{'fraction_non_alphanumeric': 0.029777278113700588, 'fraction_numerical': 0.018777916198231593, 'mean_word_length': 4.644314868804665, 'pattern_counts': {'":': 0, '<': 0, '<?xml version=': 0, '>': 0, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 3, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
Measurements of the Most Significant Software Security Weaknesses

In this work, we provide a metric to calculate the most significant software security weaknesses as defined by an aggregate metric of the frequency, exploitability, and impact of related vulnerabilities. The Common Weakness Enumeration (CWE) is a well-known and used list of software security weaknesses. The CWE community publishes such an aggregate metric to calculate the `Most Dangerous Software Errors'. However, we find that the published equation highly biases frequency and almost ignores exploitability and impact in generating top lists of varying sizes. This is due to the differences in the distributions of the component metric values. To mitigate this, we linearize the frequency distribution using a double log function. We then propose a variety of other improvements, provide top lists of the most significant CWEs for 2019, provide an analysis of the identified software security weaknesses, and compare them against previously published top lists.


INTRODUCTION
In 2019, there were over 17 000 documented software vulnerabilities [22] that enable malicious activity. While many are discovered, they map to a relatively small set of underlying weakness types. We posit that if the most significant of these types can be identified, developers of programming languages, software, and security tools can focus on preventing them and thus over time diminish the quantity and severity of newly discovered vulnerabilities.
In this work, we provide a metric to calculate the most significant security weaknesses (MSSW) in software systems. We define a 'significant' weakness as one that is both frequently occurring among the set of publicly published vulnerabilities and results in high severity vulnerabilities (those that are easily exploitable and have high impact). The set of security weakness types upon which we calculate significance comes from the Common Weakness Enumeration (CWE) [15]. We also leverage the Common Vulnerabilities and Exposures (CVE) [13] repository of publicly announced vulnerabilities, the Common Vulnerability Scoring System (CVSS) [7] to measure the severity of vulnerabilities, and the National Vulnerability Database (NVD) [22] to map the CVEs to both CWEs and CVSS scores.
In the fall of 2019, the CWE community published an equation to calculate the 'Top 25 Most Dangerous Software Errors' (MDSE) among the set of CWEs [17]. It follows the form of the common security risk matrix combining probability and severity (e.g., [5]). The MDSE equation claims to combine 'the frequency that a CWE is the root cause of a vulnerability with the projected severity'; the equation description implies that both factors are weighed equally (making no mention of any bias). However, we empirically find that the equation highly biases frequency and almost ignores severity in generating top lists of varying sizes. This is due to the equation multiplying calculated frequency and severity values together though each has has very different distributions. Frequency distributions have a power law like curve, while severity distributions are more uniform. Our mitigation is to create a revised equation, named MSSW, that adjusts the frequency distribution using a double log function to better match it to the severity distribution. We also fix an error in how normalization is done in the MDSE equation.
We next improve upon the data collection approach used by the MDSE equation by leveraging published literature [12]. Lastly, we publish top lists of the most significant CWEs for 2019, provide an analysis of those software security weaknesses, and compare our top lists against previously published lists. It is our hope that our data and methodology will be adopted to focus our collective security resources in reducing the most significant software security weaknesses.
The rest of this work is organized as follows. Section 2 provides background on CVE, CVSS, CWE, NVD, and the MDSE equation. Section 3 discusses the limitations of the MDSE equation. Section 4 arXiv:2104.05375v1 [cs.CR] 12 Apr 2021 presents our MSSW equation that mitigates the previously identified limitations. Section 5 provides two lists of the most significant CWEs at two different levels of software flaw type abstractions. Section 6 provides a discussion and analysis of the most significant CWEs identified. Section 7 presents related work, Section 8 discussed possible future research, and Section 9 concludes.

BACKGROUND 2.1 Common Vulnerabilities and Exposures
The CVEs are a large set of publicly disclosed vulnerabilities in widely-used software. They are enumerated with a unique identifier, described, and referenced with external advisories [13] [1].

