Software Vulnerability Severity Evaluation Based on Economic Losses

Enterprises suffer economic losses due to vulnerability exploitation. The aim of this paper is to propose a comprehensive software vulnerability severity evaluation model incorporating technical assessment and circumstances information of enterprises, especially economic losses caused by vulnerability exploitation. We use analytic hierarchy process to establish the model and get weights of evaluation factors, obtaining both of qualitative severity ranking levels and quantitative severity scores of vulnerabilities. Through case study, we show that evaluation values are accurate and effective and consequently, our model can be used for security improvement prioritization.