漏洞预判：从评分系统内部提取风险信号.pdf

1、#BHUSA BlackHatEventsVulnerability HaruspicyVulnerability HaruspicyPicking Out Risk Signals from Scoring System EntrailsPicking Out Risk Signals from Scoring System EntrailsTod Beardsley,runZero VP of Security Research and CVE Mucker-Abouter#BHUSA BlackHatEventsSSVC:SSVC:Tarot for your Tarot for you

2、r criticalitycriticalityThe decidedly un-mathy Stakeholder-Specific Vulnerability Categorization decision treeOracular Methods for Quantifying RiskOracular Methods for Quantifying RiskHaruspicy:Haruspicy:What is it What is it anyway?anyway?A brief jaunt into deriving signals from entrails,specifical

3、ly,sheep liversCW:MeatCVSS:CVSS:Casting fractal Casting fractal shadowsshadowsThe oldest current system,the Common Vulnerability Scoring SystemEPSS:EPSS:ML-based ML-based magicksmagicksA relative newcomer,the Exploit Prediction Scoring SystemCW:AI#BHUSA BlackHatEventsImage source:https:/www.queens.o

4、x.ac.uk/news/reading-the-past-ancient-liver-divination/Haruspicy was favored by the Etruscans,and also used by Assyrians,Babylonians,and other early Mediterranean and African cultures.Haruspicy:A Brief PrimerHaruspicy:A Brief PrimerThe gods would reveal their will through omens,manifested in the ent

5、rails of sacrificial animals particularly the liver.References on thousands of favorable and unfavorable omens were maintained by practitioners.Balancing these omens gets you an answer to your specific question.Take random signals,and assert that theyre not random.The original P-Hackers!#BHUSA Black

6、HatEventsThe Common Vulnerability Scoring System has emerged as a bedrock of risk ratings and vulnerability scoring.CVSS:The Only Number Anyone Cares About CVSS:The Only Number Anyone Cares About Eight vectors are commonly used,describing various aspects of the vulnerability.You dont strictly need C