JJ Gillis Personal Research

Article: Measuring the Exploitation of Weaknesses in the Wild by [Coelho da Silva, Gabriel de Jesus ]

What does the paper present? The paper presents a new metric for measuring the chance that a CWE will get exploited within 30 days in the wild. This new metric is called PECWE and it takes in a CVE and a date and outputs a percentage chance of it being exploited.

What is the problem that it is addressing? The problem that it is addressing is the lack of measurement for exploitation of a CWE in the wild within 30 days of a date.

Who is the audience? The security community is the main audience because awareness of this is important to be able to craft solutions that are secure and fight against these weaknesses.

What is the finding? The finding is a complementary equation to something like CVE frequency. Although CVE frequency can indicate exploitation, it doesn't necessarily mean that it is being taken advantage of. However, PECWE and CVE frequency are highly correlated.

Synthesis: PECWE can be used as the metric for mapping coding errors to weakness taxonomies.