Article in ssrn electronic Journal · July 015 doi: 10. 2139/ssrn. 2634590 citations 32 reads 1,108 author: Some of the authors of this publication are also working on these related projects

Figure 3: Normalized versus Absolute Domains
0 
10000 
20000 
30000 
40000 
50000 
60000 
70000 
80000 
0 
50 
100 
150 
200 
250 
300 
350 
2008 
2009 
2010 
2011 
2012 
2013 
2014 
Number of Malicious Domain Names per 1,000,000 
Domains
Malicious Web Domains 
Malicious Web Domains per 1,000,000 Domain Names 
Linear (Malicious Web Domains) 
Linear (Malicious Web Domains per 1,000,000 Domain Names) 
Figure 4 presents the data on the number of zero-day 
vulnerabilities normalized around the number of Internet 
users, web domains and the number of websites, and 
contrasts these numbers with the absolute trend. As 
with new vulnerabilities, the best measure to normalize 
zero-day vulnerabilities around would be the number of 
software programs used in the world, the data for which 
does not exist. Nevertheless, since zero-day vulnerabilities 
are weaknesses in computer code, the normalization 
that makes the most sense is the number of zero-days 
per 1,000,000 websites, since websites rely on a growing 
number of software platforms (think of the Heartbleed 
zero-day exploit in Secure Sockets Layer [SSL] in 2014). In 
the interest of presenting the broadest possible story, the 
number of zero-day vulnerabilities normalized around the 
number of Internet users and email users are also included 
(both proxies for the number of potentially vulnerable 
devices operating various pieces of software). 
The dotted trend line in Figure 4 shows that over time 
the absolute number of zero-day vulnerabilities is 
getting larger, suggesting a worsening cyber security 
environment. This finding is mirrored by the trend in 
zero-day vulnerabilities per 1,000,000 email users and per 
1,000,000 Internet users. However, the trend in zero-day 
vulnerabilities per 1,000,000 websites is actually declining 
over time, despite a jump upward in 2013. To the extent 
that normalizing the number of zero-day vulnerabilities 
around the number of online websites is the most accurate 
measure of this vector of cyberattack, the fact that the 
trend is negative suggests that, as is the case with the other 
measures, the security of cyberspace is improving over 
time even as the absolute number of zero-day exploits 
increases.