1. Load Dataset

# Load the dataset directly
cyber_data <- read.csv("C:/Users/Owner/Desktop/known_exploited_vulnerabilities.csv", stringsAsFactors = TRUE)

# Calculate vulnerability year and ransomware flag
cyber_data$cve_year <- as.numeric(sub("CVE-(\\d{4})-.*", "\\1", cyber_data$cveID))
cyber_data$is_ransomware <- ifelse(cyber_data$knownRansomwareCampaignUse == "Known", 1, 0)

# Calculate Total.Days from dueDate and dateAdded
cyber_data$dueDate <- as.Date(cyber_data$dueDate)
cyber_data$dateAdded <- as.Date(cyber_data$dateAdded)
cyber_data$Total.Days <- as.numeric(cyber_data$dueDate - cyber_data$dateAdded)

# Display first few lines to verify
head(cyber_data[, c("cveID", "dateAdded", "dueDate", "Total.Days")])
##            cveID  dateAdded    dueDate Total.Days
## 1 CVE-2026-82078 2026-08-31 2026-09-14         14
## 2 CVE-2026-81578 2026-08-31 2026-09-14         14
## 3 CVE-2023-49105 2026-08-27 2026-08-30          3
## 4 CVE-2026-53362 2026-08-27 2026-08-30          3
## 5 CVE-2026-66384 2026-08-27 2026-09-10         14
## 6 CVE-2021-23758 2026-08-26 2026-09-09         14

Question 1: Visualizing Top Targeted Vendors

# Get the top 10 most targeted vendors
top10_vendors <- sort(table(cyber_data$vendorProject), decreasing = TRUE)

# Create an annotated bar plot
barplot(top10_vendors,
        las = 2,
        col = "steelblue",
        main = "Top 10 Most Targeted Companies in CISA KEV Catalog",
        ylab = "Number of Known Exploited Vulnerabilities",
        cex.names = 0.8)

Explanation: This bar chart shows the 10 software companies with the highest count of known exploited vulnerabilities in the CISA(Cybersecurity and Infrastructure Security Agency) KEV catalog. The y-axis is the total number of security flaws cataloged, while the x-axis displays each company name. The visualization highlights which companies (such as Microsoft, Cisco, and Apple) are targeted.

Question 2: Simple Statistical Calculation

# Calculate summary statistics for Total.Days remediation window
mean_days   <- mean(cyber_data$Total.Days, na.rm = TRUE)
median_days <- median(cyber_data$Total.Days, na.rm = TRUE)
sd_days     <- sd(cyber_data$Total.Days, na.rm = TRUE)
iqr_days    <- IQR(cyber_data$Total.Days, na.rm = TRUE)

# Print values
cat("Mean remediation days:", round(mean_days, 2), "\n")
## Mean remediation days: 43
cat("Median remediation days:", round(median_days, 2), "\n")
## Median remediation days: 21
cat("Standard Deviation:", round(sd_days, 2), "\n")
## Standard Deviation: 58.79
cat("Interquartile Range (IQR):", round(iqr_days, 2), "\n")
## Interquartile Range (IQR): 0

Explanation: To assess the hypothesis when it comes to newer attacks being more urgent. The median represents the baseline time frame mandated by CISA for addressing exploited vulnerabilities. The large spread between the median and the standard deviation reflects notable variation, where certain critical security flaws are subject to expedited mitigation mandates compared to standard patching deadlines.

Question 3: Correlation and Scatter Plot with Regression Line

# 1. Fit simple linear regression between Total.Days and cve_year
model_q3 <- lm(Total.Days ~ cve_year, data = cyber_data)
model_summary <- summary(model_q3)

# 2. Extract correlation, R-squared, and p-value
r_val  <- cor(cyber_data$Total.Days, cyber_data$cve_year, use = "complete.obs")
r2_val <- model_summary$r.squared
p_val  <- model_summary$coefficients["cve_year", "Pr(>|t|)"]

cat("Correlation (r):", round(r_val, 4), "\n")
## Correlation (r): -0.2363
cat("R-squared (R^2):", round(r2_val, 4), "\n")
## R-squared (R^2): 0.0558
cat("p-value:", format.pval(p_val), "\n")
## p-value: < 2.22e-16
# 3. Create Scatter Plot with Regression Line
plot(cyber_data$cve_year, cyber_data$Total.Days,
     col = rgb(0.2, 0.4, 0.8, 0.4),
     pch = 16,
     main = "Vulnerability Age vs. Remediation Window",
     xlab = "CVE Publication Year",
     ylab = "Remediation Window (Total Days)")

