Automatic CVSS-Based Vulnerability Prioritization and Response with Context Information and Machine Learning

In the context of vulnerability management for data communication networks, determining which vulnerabilities to address first is of paramount importance. While identifying vulnerabilities using network scanners is relatively straightforward, efficiently prioritizing them for mitigation remains a significant challenge. Previously, our team developed a machine learning-based converter to translate CVSS v2.0 base scores into CVSS v3.x base scores, specifically to enable the use of the CVSS v3.x environmental score. The central question of this research is whether leveraging these converter-enabled CVSS v3.x environmental scores leads to a measurably improved vulnerability prioritization process compared to traditional methods, often reliant solely on CVSS v2.0 base scores. The environmental score potentially offers a more refined, context-specific perspective on vulnerability impact within specific systems. To evaluate this approach, we will test the converter’s performance in real-world environments and assess its impact on network administrator decision-making and workflows. Performance improvement will be measured by analyzing changes in mitigation times, potential threat exposure reduction, and overall vulnerability management efficiency. The ultimate goal is to determine if the proposed machine learning based methodology delivers practical benefits, enhancing organizational security through more accurate and effective vulnerability prioritization.Experimental results demonstrate that CVSS v3.x environmental scoring resolves critical v2.0 imprecision issues, enabling more accurate vulnerability prioritization. Our approach achieves measurable efficiency gains, reducing estimated remediation work hours by up to 8% compared to CVSS v2.0 methods. The study confirms that the proposed methodology delivers practical benefits, enhancing organizational security through more accurate and effective vulnerability prioritization.