Vulnerability disclosure in the age of social media: exploiting twitter for predicting real-world exploits

TLDR

The number of discovered software vulnerabilities has risen sharply in recent years. The study aims to prioritize vulnerability responses by predicting which disclosed vulnerabilities will be exploited and filtering out those that are not. The authors analyze vulnerability-related Twitter content and develop a Twitter-based exploit detector guided by a tailored threat model. The detector aids response prioritization, supports cyber‑insurance risk modeling, and demonstrates the usefulness of victim-provided information.

Abstract

In recent years, the number of software vulnerabilities discovered has grown significantly. This creates a need for prioritizing the response to new disclosures by assessing which vulnerabilities are likely to be exploited and by quickly ruling out the vulnerabilities that are not actually exploited in the real world. We conduct a quantitative and qualitative exploration of the vulnerability-related information disseminated on Twitter. We then describe the design of a Twitter-based exploit detector, and we introduce a threat model specific to our problem. In addition to response prioritization, our detection techniques have applications in risk modeling for cyber-insurance and they highlight the value of information provided by the victims of attacks.