Common Vulnerability Scoring System
CVSS 'provides a way to capture the principal characteristics of a vulnerability and produce a numerical score reflecting its severity' [6]. The CVSS base score reflects the inherent risk of a vulnerability apart from any specific environment. The base score is composed from two sub-scores that calculate exploitability (how easy it is to use the vulnerability in an attack) and impact (how much damage the vulnerability can cause to an affected component).
The exploitability score is determined by the following: • attack vector: 'the context by which vulnerability exploitation is possible', • attack complexity: 'the conditions beyond the attacker's control that must exist in order to exploit the vulnerability', • privileges required: 'the level of privileges an attacker must possess before successfully exploiting the vulnerability', and • user interaction: a human victim must participate for the vulnerability to be exploited.
The impact score is determined by measuring the impact to the confidentiality, integrity, and availability of the affected system. Also included is a scope metric that 'captures whether a vulnerability in one vulnerable component impacts resources in components beyond its security scope'. The specifics on these metrics and the details for the three equations can be found in the CVSS version 3.1 specification at [7].

Common Weakness Enumeration
The Common Weakness Enumeration (CWE) [10] is a 'communitydeveloped list of common software security weaknesses'. 'It serves as a common language, a measuring stick for software security tools, and as a baseline for weakness identification, mitigation, and prevention efforts' [15]. It contains an enumeration, descriptions, and references for 839 software weaknesses that are referred to as CWEs, where each is labelled CWE-X with X being an integer. The CWE weaknesses model has four layers of abstraction: pillar, class, base, and variant. There is also the notion of a compound, that associates two or more interacting or co-occurring CWEs [18]. These abstractions reflect to what extent issues are described in terms of five dimensions: behavior, property, technology, language, and resource. Variant weaknesses are at the most specific level of abstraction; they describe at least three dimensions. Base weaknesses are more abstract than variants and more specific than classes; they describe two to three dimensions. Class weaknesses are very abstract; they describe one to two dimensions, typically not specific about any language or technology. Pillar weaknesses are the highest level of abstraction.
There are a set of taxonomies, called views, to help organize the CWEs. Two prominent CWE taxonomies are the 'Research Concepts' (view 1000) and 'Development Concepts' (view 699). There is also a view 1003 that was made specifically to describe the set of CVEs that contains 124 CWEs. It is called 'CWE Weaknesses for Simplified Mapping of Published Vulnerabilities View'.

National Vulnerability Database
The CWE effort uses the National Vulnerability Database (NVD) [22] as a repository of data from which to calculate the MDSE scores. The NVD contains all CVEs and for each CVE it provides a CVSS score along with the applicable CWE(s) that describe the weakness(es) enabling the vulnerability. For the empirical work in this paper, we use the complete set of 17 308 CVEs published by NVD for 2019, that were available as of 2020-03-19.

Most Dangerous Software Error Equation
The MDSE equation is designed to balance the frequency and severity in ranking the CWEs. The frequency is determined by the number of CVEs that map to a given CWE in the time period of study. The severity is determined by the mean CVSS score for the CVEs mapped to a given CWE. The MDSE score for a CWE is produced by multiplying the normalized frequency by the normalized severity and then multiplying by 100. We now describe this metric more formally. For CWE ∈ , let be the number of CVEs mapped to , defined as follows: Now let be the normalized frequency for CWE , defined as follows: 2.5.2 Metric for Normalized Severity. Let , , and be as defined above in Section 2.5.1. Let be the CVSS base score for CVE . For CWE ∈ , let be the mean CVSS score, defined as follows: Now let be the normalized severity for CWE , defined as follows:    Figure 1. The bottom red line represents the set difference using frequency and the yellow middle line represents the set difference using severity. The top blue line shows the maximal possible set difference that could be achieved using the 124 CWEs.
More qualitatively, the red line hovers close to a y-axis value of 0 which means that for all list sizes the top list generated using just frequency is almost identical to the top list generated using the MDSE equation. The middle yellow line being far from the y-axis value of 0 means that for all list sizes the top list generated using just severity is very different from the top list generated using the MDSE equation. Note that the yellow line shows an almost maximal difference for top list sizes of up to 15.

