论文标题
脆弱性预测：理论和实践中
Vulnerability Forecasting: In theory and practice
论文作者
论文摘要
当您可以提前预测时，为什么要等待零日？可以提前一年预测NVD中发布的CVE量。这可以在实际值的3％之内完成，并且不同的预测算法在不同的LookAhead值下表现良好。还可以估计属于特定供应商，软件，CVSS分数或脆弱性类型的全伏特伦的比例。通过减少这种不确定性，战略补丁管理应该变得容易得多。
Why wait for zero-days when you could predict them in advance? It is possible to predict the volume of CVEs released in the NVD as much as a year in advance. This can be done within 3 percent of the actual value, and different predictive algorithms perform well at different lookahead values. It is also possible to estimate the proportions of that total volumn belonging to specific vendors, software, CVSS scores, or vulnerability types. Strategic patch management should become much easier, with this uncertainty reduction.
