# Efficient Algorithm for Providing Live Vulnerability Assessment in Corporate Network Environment
## 2 Background  
In order to understand the concept of vulnerability management, one should begin with learning what the vulnerability in a computer system is and how it is marked using the Common Vulnerability Enumeration (CVE) [13] and assessed using Common Vulnerability Scoring System (CVSS) [14]. According to [15], software vulnerabilities \"are software bugs that expose weaknesses in software systems\". Consequently, software vulnerabilities are directly linked to the software development process. Authors in [16] point out that discovering bugs, problems, and vulnerabilities during the software development process is time consuming. Moreover, the insights regarding vulnerabilities and defects are frequently not pointed out by the development team but usually come from independent researchers. The idea for creating a consistent standard for marking the vulnerabilities was presented in [13]. The authors of the CVE concept discovered the need for introducing a consistent way of marking vulnerabilities in order to improve the internal communication within the organization. Each security system that was used and attempted to be integrated, consisted of its public and nonpublic vulnerability database [13; 17; 18]. The largest problem faced was the lack of common naming convention and vulnerability identification. As a result, the data comparison for different providers and linking this data with other security systems to minimize the risks, was very time consuming [13; 17]. The Common Vulnerability Enumeration (CVE) concept was accepted by the industry and literature to such an extent that it has found its usage not only in Intrusion Detection Systems (IDSs) [19] but in every cybersecurity related field [20; 21; 22]. Further, since 1999 many computer security providers and nonprofit organizations have been developing, promoting, and implementing the diverse systems of vulnerability assessment: X-Force [23], Symantec [24], Microsoft [25], Redhat [26], Mozilla [27], Secunia [28], Vulpen [29], Google [30], VRSS [29], CVSS [31]. Currently [23; 24; 25; 26; 27; 30], many computer security providers are still maintaining research departments; however, support for many past solutions has been discontinued [31]. For instance,[28] is no longer developed while [29] has not been adopted. The Common Vulnerability Scoring System (CVSS) on the other hand, was introduced for the first time as a research project by the US National Infrastructure Advisory Council (NIAC) in 2005 [31] and adopted subsequently by other organizations. The CVSS 2.0 and CVSS 3.1 versions [32; 33] are divided into three categories:  
* Base
* Temporal
* Environmental  
Base category represents properties of the vulnerability that do not change in time. These properties consist of access complexity, access vector, and assess the degree to which a vulnerability compromises the confidentiality, integrity, and availability of the system. Temporal category describes properties that may change over time. In particular, the temporal category refers to the existence of a public exploit and a patch or fix availability. The temporal characteristics of CVE were studied specifically by [PERSON] in [15] while in [19] researchers aimed to express the value risk, potential loss, and prevalence of affected systems in the considered environment. Beyond any doubt, the Vulnerability Management (VM), an essential part of maintaining the security of an organization [34; 35], is threatened by growing cybercrime [36]. The identification and mitigation of vulnerabilities in specific or critical systems reduces the risk of exploitation impact during a potential attack [37]. Therefore, it is crucial that leading Information Technology (IT) organizations and network administrators aim for zero vulnerabilities in managed systems. The VM process should be implemented practically in every organization that uses IT infrastructure.