Skip to content

Commit ba47adb

Browse files
CrashedmindCrashedmind
committed
Deployed a9b7ccb with MkDocs version: 1.5.3
1 parent ce88888 commit ba47adb

File tree

4 files changed

+39
-39
lines changed

4 files changed

+39
-39
lines changed

‎epss/LEV/index.html‎

Lines changed: 19 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -2232,32 +2232,32 @@ <h3 id="lev2-approximation">LEV2 Approximation<a class="headerlink" href="#lev2-
22322232
</div>
22332233
<h3 id="independent-events-assumption">Independent Events Assumption<a class="headerlink" href="#independent-events-assumption" title="Permanent link">&para;</a></h3>
22342234
<div class="admonition warning">
2235-
<p class="admonition-title"><strong>Attacks Aren't Random</strong></p>
2236-
<p>The Independent Events Assumption is not valid.</p>
2235+
<p class="admonition-title"><strong>Caution: Independent Events Assumption introduces potential inaccuracies</strong></p>
2236+
<p>Assuming vulnerability exploitation events occur independently each day simplifies calculations but likely introduces inaccuracies, as real-world exploitation patterns are not random.</p>
22372237
</div>
2238-
<p><strong>Independent Events Assumption:</strong> If we assume the events (vulnerabilities being exploited) are independent day-to-day, then the probability of <em>not</em> being exploited over 30 days would be the product of the probabilities of <em>not</em> being exploited on each individual day.</p>
2238+
<p>Under this assumption:</p>
22392239
<ul>
2240-
<li>Let <span class="arithmatex">\(P_1\)</span> be the daily probability of exploitation</li>
2241-
<li>The probability of <em>not</em> being exploited on a given day is <span class="arithmatex">\((1 - P_1)\)</span></li>
2242-
<li>The probability of <em>not</em> being exploited over 30 days is <span class="arithmatex">\((1 - P_1)^{30}\)</span></li>
2243-
<li>Therefore, the probability of <em>being</em> exploited over 30 days is <span class="arithmatex">\(1 - (1 - P_1)^{30}\)</span></li>
2244-
<li>If you're given <span class="arithmatex">\(P_{30}\)</span> (the 30-day likelihood), you'd solve <span class="arithmatex">\(P_{30} = 1 - (1 - P_1)^{30}\)</span> for <span class="arithmatex">\(P_1\)</span>. This is a much more complex calculation than simple division</li>
2240+
<li>Daily probability of exploitation is denoted by <span class="arithmatex">\(P_1\)</span>.</li>
2241+
<li>Probability of not being exploited on any given day is <span class="arithmatex">\((1 - P_1)\)</span>.</li>
2242+
<li>Probability of not being exploited over 30 days is <span class="arithmatex">\((1 - P_1)^{30}\)</span>.</li>
2243+
<li>Thus, probability of being exploited within 30 days is <span class="arithmatex">\(1 - (1 - P_1)^{30}\)</span>.</li>
2244+
<li>Given the 30-day exploitation likelihood <span class="arithmatex">\(P_{30}\)</span>, the daily probability <span class="arithmatex">\(P_1\)</span> is calculated by solving: <span class="arithmatex">\(P_{30} = 1 - (1 - P_1)^{30}\)</span>.</li>
22452245
</ul>
2246-
<p>The <strong>Independent Events Assumption</strong> is not valid because:</p>
2246+
<p>However, the Independent Events Assumption is problematic because:</p>
22472247
<ul>
2248-
<li>The <abbr title="Exploit Prediction Scoring System">EPSS</abbr> data shows that signature detections do have patterns and are not entirely independent events. See <a href="https://www.cyentia.com/epss-study/">detailed analysis of exploitation patterns over time</a>.</li>
2249-
<li>Attacks driven by people have patterns e.g., a persistent threat, periodic probing of targets</li>
2248+
<li>Actual exploitation events display patterns and dependencies, not random occurrences, as shown in <abbr title="Exploit Prediction Scoring System">EPSS</abbr> exploitation analyses.</li>
2249+
<li>Human-driven attacks often follow discernible patterns, such as persistent threats or periodic target probing, further invalidating independence.</li>
22502250
</ul>
2251+
<div class="admonition quote">
2252+
<p class="admonition-title">Quote</p>
2253+
<p>Probability error – the LEV equation (10) makes some mistake or invalid assumption. For example, since (10) takes in multiple scores per probability calculation, it could amplify small dependent errors if the equation incorrectly assumes independence. </p>
2254+
<p>Page 20 <a href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.41.pdf">NIST CSWP 41: "Likely Exploited Vulnerabilities: A Proposed Metric for Vulnerability Exploitation Probability"</a></p>
2255+
</div>
22512256
<h3 id="epss-scores-as-lower-bounds-rationale"><abbr title="Exploit Prediction Scoring System">EPSS</abbr> Scores as Lower Bounds Rationale<a class="headerlink" href="#epss-scores-as-lower-bounds-rationale" title="Permanent link">&para;</a></h3>
22522257
<div class="admonition warning">
2253-
<p class="admonition-title"><strong>Rationale is lacking for <abbr title="Exploit Prediction Scoring System">EPSS</abbr> Scores as Lower Bounds</strong></p>
2254-
<p>"While <abbr title="Exploit Prediction Scoring System">EPSS</abbr> scores assume that a vulnerability has not been observed to be exploited in the past".</p>
2255-
<ul>
2256-
<li>The <abbr title="Exploit Prediction Scoring System">EPSS</abbr> model or score is not making this assumption.</li>
2257-
<li>This is not the same as the <abbr title="Exploit Prediction Scoring System">EPSS</abbr> model not using past exploitation data directly to feed the model.</li>
2258-
</ul>
2259-
<p>The "<abbr title="Exploit Prediction Scoring System">EPSS</abbr> Scores as Lower Bounds" rationale from the NIST CSWP 41 paper basically says:
2260-
"If the <abbr title="Exploit Prediction Scoring System">EPSS</abbr> IDS data sees an actual attack attempt (so true positive in the validation data), the <abbr title="Exploit Prediction Scoring System">EPSS</abbr> score is not set to 1 for that day. So the <abbr title="Exploit Prediction Scoring System">EPSS</abbr> score on that day is an under-estimate."</p>
2258+
<p class="admonition-title"><strong>Rationale for <abbr title="Exploit Prediction Scoring System">EPSS</abbr> Scores as Lower Bounds</strong></p>
2259+
<p>The "<abbr title="Exploit Prediction Scoring System">EPSS</abbr> Scores as Lower Bounds" rationale from the NIST CSWP 41 paper is basically saying:</p>
2260+
<p><em>"If the <abbr title="Exploit Prediction Scoring System">EPSS</abbr> IDS data sees an actual attack attempt (so true positive in the validation data), the <abbr title="Exploit Prediction Scoring System">EPSS</abbr> score is not set to 1 for that day. So the <abbr title="Exploit Prediction Scoring System">EPSS</abbr> score on that day is an under-estimate."</em></p>
22612261
</div>
22622262
<h2 id="takeaways">Takeaways<a class="headerlink" href="#takeaways" title="Permanent link">&para;</a></h2>
22632263
<div class="admonition success">