Limitation 1: Distribution Differences
The MDSE equation in practice biases frequency over severity, even though its equations treat them equally, because frequency and severity have very different distributions. The frequency distribution has the majority of CWEs at a very low frequency and a few at a very high frequency (somewhat resembling a power law curve). This can be seen in Figure 2 by looking at how each CWE maps to the x-axis (note that most of the yellow dots overlap, there are 102 yellow dots and 20 red triangles). The figure shows the MDSE scores for each CWE and shows how (for a top list of size 20) the top scoring chosen CWEs are exactly the most frequent CWEs. This is not unique and occurs for many top lists (e.g., for sizes 11, 13, 15, 16, 20, 21, 32, and 38) as shown when the bottom red line is at 0 in Figure 1. The other sizes of top lists produce graphs that are almost identical to that in Figure 2, with at most 3 yellow circles just to the right of the leftmost red triangles representing the chosen CWEs.
The severity distribution is more uniform within a limited range. It can be seen in Figure 3

Limitation 2: Normalization Error
Equation 5 normalizes based on the maximum and minimum CVSS score found in the set of inputted CVEs. However, this does not lead to the expected and desired normalized distribution from 0 to 1. For our data the range is from .28 to .97, as can be seen from the mappings of the points onto the x-axis in Figure 3. The reason for this is that has a smaller range than the maximum and minimum CVSS score because each represents the mean of the CVSS score for the CVEs that map to CWE . This limitation, while of less consequence than the previous, constrains the range of values thus further lessening the influence that severity has in determining a MDSE score.

MITIGATED EQUATION
We mitigate the limitations of the MDSE equation by replacing equations 3, 5, and 6 with the five equations that follow: = ′′ * ′ * 100.  values between 0 and 1 (to match the severity range in equation 10). These three equations modify the power law like frequency distribution to make it more linear, thus addressing limitation 1 (from Section 3.1). This can be seen in Figure 4. Each value on the x-axis represents a particular CWE, ordered from least frequent to most frequent. The lower blue line represents the normalized frequency (i.e., number of CVEs mapped to a particular CWE). Note the slow increase in frequency up to the 100th CWE, followed by a rapid increase terminating in an almost vertical line (i.e. large derivative). This behavior creates large differences between the most frequent CWEs and almost no difference between the lowest CWEs. If ( ) = log ( ) its derivative is

Explanation of Mitigated Equation
thus applying a log function over the frequency should minimize differences between the most frequent CWEs. The middle yellow line represents taking the log of the frequency (equations not shown), which helps linearize but still results in an upwards curve on the right side. Thus, we apply a double log for further linearization (see the top red line). We note that this approach is not pseudo-linear for the most infrequent of CWEs. However, this does not cause problems as our goal is to identify the most significant and any such CWE must have at least a moderate frequency.
Our modified MDSE equation 11 then multiplies frequency and severity as in the original MDSE equation, but it multiplies from two distributions that have a similar shape for the part of the functions that are of interest. This enables the MSSW equation to more fairly balance evaluating frequency and severity in scoring and ranking a CWE.
To address limitation 2 from Section 3.2, equation 10 normalizes the severity using the maximum and minimum mean severity values. This gives the distribution a full 0 to 1 range which is not achieved in the MDSE equation 5.

