# Efficient Algorithm for Providing Live Vulnerability Assessment in Corporate Network Environment
## 6 Results  
In this section, the main purpose is to verify the operation of the proposed software and for this purpose the test cases described in the previous section were used. First, the influence of the asset collector module on the CVSS scores is discussed. Figure 3 presents the CVSS 2.0 scores obtained for all 3 considered configurations (Tables 3-5). When compared with Figure 2a, significant \begin{table}
\begin{tabular}{c c c c} \hline \hline
**Name** & **Low** & **Medium** & **High** \\ \hline Confidentiality & 10.19\% & 7.82\% & 81.99\% \\ Integrity & 8.29\% & 10.9\% & 80.81\% \\ Availability & 9.25\% & 10.66\% & 80.09\% \\ \hline \hline \end{tabular}
\end{table} 
Table 4: Distribution of CIA requirements for configuration II. \begin{table}
\begin{tabular}{c c c c c} \hline \hline
**Name** & **Low** & **Medium** & **High** & **N.D.** \\ \hline Confidentiality & 25.36\% & 22.99\% & 23.7\% & 27.96\% \\ Integrity & 22.99\% & 25.12\% & 25.12\% & 26.78\% \\ Availability & 23.93\% & 25.83\% & 30.33\% & 19.90\% \\ \hline \hline \end{tabular}
\end{table} 
Table 3: Distribution of CIA requirements for configuration I. \begin{table}
\begin{tabular}{c c c c c} \hline \hline
**Name** & **Low** & **Medium** & **High** & **N.D.** \\ \hline Confidentiality & 76.3\% & 9\% & 6.88\% & 7.82\% \\ Integrity & 74.64\% & 8.06\% & 8.77\% & 8.53\% \\ Availability & 73.22\% & 9.48\% & 8.53\% & 8.77\% \\ \hline \hline \end{tabular}
\end{table} 
Table 5: Distribution of CIA requirements for configuration III. difference in calculated CVSS scores is observed for all considered configurations. The highest CVSS 2.0 environmental assessments received for the tested configurations are 7.5 (High) [14]. The next step in analyzing the impact of CVSS factors on the threat assessment generated by the vulnerability is considering the confidentiality, integrity, and availability requirements. Figure 3a shows the result of vulnerability prioritization including CVSS environmental 2.0 vector element for an equal distribution of all CIA components (Table 3). The obtained results indicate that only 0.33% of vulnerabilities have high priority in comparison to 34% obtained for CVSS base 2.0 score (Figure 2a). Figure 3b shows that 1.51% of vulnerabilities receive a high priority score (the scoring higher or equal to 7) (Table 4). For configuration III (Table 5), with 70% of the CIA components having LOW level, the results indicate only 0.11% of vulnerabilities with high CVSS score. For CVSS environmental 3.1 scoring the observed changes in prioritization in the applied configurations are:  
* configuration I, the decrease of critical and high vulnerabilities by 30% (Figure 4a) in comparison to CVSS base 3.1 (Figure 2b),
* configuration II, the increase of critical and high vulnerabilities by 30% (Figure 4b) in comparison to CVSS base 3.1 (Figure 2b),
* configuration 3, the decrease of critical and high vulnerabilities by 50% (Figure 4c) in comparison to CVSS base 3.1 (Figure 2b). Thus the impact of integrating CVSS base scores with information available from CMDB is large so that a significant reprioritizing after including CVSS environmental information has to take place. It is noted, however, that depending on the nature of the monitored infrastructure, the distribution of CIA values may differ from the one adopted in the research. Nonetheless, results obtained confirm that maintaining an up-to-date CMDB database and its integration with the vulnerability scan results increases the level of security services. Figure 3: CVSS Environmental 2.0 histograms. Next, the results concerning vertical scalability of the software are considered. Figure 5 shows the influence of changes on time consuming proposed test cases in section VMC Implementation and Experiment Design. \(P_{0}\) measurements were conducted to relate to changes caused by \(P\) to the initial phase of the system. Test cases \(P_{4}\), \(P_{5}\), \(P_{6}\), \(P_{10}\), \(P_{11}\), \(P_{12}\) reduce the amount of active vulnerabilities for which calculations must be made.