Measuring the Exploitation of Weaknesses in the Wild
<|reference_start|>Measuring the Exploitation of Weaknesses in the Wild: Identifying the software weaknesses exploited by attacks supports efforts to reduce developer introduction of vulnerabilities and to guide security code review efforts. A weakness is a bug or fault type that can be exploited through an operation that results in a security-relevant error. Ideally, the security community would measure the prevalence of the software weaknesses used in actual exploitation. This work advances that goal by introducing a simple metric that utilizes public data feeds to determine the probability of a weakness being exploited in the wild for any 30-day window. The metric is evaluated on a set of 130 weaknesses that were commonly found in vulnerabilities between April 2021 and March 2024. Our analysis reveals that 92 % of the weaknesses are not being constantly exploited.<|reference_end|>
@article{mell2024measuring,
    title={Measuring the Exploitation of Weaknesses in the Wild},
    author={Peter Mell, Irena Bojanova, Carlos Galhardo},
    journal={arXiv preprint arXiv:2405.01289},
    year={2024},
    archivePrefix={arXiv},
    eprint={2405.01289},
    primaryClass={cs.CR}
}