‎print_page/index.html‎

Lines changed: 19 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -4835,32 +4835,32 @@ <h3 id="epss-lev-lev2-approximation">LEV2 Approximation<a class="headerlink" hre
48354835
</div>
48364836
<h3 id="epss-lev-independent-events-assumption">Independent Events Assumption<a class="headerlink" href="#epss-lev-independent-events-assumption" title="Permanent link">&para;</a></h3>
48374837
<div class="admonition warning">
4838-
<p class="admonition-title"><strong>Attacks Aren't Random</strong></p>
4839-
<p>The Independent Events Assumption is not valid.</p>
4838+
<p class="admonition-title"><strong>Caution: Independent Events Assumption introduces potential inaccuracies</strong></p>
4839+
<p>Assuming vulnerability exploitation events occur independently each day simplifies calculations but likely introduces inaccuracies, as real-world exploitation patterns are not random.</p>
48404840
</div>
4841-
<p><strong>Independent Events Assumption:</strong> If we assume the events (vulnerabilities being exploited) are independent day-to-day, then the probability of <em>not</em> being exploited over 30 days would be the product of the probabilities of <em>not</em> being exploited on each individual day.</p>
4841+
<p>Under this assumption:</p>
48424842
<ul>
4843-
<li>Let <span class="arithmatex">\(P_1\)</span> be the daily probability of exploitation</li>
4844-
<li>The probability of <em>not</em> being exploited on a given day is <span class="arithmatex">\((1 - P_1)\)</span></li>
4845-
<li>The probability of <em>not</em> being exploited over 30 days is <span class="arithmatex">\((1 - P_1)^{30}\)</span></li>
4846-
<li>Therefore, the probability of <em>being</em> exploited over 30 days is <span class="arithmatex">\(1 - (1 - P_1)^{30}\)</span></li>
4847-
<li>If you're given <span class="arithmatex">\(P_{30}\)</span> (the 30-day likelihood), you'd solve <span class="arithmatex">\(P_{30} = 1 - (1 - P_1)^{30}\)</span> for <span class="arithmatex">\(P_1\)</span>. This is a much more complex calculation than simple division</li>
4843+
<li>Daily probability of exploitation is denoted by <span class="arithmatex">\(P_1\)</span>.</li>
4844+
<li>Probability of not being exploited on any given day is <span class="arithmatex">\((1 - P_1)\)</span>.</li>
4845+
<li>Probability of not being exploited over 30 days is <span class="arithmatex">\((1 - P_1)^{30}\)</span>.</li>
4846+
<li>Thus, probability of being exploited within 30 days is <span class="arithmatex">\(1 - (1 - P_1)^{30}\)</span>.</li>
4847+
<li>Given the 30-day exploitation likelihood <span class="arithmatex">\(P_{30}\)</span>, the daily probability <span class="arithmatex">\(P_1\)</span> is calculated by solving: <span class="arithmatex">\(P_{30} = 1 - (1 - P_1)^{30}\)</span>.</li>
48484848
</ul>
4849-
<p>The <strong>Independent Events Assumption</strong> is not valid because:</p>
4849+
<p>However, the Independent Events Assumption is problematic because:</p>
48504850
<ul>
4851-
<li>The <abbr title="Exploit Prediction Scoring System">EPSS</abbr> data shows that signature detections do have patterns and are not entirely independent events. See <a href="https://www.cyentia.com/epss-study/">detailed analysis of exploitation patterns over time</a>.</li>
4852-
<li>Attacks driven by people have patterns e.g., a persistent threat, periodic probing of targets</li>
4851+
