Comparative Analysis of Machine Learning Methods in Vulnerability Categories Prediction Based on Configuration Similarity

Attack graphs have long been a favored method for modeling complex, multi-step cyber attacks. These graphs facilitate risk assessment, the evaluation of potential host compromises within networks, and the identification of the most likely and impactful attack trajectories. Typically, these assessments rely on vulnerability data sourced from public databases. However, a significant challenge arises when devices, applications, and operating systems are not cataloged in such databases, leaving their vulnerabilities unaccounted for the construction of attack graphs. To address this gap, this paper introduces a novel approach for predicting vulnerabilities. The proposed approach evaluates the effectiveness of various machine learning techniques in prediction of vulnerability categories, based on the similarity of host configurations. In this approach, each host’s configuration is depicted as a collection of Common Platform Enumeration (CPE) descriptions. Hosts with sufficiently similar configurations are presumed to share identical categories of vulnerabilities. Vulnerabilities are classified into 24 distinct categories based on metrics such as the access vector and the level of privileges required or obtained. The performance of different machine learning methods was assessed using average accuracy, precision, recall, and F-measure scores along with standard deviations. To ensure more accurate analysis, an exhaustive search with cross-validation was conducted across a range of parameters for each method. The F-measure was selected as the key metric for refining the search parameters.