Taxonomic analysis of classification schemes in vulnerability databases

Quantitative risk assessment of system security is emerging as an important research area in view of increasing population of vulnerabilities. Assessment on classified vulnerability datasets leads to effective vulnerability mitigation and risk analysis. An effective vulnerability classification scheme under rich taxonomic features that relates cause, impact and risk level can serve the purpose. However there is no common classification scheme in this regard. The focus of our research is taxonomic analysis of classification schemes in pertinent vulnerability databases, so as to identify issues involved and form a basis for development of a common classification scheme. Our objective is to shape and mature a classification scheme to accelerate research in the quantitative evaluation of risk levels as a measure of system security.