Analysis of Mitigated Equation
We now conduct three experiments to evaluate the effect of the MSSW equation in making the frequency and severity distributions more similar and in producing top lists with more equal inclusion of both frequency and severity. A fourth experiment involving correlation calculations is provided in Section 5 (because it includes some variants introduced in that section). Figure 5 shows an MDSE risk map for the evaluated CWEs. Each red dot represents a CWE positioned according to its severity and frequency. In general, CWEs towards the upper right are more significant and those towards the lower left are less significant. Note how the majority of the CWEs are squished very close to the x-axis as many have a very small frequency. Also, the range of x-values is constrained from .37 to .97 (when the normalization should make it from 0 to 1).  Figure 6 shows the same risk map using our double log frequency ′′ and our modified severity ′ . Note how the CWEs are now more uniformly spread over the y-axis. Also, the range of x-axis values is now from 0 to 1. The MSSW equation that combines frequency and severity using the values shown in Figure 6 will now more equally combine them than with the MDSE values shown in Figure 5. Figure 7 we show the size of the set difference between the MSSW top list and the severity top list (the mostly lower red line). We also calculate the set difference between the MSSW top list and the frequency top list (the middle yellow line). Note how the red and yellow lines are much closer together than in Figure 1 and how the red line does not hover close to 0 like it does in Figure 1. This demonstrates that the MSSW equation is more evenly balancing inclusion of the top frequency and top severity CWEs.

Set Difference Experiment. In
Note that the goal is not to have the red and yellow lines match. The top list should not necessarily evenly include an equal number of both top frequency and top severity CWEs. Our point with this analysis is to show how the MDSE equation almost exclusively chooses the top frequency CWEs and how our MSSW equation factors in CWEs from both sets. The next subsection will evaluate this more equal inclusion in more detail, focusing on top lists of size 20. Figure 8 shows the MSSW scores plotted against the double log frequency ′′ scores. Each point represents a CWE. The red triangles indicate the CWEs that were chosen for the MSSW top 20 list. Note how unlike in the analogous Figure 2 for MDSE, there are many higher frequency CWEs that are not chosen for the top 20 list due to their severity not being high enough.

Chosen CWE Experiment.
Likewise, Figure 9 shows the MSSW scores plotted against the ′ normalized mean CVSS score for each CWE. Note how the range spreads from 0 to 1, unlike the analogous Figure 3 for the MDSE

