## 4 Exploitation Risk Assessment for Vulnerability
### Evaluation of Exploitation Risk Metrics
#### 4.2.2 Exploit Code Availability
This implies that in the case of a CNA with a source of \"Vendor\", \"Researcher\", or \"Open Source\", the vulnerability is considered validated. The URL list includes four reference vulnerability databases, including SecurityFocus (an online computer security news portal and information security service provider), SecurityTracker (a web portal that tracks the latest security vulnerabilities), Exploit-db (a CVE-compliant archive of publicly available vulnerabilities and corresponding vulnerable software), and PacketStormSecurity (an information security web portal that provides current and historical computer security tools, attacks, and security advisories). These vulnerability databases are frequently cited in the literature as representative sources for assessing CVE-associated vulnerabilities and exploit reports [27; 28; 29]. Consequently, in this paper, we consider these vulnerability databases to be more reliable sources than other websites. In this study, we analyzed the frequency distribution of related vendor and vulnerability information URLs for insight into the OT/ICS vulnerability environment. Table 6 presents the top 10 related reference URLs and their corresponding frequencies, all based on the same CVE. Most of the URLs in this list fall under the Vendor CANs category, while other links from US-CERT provide analysis and advisories for vulnerabilities found in OT/ICS environments. These URLs fall under the CNA-LR classification and belong to organizations that are authorized to assign CVE IDs for vulnerabilities that extend beyond the scope of traditional CNAs. This includes vulnerabilities reported or observed to CISA and vulnerabilities affecting the ICS or healthcare industries. For this paper, we consider these URLs to be validated sources for ICS/OT vulnerabilities. In addition, tag keys are paired with values associated with different categories of reference resources, including vendor advisory, third-party advisory, technical description, vulnerability database (VDB) entry, mitigation, exploit, and patch. We performed an exploratory analysis of the most frequently used tags. Table 7 shows the frequency distribution of tags using data from 1999 to 2022 in the NVD. Each CVE may have contained more than one tag, and based on the frequency distribution, the tags \"Third-party advisory\", \"Vendor advisory\", and \"VDB entry\" accounted for over half of all tags. To determine the availability of the exploit code, we performed an association analysis. In addition to the results from the URL and tag frequency analysis, we explored the connection between the previously classified exploit sources and the reference information (URL and tags) associated with the CVE. Initially, we performed an association analysis \begin{table}
\begin{tabular}{c c c} \hline \hline
**No.** & **URL String** & **Frequency** \\ \hline
1 & us-cert.gov/ics & 3163 \\
2 & siemens.com & 1571 \\
3 & schneider-electric.com & 458 \\
4 & advantech.com & 218 \\
5 & rockwellautomation.com & 142 \\
6 & search.abb.com & 131 \\
7 & kaspersky.com & 125 \\
8 & Mitsubishielectric.com & 97 \\
9 & moxa.com & 53 \\
10 & geindustrial.com & 41 \\ \hline \hline \end{tabular}
\end{table} 
Table 6: Frequency distribution of URLs related to vulnerabilities of ICS/OT. between URLs and each predefined class of exploit sources. This allowed us to classify and define the extent of exploit-related information contained in the URL corresponding to each CVE. We also performed a similar association analysis for tag information, classifying and defining the level of availability of exploiting the information provided by individual tags and combinations of tags. Figure 5 shows the results of the association analysis using URL and tag information for the sources classified as PoC and Attacked. Initially, we analyzed the referring URLs of each source category and their corresponding CVEs to determine the distribution of the probability of providing exploit information at 25%, 50%, and beyond. Our analysis revealed that CNA links corresponding to Vendor