Skip to main content
U.S. flag

An official website of the United States government

Official websites use .gov
A .gov website belongs to an official government organization in the United States.

Secure .gov websites use HTTPS
A lock ( ) or https:// means you’ve safely connected to the .gov website. Share sensitive information only on official, secure websites.

A Historical and Statistical Study of the Software Vulnerability Landscape

Published

Author(s)

Assane Gueye, Peter Mell

Abstract

Understanding the landscape of software vulnerabilities is key for developing effective security solutions. Fortunately, the evaluation of vulnerability databases that use a framework for communicating vulnerability attributes and their severity scores, such as the Common Vulnerability Scoring System (CVSS), can help shed light on the nature of publicly published vulnerabilities. In this paper, we characterize the software vulnerability landscape by performing a historical and statistical analysis of CVSS vulnerability metrics over the period of 2005-2019 through using data from the National Vulnerability Database. Each vulnerability is assigned a CVSS vector that aggregates a set of vulnerability metrics. We use these metrics to conduct four studies analyzing the following: the distribution of CVSS scores (both empirical and theoretical), the distribution of CVSS metric values and how vulnerability characteristics change over time, the relative rankings of the most frequent metric value over time, and the most prevalent patterns of co-occurrence of the metrics. Our resulting analysis shows that the vulnerability threat landscape has been dominated by only a few vulnerability types and has changed little during the time period of the study. For example, the overwhelming majority of vulnerabilities are exploitable over the network. The complexity to successfully exploit these vulnerabilities is dominantly low; very little authentication to the target victim is necessary for a successful attack. And most of the flaws require very limited interaction with users. However on the positive side, the damage of these vulnerabilities is mostly confined within the security scope of the impacted components.
Proceedings Title
The Seventh International Conference on Advances and Trends in Software Engineering (SOFTENG 2021)
Conference Dates
April 18-22, 2021
Conference Location
Porto,

Keywords

Vulnerabilities, Statistics

Citation

Gueye, A. and Mell, P. (2021), A Historical and Statistical Study of the Software Vulnerability Landscape, The Seventh International Conference on Advances and Trends in Software Engineering (SOFTENG 2021), Porto, , [online], https://tsapps.nist.gov/publication/get_pdf.cfm?pub_id=929964 (Accessed September 17, 2021)
Created April 18, 2021, Updated June 16, 2021