## 4 Exploitation Risk Assessment for Vulnerability
### Evaluation of Exploitation Risk Metrics
#### 4.2.2 Exploit Code Availability  
Attackers typically develop exploits to target vulnerabilities or use existing exploits for their attacks. In this study, we evaluate exploit code availability (ECA), which gauges the availability of exploit code for vulnerabilities employed by attackers, into four types, including Undefined, Unproven, Proof of Concept, and Attacked, based on the disclosure of exploit code for each level of availability for published vulnerabilities. To establish these categories, we performed a correlation analysis on published vulnerability data and exploit information sources, considering variations in exploit code availability. We defined classification criteria for each exploit source before conducting the correlation analysis. These sources provide a range of information, including validated exploits, actual exploits, analyzed information, and automated modules. We establish class definitions based on previous studies [6; 7; 8] and the level of information provided by the collected exploit sources. Weighting is uniformly distributed within the range (1, 2). Table 4 shows the classification criteria and assigned weights based on the source of the exploit information. Next, we perform a correlation analysis between CVEs and exploit sources for each class. CVE data provide valuable insights into the extent of vulnerability exploitation by assigning it to an object called references. The reference object has two keys (URL and tag) that are used to capture exploit information. The URL key is paired with a uniform resource locator (URL) that points to reference websites related to the vulnerability, including vendor advisories, security posts, and exploit code sharing. These referenced URLs can be used to infer the credibility and authority of an exploit reference for a CVE. The initial step involves analyzing the frequency distribution of these URLs. Table 5 shows the top 15 referring URLs based on 192,116 CVEs spanning from 1999 to 2022 in the NVD database. The majority of URLs in this list are provided by IT vendors, such as OpenSuse, GitHub (cloud code repository), Red Hat, Oracle, and IBM. These entities are known as \begin{table}
\begin{tabular}{c c c} \hline
**Exploit Code Availability** & **Weight** & **Classification Criteria** \\ \hline Attacked & 2 & \{Metasploit | KEV | NCAS | inthewild.io | Vulners:in the wild | ZDI | \\ Proof of Concept & 1.5 & \{ExploitDB| Github | ICS-CERT | exploitalert | TriKest CVE Repository \} \\ Unproven & 1 & Not satisfy any rules above \\ \hline \end{tabular} Notes: KEV: known exploit vulnerability, NCAS: National Cyber Awareness System, ICS: industrial control system. ZDI: Zero Day Initiative.  
\end{table} 
Table 4: Classification criteria based on exploit sources. \begin{table}
\begin{tabular}{c c c} \hline
**No.** & **URL String** & **Frequency** \\ \hline
1 & securityfocus.com & 67,735 \\
2 & securitytracker.com & 50,022 \\
3 & xchange.xforce.ibmcloud.com & 35,216 \\
4 & secunia.com & 31,481 \\
5 & github.com & 26,357 \\
6 & osvdb.org & 16,532 \\
7 & vupen.com & 16,021 \\
8 & debian.org & 15,436 \\
9 & Redhat.com & 12,751 \\
10 & exploitold.com & 12,317 \\
11 & Oracle.com & 10,201 \\
12 & gentoo.org & 10,021 \\
13 & opensuse.org & 9480 \\
14 & Openwall.com & 9320 \\
15 & Packetstormsecurity.com & 9271 \\ \hline \end{tabular}
\end{table} 
Table 5: Frequency distribution of URLs. CVE numbering authorities (CNAs) and are authorized to assign CVE IDs to vulnerabilities. CNAs are categorized into seven types, and the current list includes Vendor, Researcher, and Open Source. Vendor CANs assign CVE IDs to vulnerabilities found in their products, and Researcher CANs conduct research to identify vulnerabilities covered by published CVEs. In addition, Open Source CANs produce, manage, or maintain products or services with freely available source code that can be modified and redistributed [26]. These research organizations acknowledge reported vulnerabilities by verifying them, assessing their validity, and assigning a unique CVE ID.