Fawaz Alanazi 1, Ahmed Badi Alshammari 2, Chams Sallami 1, Asma A. Alhashmi 1, Rachid Effghi 3, Anil Kumar KM 4, Abdulbasit Darem 5

1 Department of Computer Science, College of Science, Northern Border University, Arar, Saudi Arabia

2 Department of Computer Science, College of Computing and Information Technology, Northern Border University, Saudi Arabia

3 Department of Big Data Analytics and Management, Bahcesehir University, Türkiye

4 JSS Science and Technology University, Department of Computer Science and Engineering, Mysuru, India

5 Center for Scientific Research and Entrepreneurship, Northern Border University, Arar, Saudi Arabia

Download Citation: |
Download PDF


ABSTRACT

In today’s highly connected digital environment, effectively managing cybersecurity vulnerabilities is essential to protecting organizational systems. This research examines the use of machine learning models to predict the severity of vulnerabilities, utilizing data from the 2022, Cybersecurity and Infrastructure Security Agency (CISA) known exploited vulnerabilities catalogue. The study evaluates five machine learning models–Logistic Regression, Decision Tree, Random Forest, Gradient Boosting, and Support Vector Machine–based on their performance in terms of accuracy, precision, recall, and computational efficiency. The results show that tree-based models, especially Decision Tree, Random Forest, and Gradient Boosting, achieved perfect accuracy (100%) in categorizing vulnerabilities by severity, outperforming Logistic Regression and Support Vector Machine, which faced difficulties with critical vulnerabilities. Additionally, tree-based models demonstrated superior computational efficiency, with Decision Tree standing out in terms of both speed and accuracy, making it ideal for real-time use. The study emphasizes the potential of machine learning to automate and improve vulnerability management, allowing security teams to prioritize significant threats and better allocate resources. Future work should focus on incorporating real-time data and exploring deep learning methods to enhance model adaptability and performance. Overall, the research highlights the importance of machine learning in bolstering cybersecurity defenses.


Keywords: Cybersecurity, Machine learning models, Threat prioritization, Vulnerability management, Vulnerability severity prediction.


Share this article with your colleagues

 


REFERENCES

  1. Babalau, I., Corlatescu, D., Grigorescu, O., Sandescu, C., Dascalu, M. 2021. Severity prediction of software vulnerabilities based on their text description, 171–177

  2. Bozorgi, M., Saul, L.K., Savage, S., Voelker, G.M. 2010. Beyond heuristics: learning to classify vulnerabilities and predict exploits. Proceedings of the 16th ACM SIGKDD International Conference on Knowledge Discovery and Data Mining, 105–114.

  3. Cybersecurity and Infrastructure Security Agency (CISA). (2022). Known Exploited Vulnerabilities Catalog. Retrieved from https://www.cisa.gov/known-exploited-vulnerabilities-catalog.

  4. Frei, S., May, M., Fiedler, U., Plattner, B. 2006. Large-scale vulnerability analysis. Proceedings of the 2006 SIGCOMM Workshop on Large-Scale Attack Defense, 131–138.

  5. Holm, H., Afridi, K.K. 2015. An expert-based investigation of the common vulnerability scoring system. Computers and Security, 53, 18–30.

  6. Holm, H., Ekstedt, M., Andersson, D. 2012. Empirical analysis of system-level vulnerability metrics through actual attacks. IEEE Transactions on Dependable and Secure Computing, 9, 825–837.

  7. Hulayyil, S.B., Li, S., Xu, L. 2023. Machine-learning-based vulnerability detection and classification in Internet of Things device security. Electronics, 12, 3927.

  8. Jabeen, G., Rahim, S., Afzal, W., Khan, D., Khan, A.A., Hussain, Z., Bibi, T. 2022. Machine learning techniques for software vulnerability prediction: A comparative study. Applied Intelligence, 52, 17614–17635.

  9. Joh, H., Malaiya, Y.K. 2014. Defining and assessing quantitative security risk measures using vulnerability lifecycle and CVSS metrics. The International Conference on Security and Management (SAM), 10–16.

