title: ÐÑÐ¸Ð¾ÑÐ¸ÑÐ¸Ð·Ð°ÑÐ¸Ñ ÑÑÑÑÐ°Ð½ÐµÐ½Ð¸Ñ ÑÑÐ·Ð²Ð¸Ð¼Ð¾ÑÑÐµÐ¹ Ð½Ð° Ð¾ÑÐ½Ð¾Ð²Ðµ Ð°Ð½Ð°Ð»Ð¸Ð·Ð° Ð¿ÑÐ¾Ð³Ð½Ð¾Ð·Ð¸ÑÑÐµÐ¼Ð¾Ð¹ ÑÐºÑÐ¿Ð»ÑÐ°ÑÐ¸ÑÑÐµÐ¼Ð¾ÑÑÐ¸
title: Ð²ÑÐ¿ÑÑÐºÐ½Ð°Ñ ÐºÐ²Ð°Ð»Ð¸ÑÐ¸ÐºÐ°ÑÐ¸Ð¾Ð½Ð½Ð°Ñ ÑÐ°Ð±Ð¾ÑÐ° ÑÐ¿ÐµÑÐ¸Ð°Ð»Ð¸ÑÑÐ°
titleType: Subtitle
title: Prioritization of vulnerability remediation based on predictive exploitability analysis
Creators: name: Ð¯ÑÐ¸Ð½ÑÐºÐ¸Ð¹, ÐÐ°Ð½Ð¸Ð¸Ð»
Publisher: name: Ð¡Ð°Ð½ÐºÑ-ÐÐµÑÐµÑÐ±ÑÑÐ³ÑÐºÐ¸Ð¹ Ð¿Ð¾Ð»Ð¸ÑÐµÑÐ½Ð¸ÑÐµÑÐºÐ¸Ð¹ ÑÐ½Ð¸Ð²ÐµÑÑÐ¸ÑÐµÑ ÐÐµÑÑÐ° ÐÐµÐ»Ð¸ÐºÐ¾Ð³Ð¾
Year: 2025
Subjects: ÑÐ¿ÑÐ°Ð²Ð»ÐµÐ½Ð¸Ðµ ÑÑÐ·Ð²Ð¸Ð¼Ð¾ÑÑÑÐ¼Ð¸
Ð¿ÑÐ¸Ð¾ÑÐ¸ÑÐ¸Ð·Ð°ÑÐ¸Ñ ÑÑÐ·Ð²Ð¸Ð¼Ð¾ÑÑÐµÐ¹
Ð°Ð½Ð°Ð»Ð¸Ð· Ð·Ð°ÑÐ¸ÑÐµÐ½Ð½Ð¾ÑÑÐ¸
Ð¿ÑÐ¾Ð³Ð½Ð¾Ð·Ð¸ÑÑÐµÐ¼Ð°Ñ ÑÐºÑÐ¿Ð»ÑÐ°ÑÐ¸ÑÑÐµÐ¼Ð¾ÑÑÑ
epss
cvss
vulnerability management
vulnerability prioritization
security analysis
predictive exploitability

description: Ð¦ÐµÐ»ÑÑ ÑÐ°Ð±Ð¾ÑÑ ÑÐ²Ð»ÑÐµÑÑÑ Ð²ÑÑÐ²Ð»ÐµÐ½Ð¸Ðµ Ð¸ Ð¿ÑÐ¸Ð¾ÑÐ¸ÑÐ¸Ð·Ð°ÑÐ¸Ñ Ð¸ÑÐ¿ÑÐ°Ð²Ð»ÐµÐ½Ð¸Ñ ÑÑÐ·Ð²Ð¸Ð¼Ð¾ÑÑÐµÐ¹ Ð½Ð° ÑÐ·Ð»Ð°Ñ Ð½Ð° Ð¾ÑÐ½Ð¾Ð²Ðµ Ð°Ð½Ð°Ð»Ð¸Ð·Ð° Ð¸Ñ Ð¿ÑÐ¾Ð³Ð½Ð¾Ð·Ð¸ÑÑÐµÐ¼Ð¾Ð¹ ÑÐºÑÐ¿Ð»ÑÐ°ÑÐ¸ÑÑÐµÐ¼Ð¾ÑÑÐ¸ (EPSS). ÐÑÐµÐ´Ð¼ÐµÑÐ¾Ð¼ Ð¸ÑÑÐ»ÐµÐ´Ð¾Ð²Ð°Ð½Ð¸Ñ ÑÐ²Ð»ÑÐµÑÑÑ Ð¿ÑÐ¾ÑÐµÑÑ Ð°Ð²ÑÐ¾Ð¼Ð°ÑÐ¸Ð·Ð¸ÑÐ¾Ð²Ð°Ð½Ð½Ð¾Ð¹ Ð¿ÑÐ¸Ð¾ÑÐ¸ÑÐ¸Ð·Ð°ÑÐ¸Ð¸ ÑÑÐ·Ð²Ð¸Ð¼Ð¾ÑÑÐµÐ¹ Ð² Ð¸Ð½ÑÐ¾ÑÐ¼Ð°ÑÐ¸Ð¾Ð½Ð½ÑÑ ÑÐ¸ÑÑÐµÐ¼Ð°Ñ Ð½Ð° Ð¾ÑÐ½Ð¾Ð²Ðµ ÑÐ°ÐºÑÐ¾ÑÐ° Ð¿ÑÐ¾Ð³Ð½Ð¾Ð·Ð¸ÑÑÐµÐ¼Ð¾Ð¹ ÑÐºÑÐ¿Ð»ÑÐ°ÑÐ¸ÑÑÐµÐ¼Ð¾ÑÑÐ¸. ÐÐ°Ð´Ð°ÑÐ¸, ÑÐµÑÐ°ÐµÐ¼ÑÐµ Ð² ÑÐ¾Ð´Ðµ Ð¸ÑÑÐ»ÐµÐ´Ð¾Ð²Ð°Ð½Ð¸Ñ: 1.Â  ÐÐ·ÑÑÐ¸ÑÑ ÑÐ¿Ð¾ÑÐ¾Ð±Ñ Ð¾ÑÐµÐ½ÐºÐ¸ ÐºÑÐ¸ÑÐ¸ÑÐ½Ð¾ÑÑÐ¸ ÑÑÐ·Ð²Ð¸Ð¼Ð¾ÑÑÐµÐ¹ Ð¸ Ð¸Ñ Ð¿ÑÐ¸Ð¾ÑÐ¸ÑÐ¸Ð·Ð°ÑÐ¸Ð¸ Ð¿ÑÐ¸ Ð¸ÑÐ¿ÑÐ°Ð²Ð»ÐµÐ½Ð¸Ð¸. 2.Â  ÐÐ·ÑÑÐ¸ÑÑ ÑÐ¾Ð²ÑÐµÐ¼ÐµÐ½Ð½ÑÐµ ÑÑÐµÐ´ÑÑÐ²Ð° ÑÐ¿ÑÐ°Ð²Ð»ÐµÐ½Ð¸Ñ ÑÑÐ·Ð²Ð¸Ð¼Ð¾ÑÑÑÐ¼Ð¸ Ð¸ Ð°Ð½Ð°Ð»Ð¸Ð·Ð° Ð·Ð°ÑÐ¸ÑÐµÐ½Ð½Ð¾ÑÑÐ¸. 3.Â  Ð Ð°Ð·ÑÐ°Ð±Ð¾ÑÐ°ÑÑ ÑÐ¿Ð¾ÑÐ¾Ð± Ð¿ÑÐ¸Ð¾ÑÐ¸ÑÐ¸Ð·Ð°ÑÐ¸Ð¸ ÑÑÐ·Ð²Ð¸Ð¼Ð¾ÑÑÐµÐ¹. 4.Â  ÐÑÐ¸Ð¼ÐµÐ½Ð¸ÑÑ ÑÐµÐ°Ð»Ð¸Ð·Ð¾Ð²Ð°Ð½Ð½ÑÐ¹ ÑÐ¿Ð¾ÑÐ¾Ð± Ð¿ÑÐ¸Ð¾ÑÐ¸Ð·Ð°ÑÐ¸Ð¸ ÑÑÐ·Ð²Ð¸Ð¼Ð¾ÑÑÐµÐ¹ Ð² ÑÐµÑÑÐ¾Ð²Ð¾Ð¹ ÑÑÐµÐ´Ðµ. Ð ÑÐ¾Ð´Ðµ ÑÐ°Ð±Ð¾ÑÑ Ð±ÑÐ»Ð¸ ÑÐ°ÑÑÐ¼Ð¾ÑÑÐµÐ½Ñ ÑÐ¾Ð²ÑÐµÐ¼ÐµÐ½Ð½ÑÐµ ÑÑÐµÐ´ÑÑÐ² ÑÐ¿ÑÐ°Ð²Ð»ÐµÐ½Ð¸Ñ ÑÑÐ·Ð²Ð¸Ð¼Ð¾ÑÑÑÐ¼Ð¸, ÑÐ°Ð·ÑÐ°Ð±Ð¾ÑÐ°Ð½Ð° ÑÐ¾ÑÐ¼ÑÐ»Ð° Ð¾ÑÐµÐ½ÐºÐ¸ Ð¿ÑÐ¸Ð¾ÑÐ¸ÑÐµÑÐ° Ð½Ð° Ð¾ÑÐ½Ð¾Ð²Ðµ Ð°Ð½Ð°Ð»Ð¸Ð·Ð° Ð¿ÑÐ¾Ð³Ð½Ð¾Ð·Ð¸ÑÑÐµÐ¼Ð¾Ð¹ ÑÐºÑÐ¿Ð»ÑÐ°ÑÐ¸ÑÑÐµÐ¼Ð¾ÑÑÐ¸, Ð¿ÑÐ¾Ð²ÐµÐ´ÐµÐ½Ð¾ ÑÐµÑÑÐ¸ÑÐ¾Ð²Ð°Ð½Ð¸Ðµ Ð½Ð° ÑÐµÑÑÐ¾Ð²Ð¾Ð¹ Ð¸Ð½ÑÑÐ°ÑÑÑÑÐºÑÑÑÐµ Ñ Ð¿Ð¾ÑÐ»ÐµÐ´ÑÑÑÐ¸Ð¼ ÑÑÐ°Ð²Ð½ÐµÐ½Ð¸ÐµÐ¼ Ñ ÑÑÑÐµÑÑÐ²ÑÑÑÐ¸Ð¼Ð¸ Ð¼ÐµÑÐ¾Ð´Ð°Ð¼Ð¸. Ð ÑÐµÐ·ÑÐ»ÑÑÐ°ÑÐµ ÑÐ°Ð±Ð¾ÑÑ ÑÐ°Ð·ÑÐ°Ð±Ð¾ÑÐ°Ð½ Ð¼ÐµÑÐ¾Ð´ Ð¿ÑÐ¸Ð¾ÑÐ¸ÑÐ¸Ð·Ð°ÑÐ¸Ð¸, ÑÑÐ¸ÑÑÐ²Ð°ÑÑÐ¸Ð¹ Ð¼ÐµÑÑÐ¸ÐºÐ¸ CVSS Ð¸ EPSS, Ð° ÑÐ°ÐºÐ¶Ðµ Ð´Ð°Ð½Ð½ÑÐµ Ð¾Ð± Ð¸Ð½ÑÑÐ°ÑÑÑÑÐºÑÑÑÐµ. ÐÑÐ¾Ð²ÐµÐ´ÐµÐ½Ð¾ ÑÐµÑÑÐ¸ÑÐ¾Ð²Ð°Ð½Ð¸Ðµ Ð¸ Ð¿Ð¾ÐºÐ°Ð·Ð°Ð½Ð¾, ÑÑÐ¾ Ð¿ÑÐµÐ´Ð»Ð¾Ð¶ÐµÐ½Ð½ÑÐ¹ Ð¼ÐµÑÐ¾Ð´ Ð¾Ð±ÐµÑÐ¿ÐµÑÐ¸Ð²Ð°ÐµÑ Ð±Ð¾Ð»ÐµÐµ ÑÐ¾ÑÐ½Ð¾Ðµ ÑÐ°ÑÐ¿ÑÐµÐ´ÐµÐ»ÐµÐ½Ð¸Ðµ Ð¿ÑÐ¸Ð¾ÑÐ¸ÑÐµÑÐ¾Ð² ÑÑÑÑÐ°Ð½ÐµÐ½Ð¸Ñ ÑÑÐ·Ð²Ð¸Ð¼Ð¾ÑÑÐµÐ¹. Ð ÐµÐ·ÑÐ»ÑÑÐ°ÑÑ Ð¸ÑÑÐ»ÐµÐ´Ð¾Ð²Ð°Ð½Ð¸Ñ Ð¼Ð¾Ð³ÑÑ Ð±ÑÑÑ Ð¸ÑÐ¿Ð¾Ð»ÑÐ·Ð¾Ð²Ð°Ð½Ñ Ð² ÑÐ¸ÑÑÐµÐ¼Ð°Ñ ÑÐ¿ÑÐ°Ð²Ð»ÐµÐ½Ð¸Ñ ÑÑÐ·Ð²Ð¸Ð¼Ð¾ÑÑÑÐ¼Ð¸, Ð° ÑÐ°ÐºÐ¶Ðµ Ð² Ð¿ÑÐ¾ÑÐµÑÑÐµ Ð¿Ð¾ÑÑÑÐ¾ÐµÐ½Ð¸Ñ ÑÑÑÐµÐºÑÐ¸Ð²Ð½Ð¾Ð¹ ÑÑÑÐ°ÑÐµÐ³Ð¸Ð¸ ÑÑÑÑÐ°Ð½ÐµÐ½Ð¸Ñ ÑÐ¸ÑÐºÐ¾Ð² Ð¸Ð½ÑÐ¾ÑÐ¼Ð°ÑÐ¸Ð¾Ð½Ð½Ð¾Ð¹ Ð±ÐµÐ·Ð¾Ð¿Ð°ÑÐ½Ð¾ÑÑÐ¸ Ð² Ð¾ÑÐ³Ð°Ð½Ð¸Ð·Ð°ÑÐ¸ÑÑ.
description: The aim of this study is to identify and prioritize the remediation of vulnerabilities on nodes based on an analysis of their Predictive Exploitability (EPSS). The subject of the research is the process of automated vulnerability prioritization in information systems based on the Predictive Exploitability factor. The objectives of the research include: 1.Â  Study methods for assessing the criticality of vulnerabilities and their prioritization for remediation. 2.Â  Examine modern vulnerability management and security analysis tools and the techniques they use for gathering information about existing vulnerabilities. 3.Â  Develop a method for prioritizing vulnerabilities. 4.Â  Apply the developed method for vulnerability prioritization in a test environment. The research involves an analytical review of modern vulnerability management tools, the development of a priority evaluation formula based on Predictive Exploitability Analysis, and testing in a controlled environment with subsequent comparisons. As a result, a prioritization method was developed that takes into account CVSS and EPSS metrics, as well as infrastructure data. Testing was conducted using security scanner reports, demonstrating that the proposed method provides more accurate prioritization of vulnerability remediation. The results of this study can be utilized in vulnerability management systems and in the process of developing effective risk mitigation strategies in organizations.