2019 TOP 20 LISTS OF THE MOST SIGNIFICANT WEAKNESSES
We now use our MSSW equation to generate lists of the most significant software security weaknesses. We choose a list size of 20, somewhat arbitrarily, to enable the lists to conveniently fit on a page. We performed the experiments on a variety of list sizes and did not discover any appreciable differences. We did not choose a size of 25 to match the CWE top list because we needed to produce two top lists of differing levels of abstraction to get the most accurate results (explained below) and thus were unable to produce a single list of 25 CWEs for an ideal comparison with the CWE top 25 list.
We follow the approach in [12] of separately providing a top list for CWEs of higher levels of abstraction (pillars and classes) apart from a list covering CWEs of lower levels of abstraction (bases, variants, and compounds). This was done in [12] to avoid errors in frequency calculations that exist in CWE's top 25 list. The paper argues that CWEs mapped to lower level abstractions (e.g., bases) also should count towards their parent abstractions (e.g., classes); this is not done with MDSE calculations. For example, class CWE-20 (Improper Input Validation) is a parent of base CWE-1289 (Improper Validation of Unsafe Equivalence in Input). If a vulnerability exists with CWE-1289, then CWE-20 also needs to be taken into account with the CWE frequency counts. However when this frequency propagation is performed, combining together the two abstractions results in a single top list with a bias towards parents with many children (especially popular children). Thus the 2 levels of abstraction need to be presented in separate top lists.
We will refer to the higher level abstraction list as the class list and the lower level abstraction list as the base list for convenience and because both lists are primarily composed of either classes or bases. We also follow [12] in using published CWE taxonomy views 1000 and 1008 (discussed in Section 2.3) to propagate CVE data from child CWEs to their parents (discussed above). This provides a more accurate mapping of CVEs onto the CWEs, providing a more accurate data foundation upon which to apply our MSSW equation. 2 These modifications also alter the frequency and severity distributions which could potentially render our double log function invalid. However, Table 1 shows correlation results for using and not using all combinations of the modifications adopted from [12]. It shows that the MDSE equation is highly correlated to frequency (.97 or higher) with very little correlation to severity (.25 or lower) regardless of the modifications used or not used. It also shows that the MSSW equation is strongly correlated to both frequency (.81 or higher with one exception) and severity (.66 or higher) regardless of the modifications used. Our one exception is for the class list using propagation with MSSW; even here the frequency correlation was .55 (still strong but much less than the others).
Note that our objective is not for the correlations to necessarily be equal, but that there exists a strong correlation for both frequency and severity. Depending upon the data, the higher frequency CVEs may or may not also be the highest severity CVEs. If so, then the correlations to frequency and severity would both be very high and almost equal. If not, both should still be high but one may be higher than the other. What we do not want in these results is for one of frequency or severity to have a high correlation and the other to have a very low correlation (which can be seen with the MDSE equation).
We also checked to see that the double log still linearized the frequency distribution when using both variants from [12]. While propagating CVEs over the CWEs using the CWE taxonomies and using all applicable CWEs (i.e., pillars, classes, bases, variants, and 2 This propagation especially helps the formulation of the class list since most classes have children. It has a lesser effect on the base list. Note that it is impossible to inverse the propagation of data. CWEs are labelled as specifically as possible by NVD analysts so CVEs described by pillar or class CWEs do not get reflected in the base list. It is even possible that they shouldn't because there may be unidentified bases missing from view 1003 that are still covered by the view 1003 classes.  compounds), the results show that the double log does still linearize the frequency (see Figure 10). The same results were obtained while also performing the experiment using just the pillars/classes and then just the bases, variants, and compounds (graphs not shown). Using our MSSW equation to aggregate the frequency and severity of CWEs, the top 20 class list for 2019 is shown in Table 2. The top 20 base list is shown in Table 3. These two lists use the modification from [12] where the CVEs are propagated up through the CWE taxonomies. We claim that these two lists represent the most accurate measurement yet produced for determining the most significant software security weaknesses. Given that there is no ground truth for how to best combine frequency and severity and no ground truth upon which to establish the correctness of the CVSS metric, it is likely impossible to prove any such metric as maximally effective. We make our 'most accurate measurement yet' claim based on the demonstrated limitations in the published MDSE equation and a lack of competing published alternatives.

DISCUSSION AND ANALYSIS OF THE MOST SIGNIFICANT WEAKNESSES
In this section, we evaluate our 2019 MSSW class and base lists (see Tables 2 & 3) and compare them against the 2019 CWE Top 25 MDSE List [17] (reproduced in Table 4).
As stated previously, we expect the MDSE list to vary from the MSSW class and base lists because: (1) the MDSE list is biased towards the frequency of a CWE occurring in CVEs, (2) we use the taxonomy propagation approach from [12], and (3) the class and base lists contain a total of 40 CWEs while the MDSE list contains 25 CWEs. A simple inspection of the list shows how parent CWEs do not receive CVE counts from their children. For example, the count for the top class CWE-119 (rank 1, count 1048) does not include the counts of its children CWE-125 (rank 5, count 678) and CWE-787 (rank 12, count 473). Analogously, the count for the class CWE-287 (rank 13, count 299) does not include the counts of its children base CWE-798 (rank 19, count 91) and base CWE-295 (rank 25, count 77).

High Level Summaries
Our MSSW class list is comprised of 19 class CWEs and the pillar CWE-682 (rank 9) -see Table 2. Only three CVEs are directly described with the pillar, but it appears in the list because there is a set of severe CVEs described with its children (see subsection 6.5). Our MSSW base list is comprised of 17 bases, the variants CWE-416 (rank 7) and CWE-415 (rank 14), and the compound CWE-352 (rank 10) -see Table 3. Each of the two lists properly compare items of the same kind. Interestingly but not surprisingly, each CWE from the base list is a child of a CWE from class list. However, the ordering of these parent-child pairs are not necessarily preserved between the two lists.