<li>Actual exploitation events display patterns and dependencies, not random occurrences, as shown in <abbr title="Exploit Prediction Scoring System">EPSS</abbr> exploitation analyses.</li>
4852+
<li>Human-driven attacks often follow discernible patterns, such as persistent threats or periodic target probing, further invalidating independence.</li>
48534853
</ul>
4854+
<div class="admonition quote">
4855+
<p class="admonition-title">Quote</p>
4856+
<p>Probability error – the LEV equation (10) makes some mistake or invalid assumption. For example, since (10) takes in multiple scores per probability calculation, it could amplify small dependent errors if the equation incorrectly assumes independence. </p>
4857+
<p>Page 20 <a href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.41.pdf">NIST CSWP 41: "Likely Exploited Vulnerabilities: A Proposed Metric for Vulnerability Exploitation Probability"</a></p>
4858+
</div>
48544859
<h3 id="epss-lev-epss-scores-as-lower-bounds-rationale"><abbr title="Exploit Prediction Scoring System">EPSS</abbr> Scores as Lower Bounds Rationale<a class="headerlink" href="#epss-lev-epss-scores-as-lower-bounds-rationale" title="Permanent link">&para;</a></h3>
48554860
<div class="admonition warning">
4856-
<p class="admonition-title"><strong>Rationale is lacking for <abbr title="Exploit Prediction Scoring System">EPSS</abbr> Scores as Lower Bounds</strong></p>
4857-
<p>"While <abbr title="Exploit Prediction Scoring System">EPSS</abbr> scores assume that a vulnerability has not been observed to be exploited in the past".</p>
4858-
<ul>
4859-
<li>The <abbr title="Exploit Prediction Scoring System">EPSS</abbr> model or score is not making this assumption.</li>
4860-
<li>This is not the same as the <abbr title="Exploit Prediction Scoring System">EPSS</abbr> model not using past exploitation data directly to feed the model.</li>
4861-
</ul>
4862-
<p>The "<abbr title="Exploit Prediction Scoring System">EPSS</abbr> Scores as Lower Bounds" rationale from the NIST CSWP 41 paper basically says:
4863-
"If the <abbr title="Exploit Prediction Scoring System">EPSS</abbr> IDS data sees an actual attack attempt (so true positive in the validation data), the <abbr title="Exploit Prediction Scoring System">EPSS</abbr> score is not set to 1 for that day. So the <abbr title="Exploit Prediction Scoring System">EPSS</abbr> score on that day is an under-estimate."</p>
4861+
<p class="admonition-title"><strong>Rationale for <abbr title="Exploit Prediction Scoring System">EPSS</abbr> Scores as Lower Bounds</strong></p>
4862+
<p>The "<abbr title="Exploit Prediction Scoring System">EPSS</abbr> Scores as Lower Bounds" rationale from the NIST CSWP 41 paper is basically saying:</p>
4863+
<p><em>"If the <abbr title="Exploit Prediction Scoring System">EPSS</abbr> IDS data sees an actual attack attempt (so true positive in the validation data), the <abbr title="Exploit Prediction Scoring System">EPSS</abbr> score is not set to 1 for that day. So the <abbr title="Exploit Prediction Scoring System">EPSS</abbr> score on that day is an under-estimate."</em></p>
48644864
</div>
48654865
<h2 id="epss-lev-takeaways">Takeaways<a class="headerlink" href="#epss-lev-takeaways" title="Permanent link">&para;</a></h2>
48664866
<div class="admonition success">

‎search/search_index.json‎

Lines changed: 1 addition & 1 deletion
Large diffs are not rendered by default.

‎sitemap.xml.gz‎

0 Bytes
Binary file not shown.

0 commit comments

Comments
 (0)