Küberturvalisuse suundumuste prognoosimismudel
Abstract
Haavatavuste avalikustamise aegridasid on varem kasutatud mõnede väärtuste prognoosimiseks tulevikus. Kirjanduse ülevaatest selgus, et teadlased pole varem keskendunud CWE (Common Weakness Enumeration) haavatavustüüpide keskmise CVSS (Common Vulnerability Scoring System) tõsidusskoori prognoosimisele. Tarkvara riskijuhtimise analüütikute jaoks võib see olla probleem, sest haavatavuskategooriate tulevaste tõsidusskooride mitteteadmisega võivad kaasneda vähem täpsed riskitasemehinnangud. Käesoleva magistritöö raames valmib programmeerimiskeeles R loodud pakett, mis lahendab selle probleemi. Loodud rakendust kasutatakse lõpuks 2018. aasta kuukeskmiste CVSS skooride prognoosimiseks. MAE, RMSE, MAPE ja MASE arvutatakse välja 2016. ja 2017. aasta prognooside täpsuse hindamiseks, mis aitab eri mudelite vahel valida. 2018. aasta prognooside genereerimisel 34 CWE-le kaalutakse 13 tüüpi mudeleid. Punktprognooside põhjal on 2018. aastal kümne CWE tõsidusaste "Kõrge".
Vulnerability disclosure time series data have been previously used to estimate some values in the future. A literature review revealed that researchers have not focused on forecasting the mean Common Vulnerability Scoring System (CVSS) severity scores of Common Weakness Enumeration (CWE) vulnerability types. This could be a problem for software risk management analysts because not knowing the vulnerability categories' upcoming severity scores could result in less accurate risk level assessments. This thesis project provides an R package that addresses the problem. It is eventually used to forecast mean monthly CVSS scores of the year 2018. MAE, RMSE, MAPE and MASE are used to evaluate the accuracy of the forecasts for the years 2016 and 2017. These measures help to choose between the models. Thirteen different types of models are considered when generating the forecasts of 2018 for a subset of 34 CWEs. According to point forecasts, ten CWEs are expected to have "High" severity in 2018.
Vulnerability disclosure time series data have been previously used to estimate some values in the future. A literature review revealed that researchers have not focused on forecasting the mean Common Vulnerability Scoring System (CVSS) severity scores of Common Weakness Enumeration (CWE) vulnerability types. This could be a problem for software risk management analysts because not knowing the vulnerability categories' upcoming severity scores could result in less accurate risk level assessments. This thesis project provides an R package that addresses the problem. It is eventually used to forecast mean monthly CVSS scores of the year 2018. MAE, RMSE, MAPE and MASE are used to evaluate the accuracy of the forecasts for the years 2016 and 2017. These measures help to choose between the models. Thirteen different types of models are considered when generating the forecasts of 2018 for a subset of 34 CWEs. According to point forecasts, ten CWEs are expected to have "High" severity in 2018.