Abstract: Vulnerability is the main origin of network security incident. A large number of vulnerabilities and their dangers make rating vulnerabilities become particularly important. This paper analyzes well-known security agencies and manufacturers’ characteristics of rating vulnerability, introduces the Common Vulnerability Scoring System(CVSS) and its shortcomings, proposes a more complete quantitative rating system CVRS on the basis of CVSS against CVSS’s shortcomings, and illustrates the validity and superiority of CVRS through some instances.

Key words: vulnerability, Common Vulnerability Scoring System(CVSS), rating method

摘要： 漏洞是网络安全事件的主要根源，漏洞的大量存在及其带来的危害使漏洞评级变得尤为重要。该文分析目前著名安全机构和生产厂商对漏洞进行评级的特点，介绍通用缺陷评估系统(CVSS)及其存在的缺点，在CVSS的基础上提出一种更完善的定量评级方法CVRS，通过评估实例说明了CVRS的有效性和优越性。

关键词: 漏洞, 通用缺陷评估系统, 评级方法

CLC Number: 

• TP309