# Unveiling the Landscape of Operating System Vulnerabilities
## 7 Deferred
### Analysis of Vulnerabilities Trends, Severity, and Types  
Following the data preparation and sampling of OS categories and versions, we proceeded with a temporal analysis of the selected OS categories and recent OS versions. To conduct this analysis, we leveraged the temporal information encoded within the CVE IDs. The year component of the CVE ID format, represented as CVE-YYYY-XXXXX, indicates the disclosure year of the vulnerability. We grouped the top 10 vulnerable OS categories based on the year indicated in their respective CVE IDs. By doing so, we obtained the number of vulnerabilities reported for each product from 1999 up to 2022. This analysis allows us to understand the trends in vulnerability reports over the years, providing valuable insights into the frequency and distribution of vulnerabilities within each category. Furthermore, examining the trend in vulnerability reports year by year contributes to a better understanding of the evolving landscape of vulnerabilities in the selected OS categories.  
Furthermore, it is also evident that not all OS categories with specific versions are necessarily supported by their respective vendors. Hence, we took an additional step to extract the top 10 OSs with specific versions that are confirmed to be supported by the vendors. This selection was made within the recent timeframe of 2021-2022, ensuring that the readers gain insight into the prevailing vulnerabilities that are relevant and applicable in the present time.  
On the other hand, we also performed a severity analysis of the vulnerabilities discovered in the top 10 OS categories based on CVSS scores. As discussed in Section 2, we scraped four different CVSS scores based on the availability such that we will have at least one CVSS score for each product. Finally, we computed a single CVSS score by taking the maximum of all four CVSS scores for each product as follows:  
\[CVSS\_score=max(CVSSv2\_NIST,CVSSv2\_CNA,CVSSv3\_NIST,CVSSv3\_CNA)\]  
After extraction of the CVSS score, we grouped the score into one of ten categories. The CVSS score is a continuous number and thus it will be difficult to generate comparative bar plots. Furthermore, creating the line plots may generate a disoriented graph that may not produce valuable insights. Therefore, we prepare the 10 discrete groups of CVSS scores viz. 0-1, 1-2, 2-3,..., 9-10 classes. All groups include the lower bound and exclude the upper bound except for the CVSS group 9-10, which includes both lower and upper bounds.  
We expand our methodology by unfolding the types of vulnerabilities based on the CWE ID. We scraped the reported CWE IDs associated with each data point. We leveraged this CWE ID to rank the top 10 vulnerability types based on the number of times the vulnerability type is observed within the CVE record. It is quite important to understand the year-wise vulnerability types such that the end-users can understand and take necessary precautions about the prevailing vulnerability types. Next, we analyzed the year-wise vulnerability count for each of our top 10 CWE IDs. Then, we compared the vulnerability counts of the CWE IDs common to our top 10 vulnerable OS categories as well as the top 10 vulnerable OS versions in recent years. This comparison provides insights into the vulnerability patterns between the broader range of vulnerable OS categories and the more recent OS versions with specific releases.  
\begin{table}
\begin{tabular}{c c c} \hline \hline
**Dataset Name** & **Number of Data Points** & **Description** \\ \hline OS\_CAT & 310,429 & Versions aggregated together \\ OS\_VER & 465,084 & Versions taken independently \\ \hline \hline \end{tabular}
\end{table}
Table 3: OS vulnerability datasets derived using 54549 unique CVE IDs associated with OSs.