Jump to content

Draft:Exploit Prediction Scoring System

From Wikipedia, the free encyclopedia
  • Comment: This isn't sourced well enough for me to accept, and it potentially contains content too closely paraphrased to its own website, which features an all rights reserved copyright notice. SportingFlyer T·C 02:25, 20 May 2025 (UTC)

Exploit Prediction Scoring System (EPSS) is an open, data-driven risk metric that estimates the probability a publicly disclosed software vulnerability will be exploited in the wild within the next 30 days.[1] Managed by the Forum of Incident Response and Security Teams (FIRST), EPSS complements the severity-focused Common Vulnerability Scoring System (CVSS) by prioritizing vulnerabilities according to real-world exploitation likelihood.[1]

Overview

[edit]

EPSS produces a numerical probability between 0 and 1 (expressed as 0–100%) for every Common Vulnerabilities and Exposures (CVE) identifier listed in the National Vulnerability Database (NVD).[2] A higher score indicates a greater chance that the vulnerability will be targeted by threat actors during the next month.[2] Scores are recalculated and published daily as a downloadable data set and through an API.[2]

Mission

[edit]

The Exploit Prediction Scoring System (EPSS) aims to help network defenders prioritize remediation by estimating the likelihood that a software vulnerability will be exploited.[3] It uses current threat information from CVE and real-world exploit data to produce a probability score between 0 and 1 (0–100%).[3] The higher the score, the greater the probability of exploitation.[3] Machine learning enhances its predictive accuracy.[4]

Updates to EPSS

[edit]
  • Version 4 (current) – released 17 March 2025.[1]
  • Version 3 – released 7 March 2023.[5]
  • Major update – 4 February 2022.[6]
  • First public scores – 7 January 2021.[7]
  • EPSS SIG formed at FIRST – April 2020.[8]
  • Original EPSS model presented at Black Hat – 2019.[8]

Goals and deliverables

[edit]

EPSS publishes scores for all CVEs in a public state.[2] The EPSS-SIG aims to improve data collection and analysis for near-real-time assessments of publicly disclosed vulnerabilities.[9] This involves partnerships with data providers and infrastructure for a publicly accessible interface.[3] Multiple datasets, including intrusion-detection systems, honeypots, and malware analysis, are ingested to identify exploitation instances.[3]

History

[edit]
  • Black Hat 2019 – The original concept and prototype were presented by researchers Michael Roytman, Jay Jacobs, and Sasha Romanosky.[8]
  • April 2020 – FIRST chartered the EPSS Special Interest Group (SIG) to develop the model collaboratively.[9]
  • 7 January 2021 – Public publication of daily EPSS scores began (model v1).[7]
  • 4 February 2022 – Version 2 incorporated additional telemetry sources and algorithmic improvements.[6]
  • 7 March 2023 – Version 3 introduced gradient-boosted decision trees and expanded feature sets.[5]
  • 17 March 2025 – Version 4 added contextual threat-intelligence feeds and performance gains.[1]

Methodology

[edit]

EPSS employs supervised machine-learning, currently using gradient-boosted trees, trained on historical exploitation events.[3] Predictive features include:

  • CVSS base metrics (attack vector, privileges required, etc.).[3]
  • Availability of exploit code in public repositories or exploit kits.[3]
  • Mentions in security advisories and social-media telemetry.[3]
  • Presence of the CVE in malware campaigns or botnet traffic.[3]

The model is retrained periodically to incorporate new data sources and adversary behavior.[3] Performance is measured using area under the precision-recall curve (AUPRC) against confirmed exploitation incidents.[3]

Output interpretation

[edit]

EPSS scores are decile-ranked: the top 1% of scores historically accounts for roughly 80% of observed exploitation activity.[2] FIRST recommends prioritizing remediation for CVEs above the 0.5 probability threshold, though organizations may choose bespoke cut-offs based on risk appetite.[2]

Adoption and usage

[edit]

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) encourages using EPSS alongside its Known Exploited Vulnerabilities Catalog for patch triage.[10] Major vulnerability-management platforms, such as Rapid7, Tenable, and Qualys, integrate EPSS scores for risk-based patching.[8] Academic research uses EPSS to model exploit trends and evaluate defenses.[11]

Comparison with other scoring systems

[edit]

While CVSS quantifies technical severity, EPSS predicts exploitation likelihood.[3] Combining both aligns remediation with actual threat activity.[12]

See also

[edit]
[edit]

Official website

References

[edit]
  1. ^ a b c d "EPSS Version 4 Released". FIRST. 17 March 2025. Retrieved 14 April 2025.
  2. ^ a b c d e f "EPSS Data Statistics". FIRST. Retrieved 14 April 2025.
  3. ^ a b c d e f g h i j k l m "How the EPSS Scoring System Works". Orca Security Blog. 15 February 2023. Retrieved 14 April 2025.
  4. ^ "Machine Learning Improves Prediction of Exploited Vulnerabilities". Dark Reading. 7 March 2023. Retrieved 14 April 2025.
  5. ^ a b "Understanding and Using the EPSS Scoring System". FOSSA Blog. 20 January 2023. Retrieved 14 April 2025.
  6. ^ a b "Understanding and Using the EPSS Scoring System". FOSSA Blog. 20 January 2023. Retrieved 14 April 2025.
  7. ^ a b "Understanding and Using the EPSS Scoring System". FOSSA Blog. 20 January 2023. Retrieved 14 April 2025.
  8. ^ a b c d "What Is an EPSS Score?". Brinqa. 10 February 2024. Retrieved 14 April 2025.
  9. ^ a b "EPSS Special Interest Group Portal". FIRST. Retrieved 14 April 2025.
  10. ^ Parla, Rianna (4 November 2024). "Efficacy of EPSS in High Severity CVEs Found in CISA KEV". arXiv:2411.02618 [cs.CR].
  11. ^ Mell, Peter; Bojanova, Irena; Galhardo, Carlos (1 May 2024). "Measuring the Exploitation of Weaknesses in the Wild". arXiv:2405.01289 [cs.CR].
  12. ^ Jiang, Yuning; Oo, Nay; Meng, Qiaoran; Hoon Wei Lim; Sikdar, Biplab (12 February 2025). "A Survey on Vulnerability Prioritization: Taxonomy, Metrics, and Challenges". arXiv:2502.11070 [cs.CR].

[1]

[2]

[3]

[4]

[5]

  1. ^ "Machine Learning Improves Prediction of Exploited Vulnerabilities". Dark Reading. 7 March 2023. Retrieved 14 April 2025.
  2. ^ "EPSS Integration Expands Across Vulnerability-Management Vendors". Dark Reading. 2 April 2025. Retrieved 14 April 2025.
  3. ^ A Visual Exploration of Exploits in the Wild (Report). Cyentia Institute. 2024. Retrieved 14 April 2025.
  4. ^ "Healthcare and Public Health Sector Vulnerability Mitigation Guide" (PDF). Cybersecurity and Infrastructure Security Agency. 2023. Retrieved 14 April 2025.
  5. ^ 2024 Data Breach Investigations Report (PDF) (Report). Verizon. 2024. Retrieved 14 April 2025.
Retrieved from "https://en.wikipedia.org/w/index.php?title=Draft:Exploit_Prediction_Scoring_System&oldid=1291258066"