Vulnerability lifecycles

Coordinated vulnerability disclosure (CVD) is meant to get patches deployed before attackers exploit a vulnerability. Evaluating it requires knowing when exploitation began, and that date is rarely recorded.

We analyzed two years of application-layer scanning traffic from DScope and dated real-world exploitation for 63 vulnerabilities. Combined with six other datasets, these dates give a lifecycle for each vulnerability. We found that CVD across diverse vendors is less effective than earlier studies estimated, and that intrusion detection systems are underused for protection against critical vulnerabilities.

The paper received the Best Paper Runner-Up award at IMC 2023.