## 6 Discussion  
### Review Case Study Results and Contributions  
In the first case, we utilized the proposed evaluation system to determine the Exploitation Risk Score in a real-world case where four vulnerabilities were exploitatively cascaded. Specific to this instance, we calculated three metrics for the vulnerability identified as CVE-2023-36844 during the first approach. When determining the ERS for a vulnerability, the assessment relies on three metrics: ECR, EUP, and ECA. It is essential to have a thorough understanding of the attacker's motives and techniques to achieve them. The attack techniques identified based on the potential impact information for CVE-2023-36844 include those related to integrity compromise, which fall into the secondary impact category. This is consistent with the primary impact information for vulnerabilities that have been cascaded in real-world attacks to compromise system integrity. The attack vector is used by multiple APT groups and malware, resulting in a 62% probability of cascading. This means that there is an approximate 62% probability that the integrity compromising vulnerability (CVE-2023-36846, CVE-2023-3684) will be cascaded and exploited by performing an initial approach using CVE-2023-36844. This is combined with a tactical weight that represents the attacker's aggressiveness and motives to produce an ECR that ultimately represents the risk of an attacker cascading vulnerabilities to achieve their motives based on their attack technique. The EoE, which denotes the difficulty of an attacker in exploiting a vulnerability, was calculated using the ECA and EUP measurements for CVE-2023-36844. Subsequently, the ECR previously calculated was added to derive the final risk score, ERS. As a result, unlike the traditional CVSS score, which in this case provides a static severity score for the unchanging attributes of the vulnerability, the ERS provides a dynamic, \begin{table}
\begin{tabular}{c c c c c c c c c} \hline \hline \multirow{2}{*}{**CVE ID**} & \multicolumn{2}{c}{**Exploit Chaining Risk**} & \multicolumn{2}{c}{
\begin{tabular}{c} **Ease of** \\ **Exploitation** \\ \end{tabular} } & \multicolumn{2}{c}{**Exploitation**} & \multicolumn{2}{c}{**Base Score**} & \multicolumn{2}{c}{**Exploited**} \\ \cline{2-9}  & ECP & W (T) & ECR & EUP & ECA & & & \\ \hline CVE-2015-7855 & 0.84 & 9.25 & 7.77 & 0.97 & 2 & 9.71 & 6.5 & O \\ CVE-2023-38558 & 1 & 4.5 & 4.5 & 0.00042 & 1.5 & 4.5 & 5.5 & X \\ CVE-2016-9899 & 0.83 & 10 & 8.3 & 0.866 & 2 & 10.032 & 9.8 & O \\ CVE-2019-19281 & 0.93 & 9.5 & 8.84 & 0.002 & 1.5 & 8.84 & 7.5 & X \\ CVE-2017-17562 & 0.83 & 11.5 & 9.55 & 0.97 & 2 & 11.485 & 8.1 & O \\ \hline \hline \end{tabular}
\end{table} 
Table 12: Assessment of exploit risk based on exploit vulnerability information. comprehensive understanding of the attack technique used to achieve the attacker's motives across three dimensions. In the second case, we constructed a data leakage attack scenario in a control system environment based on an actual cyber incident. Among them, the evaluation was performed on five vulnerabilities found in the devices where command injection and data leakage occurred, and all three vulnerabilities that were exploited in the actual control system were identified. Among the evaluation results in Table 12, we can see that for CVE-2015-7855, which was used for exploitation, although its CVSS score is lower than the management target score of 7.0 compared to CVE-2019-19281, it can be confirmed that the final ERS calculated in this paper is higher. CVE-2019-19281 has approximately one higher risk of attack technique chaining to achieve the attacker's motives than CVE-2015-7855. However, CVE-2015-7855 has a very high probability (97%) of being successfully exploited because validated attack code is available for exploitation.