Abstract: Procedures to identify the probabilities for different states in a vulnerability life cycle are described. The probabilities are used to develop a number of statistical models to evaluate the risk factor of a particular vulnerability at time “t”. A transition probability matrix of all states of a particular vulnerability as a function of time is also described. A Markov chain process can be iterated to reach a steady state of the transition probability matrix, with the initial probabilities reaching the absorbing states, including exploited and patched states. A risk factor is also introduced for use as an index of the risk of a vulnerability being exploited. Finally, statistical models that can calculate the risk factor more conveniently without going through the Markovian process are described.

Abstract: A statistical model for predicting an expected path length (“EPL”) of the steps of an attacker is described. The model is based on utilizing vulnerability information along with an attack graph. Using the model, it is possible to identify the interaction among vulnerabilities and individual variables or risk factors that drive the EPL. Gaining a better understanding of the relationship between the vulnerabilities and their interactions can provide security administrators with a better view and understanding of their security status. In addition, a number of different attributable variables and their contribution in estimating the EPL can be ranked. Thus, it is possible to utilize the ranking process to take precautions and actions to minimize the EPL.

Abstract: According to the embodiments, a statistical model is developed to estimate the probability of being in a certain stage of a particular vulnerability in its life cycle. The methodology with the application of Markov chain theory gives the basis for calculating estimates for probabilities for different stages of a life cycle of the vulnerability considered. Using the developed method, it is possible to evaluate the risk level of a particular vulnerability at a certain time. These developments allow an advantage in taking measures to avoid exploitations and introduce patches for the vulnerability before an attacker takes the advantage of that particular vulnerability.