
4612-
<p>LEV fills a critical gap by looking backward in time, complementing forward-looking and current exploitation data:</p>
4611+
<p class="admonition-title"><strong>KEY INSIGHT: LEV gives an additional View of Vulnerability <abbr title="The likelihood of a vulnerability being exploited and the potential impact of such an exploit on an organization.">Risk</abbr></strong></p>
4612+
<p>LEV fills a gap by looking backward in time, complementing forward-looking and current exploitation data:</p>
46134613
<table>
46144614
<thead>
46154615
<tr>
@@ -4775,7 +4775,10 @@ <h3 id="epss-lev-misunderstanding-of-epss">Misunderstanding of <abbr title="Expl
47754775
<h3 id="epss-lev-lev2-approximation">LEV2 Approximation<a class="headerlink" href="#epss-lev-lev2-approximation" title="Permanent link">&para;</a></h3>
47764776
<div class="admonition warning">
47774777
<p class="admonition-title"><strong>Invalid Probability Division</strong></p>
4778-
<p>The "Small Probability" approximation is not valid for higher <abbr title="Exploit Prediction Scoring System">EPSS</abbr> scores (the scores of interest).</p>
4778+
<p>The "Small Probability" approximation is not valid for higher <abbr title="Exploit Prediction Scoring System">EPSS</abbr> scores (the scores of interest), and is not necessary if the computation is optimized per the <a href="https://github.com/RiskBasedPrioritization/LEV/">Source Code</a> provided here.</p>
4779+
<ul>
4780+
<li>Rigorous vs NIST approximation time ratio: 2.23x</li>
4781+
</ul>
47794782
</div>
47804783
<p>LEV handles <abbr title="Exploit Prediction Scoring System">EPSS</abbr> scores as covering only a single day by dividing them by 30: <span class="arithmatex">\(P_1 \approx P_{30}/30\)</span></p>
47814784
<p>Dividing a 30-day probability by 30 to get a 1-day probability generally <strong>does not make sense</strong> in a rigorous probabilistic context.</p>
@@ -4805,9 +4808,12 @@ <h3 id="epss-lev-lev2-approximation">LEV2 Approximation<a class="headerlink" hre
48054808
<div class="admonition tip">
48064809
<p class="admonition-title">Tip</p>
48074810
<p>Using standard concurrent processing per the source code, the approximation is not required on a standard computer.</p>
4811+
<p>The code to calculate LEV (both approximation and rigorous), and the composite probability (both approximation and rigorous) completes in less than 30 minutes on a standard computer. </p>
48084812
<ul>
4809-
<li>the code completes in minutes </li>
4813+
<li>The approximation calculations are not required but in the code for comparison.</li>
4814+
<li>See example log file: <a href="https://github.com/RiskBasedPrioritization/LEV/blob/main/logs/20250531_180156.log">https://github.com/RiskBasedPrioritization/LEV/blob/main/logs/20250531_180156.log</a></li>
48104815
</ul>
4816+
<p>Calculations for new days (new runs) can be very fast if the code is optimized to use existing calculations from previous runs (it isn't currently).</p>
48114817
</div>
48124818
<h3 id="epss-lev-independent-events-assumption">Independent Events Assumption<a class="headerlink" href="#epss-lev-independent-events-assumption" title="Permanent link">&para;</a></h3>
48134819
<div class="admonition warning">
@@ -4824,15 +4830,19 @@ <h3 id="epss-lev-independent-events-assumption">Independent Events Assumption<a
48244830
</ul>
48254831
<p>The <strong>Independent Events Assumption</strong> is not valid because:</p>
48264832
<ul>
4827-
<li>The <abbr title="Exploit Prediction Scoring System">EPSS</abbr> data shows that signature detections do have patterns and are not entirely independent events. See <a href="https://www.cyentia.com/epss-study/">detailed analysis of exploitation patterns over time</a></li>
4833+
<li>The <abbr title="Exploit Prediction Scoring System">EPSS</abbr> data shows that signature detections do have patterns and are not entirely independent events. See <a href="https://www.cyentia.com/epss-study/">detailed analysis of exploitation patterns over time</a>.</li>
48284834
<li>Attacks driven by people have patterns e.g., a persistent threat, periodic probing of targets</li>
48294835
</ul>
48304836
<h3 id="epss-lev-epss-scores-as-lower-bounds-rationale"><abbr title="Exploit Prediction Scoring System">EPSS</abbr> Scores as Lower Bounds Rationale<a class="headerlink" href="#epss-lev-epss-scores-as-lower-bounds-rationale" title="Permanent link">&para;</a></h3>
48314837
<div class="admonition warning">
48324838
<p class="admonition-title"><strong>Rationale is lacking for <abbr title="Exploit Prediction Scoring System">EPSS</abbr> Scores as Lower Bounds</strong></p>
48334839
<p>"While <abbr title="Exploit Prediction Scoring System">EPSS</abbr> scores assume that a vulnerability has not been observed to be exploited in the past".</p>
4834-
<p>The <abbr title="Exploit Prediction Scoring System">EPSS</abbr> model or score is not making this assumption.</p>
4835-
<p>This is not the same as the <abbr title="Exploit Prediction Scoring System">EPSS</abbr> model not using past exploitation data directly to feed the model.</p>
4840+
<ul>
4841+
<li>The <abbr title="Exploit Prediction Scoring System">EPSS</abbr> model or score is not making this assumption.</li>
4842+
<li>This is not the same as the <abbr title="Exploit Prediction Scoring System">EPSS</abbr> model not using past exploitation data directly to feed the model.</li>
4843+
</ul>
4844+
<p>The "<abbr title="Exploit Prediction Scoring System">EPSS</abbr> Scores as Lower Bounds" rationale from the NIST CSWP 41 paper basically says:
4845+
"If the <abbr title="Exploit Prediction Scoring System">EPSS</abbr> IDS data sees an actual attack attempt (so true positive in the validation data), the <abbr title="Exploit Prediction Scoring System">EPSS</abbr> score is not set to 1 for that day. So the <abbr title="Exploit Prediction Scoring System">EPSS</abbr> score on that day is an under-estimate."</p>
48364846
</div>
48374847
<h2 id="epss-lev-takeaways">Takeaways<a class="headerlink" href="#epss-lev-takeaways" title="Permanent link">&para;</a></h2>
48384848
<div class="admonition success">

‎search/search_index.json‎

Lines changed: 1 addition & 1 deletion
Large diffs are not rendered by default.

0 commit comments

Comments
 (0)