  10. Khattak, A., Almujibah, H., Elamary, A., Matara, C.M. 2022. Interpretable dynamic ensemble selection approach for the prediction of road traffic injury severity: A case study of Pakistan’s National Highway N-5. Sustainability, 14, 12340.

  11. Laghari, A.A., Jumani, A.K., Laghari, R.A., Li, H., Karim, S., Khan, A.A. 2024. Unmanned aerial vehicles advances in object detection and communication security review. Cognitive Robotics.

  12. Laghari, A.A., Li, H., Khan, A.A., Shoulin, Y., Karim, S., Khani, M.A.K. 2024. Internet of Things (IoT) applications security trends and challenges. Discover Internet of Things, 4, 36.

  13. Le, Q., Mikolov, T. 2014. Distributed representations of sentences and documents. Proceedings of the 31st International Conference on Machine Learning, 1188–1196.

  14. Liu, K., Zhou, Y., Wang, Q., Zhu, X. 2019. Vulnerability severity prediction with deep neural network. In 2019 5th international conference on big data and information analytics (BigDIA), 114–119.

  15. Mell, P., Scarfone, K., Romanosky, S. 2007. A complete guide to the common vulnerability scoring system version 2.0. FIRST–Forum of Incident Response and Security Teams, 23.

  16. Nayak, K., Marino, D., Efstathopoulos, P., Dumitras, T. 2014. Some vulnerabilities are different than others - studying vulnerabilities and attack surfaces in the wild. In International Workshop on Recent Advances in Intrusion Detection. Cham: Springer International Publishing, 426–446.

  17. Nazir, R., Laghari, A.A., Kumar, K., David, S., Ali, M. 2021. Survey on wireless network security. Archives of Computational Methods in Engineering, 1–20.

  18. Neuhaus, S., Zimmermann, T., Holler, C., Zeller, A. 2007. Predicting vulnerable software components. Proceedings of the 14th ACM Conference on Computer and Communications Security, 529–540.

  19. Smadi, S., Aslam, N., Zhang, L. 2018. Detection of online phishing email using dynamic evolving neural network based on reinforcement learning. Decision Support Systems, 107, 88–102.

  20. Smaha, S.E. 1988. Haystack: An intrusion detection system. IEEE Aerospace Computer Security Applications Conference, 37–44.

  21. Solms, R. von, Niekerk, J. van. 2013. From information security to cyber security. Computers and Security, 38, 97–102.

  22. Yin, S., Li, H., Laghari, A.A., Teng, L., Gadekallu, T.R., Almadhor, A. 2024a. FLSN-MVO : Edge computing and privacy protection based on federated learning siamese network with multi-verse optimization algorithm for industry 5.0. IEEE Open Journal of the Communications Society.

  23. Yin, S., Li, H., Laghari, A.A., Gadekallu, T.R., Sampedro, G.A., Almadhor, A. 2024b. An anomaly detection model based on deep auto-encoder and capsule graph convolution via sparrow search algorithm in 6G internet-of-everything. IEEE Internet of Things Journal, 11, 29402–29411.

  24. Yin, S., Li, H., Teng, L., Laghari, A.A., Estrela, V.V. 2024c. Attribute-based multiparty searchable encryption model for privacy protection of text data. Multimedia Tools and Applications, 83, 45881–45902.

  25. Zhang, S., Caragea, D., Ou, X. 2011. An empirical study on using the national vulnerability database to predict software vulnerabilities. Lecture Notes in Computer Science, 22, 217–231.


ARTICLE INFORMATION

Received: 2025-01-21
Revised: 2025-02-21
Accepted: 2025-03-09
Available Online: 2025-03-23


Cite this article:

Alanazi, F., Alshammari, A.B., Sallami, C., Alhashmi, A.A., Effghi, R., Kumar, A., Darem, A. 2025. Enhancing cybersecurity vulnerability detection using different machine learning severity prediction models. International Journal of Applied Science and Engineering, 22, 2025013. https://doi.org/10.6703/IJASE.202503_22(1).003

  Copyright The Author(s). This is an open access article distributed under the terms of the Creative Commons Attribution License (CC BY 4.0), which permits unrestricted use, distribution, and reproduction in any medium, provided the original author and source are cited.

Other people also read ...