Instruct: Identify the main and secondary category of Arxiv papers based on the titles and abstracts
Query: Attack Potential in Impact and Complexity   Vulnerability exploitation is reportedly one of the main attack vectors
against computer systems. Yet, most vulnerabilities remain unexploited by
attackers. It is therefore of central importance to identify vulnerabilities
that carry a high `potential for attack'. In this paper we rely on Symantec
data on real attacks detected in the wild to identify a trade-off in the Impact
and Complexity of a vulnerability, in terms of attacks that it generates;
exploiting this effect, we devise a readily computable estimator of the
vulnerability's Attack Potential that reliably estimates the expected volume of
attacks against the vulnerability. We evaluate our estimator performance
against standard patching policies by measuring foiled attacks and demanded
workload expressed as the number of vulnerabilities entailed to patch. We show
that our estimator significantly improves over standard patching policies by
ruling out low-risk vulnerabilities, while maintaining invariant levels of
coverage against attacks in the wild. Our estimator can be used as a first aid
for vulnerability prioritisation to focus assessment efforts on high-potential
vulnerabilities.

19
The categories of this paper are: eess
18
The categories of this paper are: econ
30
The categories of this paper are: q-alg
27
The categories of this paper are: comp-gas
24
The categories of this paper are: dg-ga
12
The categories of this paper are: nucl-th
7
The categories of this paper are: hep-th
4
The categories of this paper are: cond-mat
25
The categories of this paper are: patt-sol
36
The categories of this paper are: cmp-lg
8
The categories of this paper are: hep-ex
0
The categories of this paper are: hep-ph
32
The categories of this paper are: atom-ph
9
The categories of this paper are: nlin
35
The categories of this paper are: mtrl-th
14
The categories of this paper are: math-ph