Reordered Rankings
The    Table 3). The MDSE list also contains these five CWEs, however the rankings of the first three are 6, 16, and 11 due to their lower frequencies of 397, 85, and 217. The MSSW inclusion of their high severity scores of 8.89, 9.01, and 8.58 moved them several positions up in the base list. Note that CWE-502 covers Object Injection. Also of importance is that the second ranked in the MDSE list CWE-79 (Cross-site Scripting), is not in our MSSW base list. Although it has the highest frequency of 1571, its severity score of 5.83 is relatively low.
The MSSW class list includes CWE-913 (Improper Control of Dynamically-Managed Code Resources), CWE-116 (Improper Encoding or Escaping of Output), and CWE-74 (Injection), ranked 1, 14, and 16 (see Table 2). The reason for that is CWE-913 is the parent of CWE-502, CWE-116 is a typical cause of injection and CWE-74 is the parent of CWE-78, CWE-89, and CWE-94. Interestingly, the class CWE-74 has rank 16 among classes, while its children bases CWE-89, CWE-78, and CWE-94 are ranked 1, 4, 6 among bases. The frequencies of 2455 for CWE-74, 384 for CWE-89, 194 for CWE-78, and 100 for CWE-94, leave 1777 injection CVEs that are described with CWEs that are either very infrequent or not severe. These are bases CWE-79 (Cross-site Scripting) with the low severity of 5.83, CWE-88 (Argument Injection) with the low frequency of 6, and CWE-91 (XML Injection) with the low frequency of 16. Being not too dangerous they bring the class CWE-74 down to rank 16. That same base CWE-79, not included in the MSSW base list, is ranked 2nd in the MDSE list due to the frequency biasing.

Memory
Weaknesses. The most dangerous memory weaknesses are CWE-787 (Out-of-bounds Write) and CWE-120 (Classic Buffer Overflow) with ranks 3 and 5 -see Table 3. Both of them are included in the base list but not the MDSE list, due to the correction of the frequency bias towards proper inclusion of their severity scores of 8.34 and 8.55.
The other memory weaknesses in the MSSW class and base lists are as follows: • bases CWE-125 and CWE-787 are buffer overflow (out of bounds read or write) • variant CWE-416 is use after free (use of deallocated memory through a dangling pointer) • variant CWE-415 is double free (deallocate of already deallocated memory) • class CWE-119 is a general memory corruption weakness, which includes buffer overflow, use after free and double free. • class CWE-400 is memory overflow (stack/heap exhaustion) [21] 6.4.3 Injection/Memory Weakness Comparison. Compared to MDSE, the MSSW equation brings up several injection weaknesses with much higher severity than that of any memory weaknesses. The related CVE analysis confirms that the injection CVE are easier to exploit and with higher impact. An injection directly leads to arbitrary command, code, or script execution. Once a SQL injection is in place, there is no need of additional sophisticated attack crafting or use of glitches in the system. However, it takes considerable extra effort for an attacker to turn a buffer overflow into an arbitrary code execution. He or she would need to have exceptional skills, such as to apply spraying memory techniques. The possible damage from an Object injection or from an SQL injection or from is very high. Object injection could lead to remote code execution. An SQL injection may expose huge amounts of structured data, which is proven to be more valuable than raw data. Well formed structured data is easy to read, sort, search, and make sense of it. Via an SQL injection, an attacker could modify a database -insert, update, delete data, execute admin operations, recover file content, and even issue OS commands [25].

