Exploited Before It Was Fixed? Vulnerability Timelines from Open, Machine-Readable Evidence

Status: draft. All sections drafted; open: the Telegram classifier's precision.

LaTeX source, measurement scripts and lab notes for a paper on measuring vulnerability lifecycle intervals, chiefly the interval between exploitation and patch availability, from open evidence: publisher timelines (GCVE BCP-05-X-03), CSAF advisories, several KEV catalogs and sightings, as held by Vulnerability-Lookup.

The dates and metrics follow the Vulnerability Timeline and Exposure Metrics framework (VTEM), presented by Kymberlee Price and Jake Kouns at Black Hat USA 2015, where the evidence has an equivalent. The question VTEM left open is whether the dates it needs are published; this paper measures how far open, machine-readable evidence gets today.

Reference implementation: the timeline durations of Vulnerability-Lookup (PR #714, merged as cadc9086), documented in docs/vulnerability-timeline.md of that repository.

Repository contents

File	Purpose
main.tex, references.bib	Paper source (draft)
abstract.txt	Abstract as plain text, within the arXiv limit
NOTES.md	Raw lab notebook: decisions, measurements, open questions
scripts/measure_coverage.py	Anchors and durations of every identifier with exploitation evidence (runs in a Vulnerability-Lookup checkout)
scripts/report.py	Coverage and duration tables from a measurement (standard library only)
scripts/patch_references.py	Patch-tagged (undated) references of the measured identifiers (runs in a Vulnerability-Lookup checkout)
scripts/fixed_versions.py	Fixed versions named by the records of the measured identifiers (runs in a Vulnerability-Lookup checkout)
scripts/sample_telegram_sightings.py	Checklist of Telegram sightings to verify by hand (issue #1)
results/	Measurement outputs (.jsonl.gz, one line per identifier) with their .meta.json and report

Reproducing the measurement

The measurement reads a Vulnerability-Lookup instance (Kvrocks storage, Redis cache and PostgreSQL running) through the same builder as the /api/vulnerability/<id>/timeline endpoint, and writes nothing to it. Check out the commit recorded in the result's .meta.json, then:

cd vulnerability-lookup
VULNERABILITYLOOKUP_HOME=$PWD poetry run python \
    ../exploitation-patch-timeline-paper/scripts/measure_coverage.py \
    --output ../exploitation-patch-timeline-paper/results/coverage-YYYY-MM-DD.jsonl
cd ../exploitation-patch-timeline-paper
gzip results/coverage-YYYY-MM-DD.jsonl
python3 scripts/report.py results/coverage-YYYY-MM-DD.jsonl.gz

The figures depend on the instance's data at the time of the run (feeds, KEV catalogs, sightings), so a later run on another instance will differ; the per-identifier output is kept so every figure can be traced to the anchor events behind it.

Building the PDF

pdflatex main.tex
bibtex main
pdflatex main.tex
pdflatex main.tex

License

The paper text and figures are licensed under CC BY-SA 4.0 (see LICENSE).