On prioritization of vulnerability categories based on CVSS scores

In view of increasing population of vulnerabilities, quantitative evaluation of vulnerabilities is necessary for efficient mitigation. Evaluation on classified vulnerability datasets can further improve the mitigation process. Objective of this paper is to develop security metrics to prioritize vulnerability categories based on CVSS scores to step ahead in this regard. In this context, security metrics are developed to reevaluate and unify vulnerability severity scores depending on availability of patches and age of vulnerability. Proposed metrics are applied on 5177 vulnerabilities extracted from NVD published in recent one year and vulnerability categories are prioritized and ranked based on cumulative severity scores.