Next Most Dangerous CWEs
The next most dangerous groups of weaknesses in the MSSW class and base lists relate to file input and upload, authentication, randomization, cryptography, arithmetics and conversion, and input validation: •

RELATED WORK
The constant need to improve information security has motivated a widespread interest in metrics (both qualitative [8] and quantitative [23]). As stated by Lord Kelvin, you cannot improve if you cannot measure. However, many members of the software security community doubt our ability to quantify security. Bellovin was among the first [2] to argue about the infeasibility of software security metrics. [4] discusses the limitations of the celebrated "Risk = Threat × Vulnerability × Consequence" model that is widely used.
In [30] Verendel presents a critical survey of results and assumptions made in the community to quantify security. After reviewing over 100 articles, he concludes that the validity of most methods is still strikingly unclear. Many reasons explain this invalidity: lack of validation, lack of comparison against empirical data, and the fact that many assumptions in formal treatments are not empirically well-supported in operational security.
Although we agree, we posit that acceptable but possibly imperfect metrics must be developed in order to facilitate security decisions and to evaluate changes in security posture. To this end, there have been substantial efforts to produce security metrics; [30] surveys the literature of security metrics published between 1981 and 2008. More efforts can be found in [28], [26], and [20]. Security metrics that produce lists of the top security issues are also very prevalent [29], [11]. Specific to software security, there is the OWASP Top 10 [24] for web applications. Also, the CWE project has the Common Weaknesses Scoring System (CWSS) [14] and the Common Weakness Risk Analysis Framework (CWRAF) [16], which are used together to provide the most important weaknesses tailored to a particular organization.
There is also work to critique and improve the foundational data structures used by the MDSE and MSSW metrics. CWEs have been discussed in [31]. An entirely new approach to classifying software bugs (weaknesses) is proposed by [3] and is currently under development. The evolution of CWE is documented in [19] (e.g., the addition of classification trees and content for mobile applications and hardware). A critique of CVSS is available in [9]. In [12] a novel CWE data collection method is proposed along with simple atomic software security metrics. Our approach in contrast is an aggregate metric designed to be a direct replacement for the MDSE equation.
Along with much other work, our research should be considered as an important step in the process to improve CWE. We believe that our contribution is major as it points out a serious bias in the CWE MDSE equation that is preventing accurate measurements of the most significant software security weaknesses.

FUTURE WORK
This goal of this work is to identify and fix the unintended bias in the MDSE equation towards frequency. Thus we design the MSSW equation to, as evenly as possible, factor together frequency and severity. And this is rational as it models typical security risk matrices that equally combine probability and impact (e.g., [5]). However, it is possible that intentionally biasing towards either frequency or severity is more useful in this domain. Also, the CVSS severity equation is itself an aggregate of exploitability and impact. Future work should evaluate whether or not any intentional bias should be added between these 3 factors.
Also, future work should evaluate additional metrics that might be useful for determining the most significant CWEs. In particular, it would be useful to identify CWEs whose associated vulnerabilities are frequently used in actual and impactful breaches. We note that the CVSS temporal equations provide some of this, but these results are not commonly calculated and no public repository of this data exists. That said, some data does exist to support such mappings (e.g., [27]).

CONCLUSION
The field of security metrics is a difficult area of scientific research because there is often no ground truth, unlike disciplines such as physics and chemistry. This may lead one to focus on just taking simple low level measurements that are inherently defensible; that was the approach taken in [12]. However, creating aggregate metrics that compose multiple simple measurements is of practical importance for the field of security. In this work we did just that, aggregating frequency and severity (i.e., exploitability and impact) into a single metric. Our objective is not for the correlations to necessarily be equal, but that there exists a strong correlation for both factors which more evenly balances the inclusion of the top frequency and top severity CWEs. This seemingly simple task proved challenging because of the differing distributions of both simpler metrics. Indeed, the officially published CWE metric neglected this property and did not achieve its stated objective (almost exclusively choosing the most frequent CWEs). With our work, we claim to have addressed the limitations and to have produced the most accurate equation yet for measuring the most significant software security weakness.