A Model for Android and iOS Applications Risk Calculation: CVSS Analysis and Enhancement Using Case-Control Studies

Abstract

Various researchers have shown that the Common Vulnerability Scoring System (CVSS) has many drawbacks and may not provide a precise view of the risks related to software vulnerabilities. However, many threat intelligence platforms and industry-wide standards are relying on CVSS score to evaluate cybersecurity compliance. This paper suggests several improvements to the calculation of Impact and Exploitability sub-scores within the CVSS, improve its accuracy and help threat intelligence analysts to focus on the key risks associated with their assets. We will apply our suggested improvements against risks associated with several Android and iOS applications and discuss achieved improvements and advantages of our modelling, such as the importance and the impact of time on the overall CVSS score calculation.

arXiv comment19 Pages

References in corpus (9)

• Epidemic spreading in scale-free networks
• Epidemic processes in complex networks
• Internet of Things Security and Forensics: Challenges and Opportunities
• My Software has a Vulnerability, should I worry?
• Know Abnormal, Find Evil: Frequent Pattern Mining for Ransomware Threat Hunting and Intelligence
• Disease Localization in Multilayer Networks
• A Cyber Kill Chain Based Taxonomy of Banking Trojans for Evolutionary Computational Intelligence
• Greening Cloud-Enabled Big Data Storage Forensics: Syncany as a Case Study
• Forensics Analysis of Android Mobile VoIP Apps

Cited by in corpus (2)

• Cyber Threat Intelligence : Challenges and Opportunities
• Digital Forensics vs. Anti-Digital Forensics: Techniques, Limitations and Recommendations