IVSV: An improved CVSS base score mechanism with vulnerability type

Abstract

Increased demand of Software and Applications offer intruders to perform malicious activities and exploit user’s personal data. Ignorance of security measures and tools while coding the software promotes the vulnerabilities and flaws. Developing a secure and bug free software is a big challenge for a developer and needs proper attention towards safety features. A single security mistake can lead to a loss of important information or confidential business data. Software companies and other organizations are looking for improved vulnerability security systems to narrow down the risk of vulnerabilities. Risks like social security attacks, bugs, phishing emails, vulnerabilities, virus attacks and more, hover over the IT industry. Threats are possible from all directions and in many different ways, so having an adequate vulnerability scoring mechanism is highly needed to reduce the risk of attacks. Identifying these threats before they get close enough to do damage is the most practical way to handle them. CVSS-V2 (Common Vulnerability Scoring System) is a standard for scoring the severity of vulnerabilities. CVSS-V2 uses three equations (Base, Temporal and Environmental) to capture and rate vulnerability severity. Numerous IT companies and government organizations rely on CVSS to evaluate and prioritize vulnerabilities. This paper proposes a method as an improvement over CVSS-V2 scoring system by introducing “Vulnerability type” in its base score equation.