# A Dynamic Risk Assessment and Mitigation Model
## 2 Background  
The CVE framework, developed by MITRE [8], functions as a comprehensive repository for cataloging individual cybersecurity vulnerabilities. Widely regarded as an industry-standard framework, the CVE initiative facilitates the identification, definition, and public disclosure of vulnerabilities associated with cybersecurity. Each vulnerability is assigned a unique identifier, referred to as a CVE-ID, which adheres to the format CVE-year-arbitrary digits. For instance, CVE-2019-11510 denotes a vulnerability identified in the year 2019. The CVSS [9] provides an open and standardized framework for describing the characteristics and severity of vulnerabilities. Each CVSS vulnerability is represented by a vector string, which acts as a concise textual summary of the metric values used to compute the vulnerability's score. This study utilizes version 3.x of the CVSS to evaluate CVEs, with a particular emphasis on the exploitability and impact metrics. The NIST NVD [10] serves as the official repository of the U.S. government for comprehensive data related to standards-compliant vulnerability management. Within the NVD,CVEs from the CVE Dictionary undergo detailed analysis. This analysis encompasses a thorough examination of CVE descriptions, references, and supplementary publicly available data. The process results in the assignment of relevant metrics using the CVSS framework. Specifically, the NVD provides an aggregated score under the CVSS 3.x framework, integrating the three distinct metric groups: Base, Temporal, and Environmental. However, it is important to note that many vulnerabilities in the NVD are still evaluated using the older CVSS 2.0 framework. Additionally, the latest CVSS 4.0 framework has not yet been adopted by the NVD for CVE scoring. The EPSS [11] model synthesizes vulnerability-related data from various sources to generate quantitative predictions about the likelihood of vulnerabilities being exploited within the next 30 days. Leveraging machine learning techniques, EPSS identifies patterns and correlates vulnerability information with relevant exploitation activities. This process produces an exploitation probability score for each CVE, influenced by factors such as the age of the vulnerability, the availability of publicly accessible exploit code, and other pertinent considerations. In the context of its application within the risk calculation Equation (1),  
\[Risk=Threat\times Vulnerability\times Impact, \tag{1}\]  
The EPSS model's authors explicitly recommend that EPSS scores be utilized as part of the threat component rather than the vulnerability component. The CWE [12] is an extensive catalog of prevalent software and hardware weaknesses, collaboratively identified and maintained by the cybersecurity community. A weakness is defined as a condition in hardware, firmware, or software that can contribute to the emergence of vulnerabilities under specific circumstances. Each weakness is assigned a unique identifier, referred to as a CWE-ID, which facilitates the specification and tracking of individual weaknesses. The NVD enables users to associate specific CVE-IDs with corresponding CWE-IDs, providing insights into the underlying weaknesses that contribute to particular vulnerabilities. Notably, a single CWE may be linked to multiple CVE-IDs, as a single type of weakness can result in multiple distinct vulnerabilities. In this study, the NVD website and API are utilized to correlate CVEs with CWEs, although similar functionality is also available through the MITRE CWE website. The CAPEC initiative [13] serves as a comprehensive repository of common attack patterns that adversaries may employ, enabling users to understand how system weaknesses can be exploited. CAPEC provides detailed descriptions of the techniques adversaries might utilize to exploit these weaknesses effectively.