Real Time Vulnerability Alerting
summary
System ingests public feeds (NVD, Exploit-DB, vendor advisories, blogs, Twitter), stores records in RDS relational DB, and uses multiple AWS Lambda jobs plus a simple weighted scoring analytics lambda to rank emergent CVEs. Over two years it surfaces a tiny set of truly seismic issues (Meltdown/Spectre, BlueKeep, WhatsApp RCE, recent Windows cert bug) and consistently flags far fewer alarms than raw CVSS lists — first-month result was 4 vs 96 high CVSS items.
AI-written summary · about
chapters (19)
- 0:00Intro
- 2:26Outline
- 6:40Tsunami Facts
- 8:08Deep Ocean Assessment and Reporting
- 10:06Data Analytics
- 10:44Can principles from Tsunami warning system applied for cyber attacks?
- 11:34Data Collection
- 15:34Technology
- 22:13First Month Report
- 24:59Vulnerability Details
- 25:505 days later
- 27:54Need for easy classification
- 28:55First month classification
- 29:33First month prioritization: CVSS vs Alerts
- 34:34Six month prioritization: CVSS vs Alerts
- 35:42One year data
- 36:48One year prioritization: CVSS vs Alerts
- 38:24All data
- 43:43Future work
related talks
44mReal Time Vulnerability Alerting by Using Principles from the United States Tsunami Warning Center
36mUsing AI to Discover Silently Patched Vulnerabilities in Open...
58mWhy Can't We All Just Get Along? Bridging the Gap in Vulnerability Prioritization Standards
25mAutomating Cyber Threat Intelligence: A Practical Approach to Managing Emerging Vulnerabilities
50mWorrisome Web Vulnerability Trends in the Race to Innovation
51mPanel Discussion: It is a Tale as Old as Time…. a CNA, the NVD, and a CVE Consumer Walk Into a ...
24mSecurity Advisories and Vulnerability Prioritization in the Wild
40mOpen Source CVE Monitoring and Management: Cutting Through the Vulnerability Storm