## 4 Exploitation Risk Assessment for Vulnerability
### Evaluation of Exploitation Risk Metrics  
#### 4.2.1 Exploit Chaining Risk  
Attackers do not restrict themselves to exploiting a single vulnerability to accomplish a single attack motive; rather, they often exploit multiple vulnerabilities in succession. This practice is known as vulnerability chaining, which involves the consecutive exploitation of multiple vulnerabilities during a single attack [23]. To quantify the probability of vulnerability chaining, we rely on information about the attacker's tactics and techniques (TTPs) used to exploit these vulnerabilities. We use the attack technique applied to exploit the vulnerability and the impact information following a successful exploit. The impact information guides us in identifying the exploit techniques capable of causing it, leading to the determination of the probability of chained attacks targeting a single vulnerability. It is important to note that our research aims to assess the likelihood of chained attacks, not to identify specific vulnerabilities that can be chained together. To facilitate the mapping of TTPs to identify specific CVEs and their subsequent impact techniques, we use a mapping methodology provided by MITRE. This methodology maps attack techniques and their subsequent impact on a CVE, categorizing them into three groups: exploitation technique, primary impact, and secondary impact. The exploitation technique is the method used to exploit a specific vulnerability, whereas the primary impact is the benefit an attacker can attain by exploiting the vulnerability. Secondary impact encompasses the subsequent techniques and impacts achievable by an attacker by using the techniques associated with the primary impact. CVE descriptions include information regarding the type of vulnerability, potential attacker actions upon exploiting the vulnerability, and the attacker's likely approach. To map TTPs using information contained in CVE descriptions, we follow MITRE's established methodology [24] for categorizing and mapping related attack techniques to vulnerability types, exploit outcomes, exploit behaviors, and tactics, as shown in Figure 4.  
In this study, exploit chaining probability (ECP) refers to the probability of the next technique being employed, given the success of the previous technique. The probability of each technique is calculated based on its frequency of use in attack groups, malware, etc., where it has been observed. These probabilities are used to calculate the probability of a subsequent attack, assuming the previous attack technique was successful. A higher calculated probability suggests that the technique is used more often by multiple attack groups and software, making it more likely to be employed and chained by an attacker. ECP calculates the probability of chaining from the initial attack technique to the final subsequent attack technique by considering the probability that the subsequent attack will not occur if the preceding attack has occurred. The formula is as follows:  
\[ \begin{split} ECP&=P(A)\times\Big{[}1-\left\{\prod _{k=1}^{n}P(B_{k}^{c}|A)+\prod_{k=1}^{n}P(C_{k}^{c}|B)\right\}\Big{]},\\ &=P(A)\times\Big{[}1-\left\{\prod_{k=1}^{n}P(B_{k}^{c})+\prod_{k= 1}^{n}P(C_{k}^{c})\right\}\Big{]},\end{split}  \tag{1}\]  
Figure 4: CVE mapping to MITRE ATT&CK TTPs for Impact. Tactics are prioritized and weighted according to their urgency and impact on the security of the target. The prioritization of tactics shown in Table 3 is consistent with the prioritization of each tactic as defined in the key phases of the Technical Cyber Threat Framework published by the U.S. National Security Agency (NSA) [25], and the weights for quantification were defined based on criteria utilized in existing research [12]. The highest priority (1) tactic is \"exfiltration and impact\", which is the ultimate goal of an APT attack.