# Add fitted regression line
abline(model_q3, col = "red", lwd = 2)

Explanation: I examined whether newer vulnerabilities face shorter remediation deadlines. The Pearson correlation coefficient (\(r = -0.23\)) demonstrates a statistically significant negative relationship (\(p < 2.2\times 10^{-16}\)). As the CVE publication year increases, the required remediation window decreases, as shown by the downward sloping regression line. While the \(R^2\) value of approximately \(0.05\) indicates that publication year alone accounts for a good amount of the overall variance, the negative slope confirms our hypothesis that newer, actively exploited zero day flaws receive shortened resolution timelines from CISA.

Question 4: Distribution of Remediation Window

# Plot an annotated histogram of Total.Days
hist(cyber_data$Total.Days,
     breaks = 30,
     col = "darkseagreen3",
     border = "white",
     main = "Distribution of Remediation Window (Total Days)",
     xlab = "Remediation Window (Days)",
     ylab = "Frequency of Vulnerabilities")

# Add a vertical dashed line for the median
abline(v = median(cyber_data$Total.Days, na.rm = TRUE), col = "red", lwd = 2, lty = 2)

# Add a vertical solid line for the mean
abline(v = mean(cyber_data$Total.Days, na.rm = TRUE), col = "blue", lwd = 2)

# Add a legend
legend("topright", 
       legend = c(paste("Median =", median(cyber_data$Total.Days, na.rm = TRUE)),
                  paste("Mean =", round(mean(cyber_data$Total.Days, na.rm = TRUE), 1))),
       col = c("red", "blue"), 
       lty = c(2, 1), 
       lwd = 2)

Explanation: This histogram displays the distribution of remediation windows (Total.Days) across the catalog. The data is heavily right-skewed rather than normally distributed. The majority of vulnerabilities cluster around the median of 21 days, showing the standard federal patching directives. However, a long right tail extends out past 100 to nearly 180 days, pulling the mean up to 43.0 days. Because the distribution is strongly skewed and non-normal, non-parametric statistical tests (like the Wilcoxon rank-sum test) or log transformations are appropriate when comparing subgroups.

Question 5: Group Comparison Test (Ransomware vs. Non-Ransomware)

# 1. Inspect the two groups
table(cyber_data$knownRansomwareCampaignUse)
## 
##   Known Unknown 
##     352    1335
# 2. Compare group medians and means
aggregate(Total.Days ~ knownRansomwareCampaignUse, data = cyber_data, 
          FUN = function(x) c(median = median(x), mean = mean(x), n = length(x)))
##   knownRansomwareCampaignUse Total.Days.median Total.Days.mean Total.Days.n
## 1                      Known          21.00000        46.94034    352.00000
## 2                    Unknown          21.00000        41.96629   1335.00000
# 3. Apply the Wilcoxon Rank-Sum Test (Mann-Whitney U Test)
group_test <- wilcox.test(Total.Days ~ knownRansomwareCampaignUse, data = cyber_data)
group_test
## 
##  Wilcoxon rank sum test with continuity correction
## 
## data:  Total.Days by knownRansomwareCampaignUse
## W = 241016, p-value = 0.3956
## alternative hypothesis: true location shift is not equal to 0

Explanation: To test whether threat type impacts remediation urgency, I divided the data set into two groups using the knownRansomwareCampaignUse column (352 Known vs. 1,335 Unknown). Because Total.Days is heavily right-skewed and non-normal (as shown in Question 4), I used the non-parametric Wilcoxon rank-sum test rather than a standard t-test.

The test yielded a test statistic of W = 241,016 and a p-value of 0.3956. Because the p-value is well above the significance threshold (alpha = 0.05), I fail to reject the null hypothesis. This indicates there is no statistically significant difference in the remediation deadlines assigned to ransomware-associated vulnerabilities compared to general exploited flaws; CISA enforces standardized remediation windows (predominantly 21 days) across all actively exploited catalog entries regardless of ransomware status.