Security vulnerability detection

• US 10,614,223 B2
• Filed: 05/28/2015
• Issued: 04/07/2020
• Est. Priority Date: 05/28/2015
• Status: Active Grant

• Current Assignee: Micro Focus LLC (Open Text Corporation)
• Original Assignee: Micro Focus LLC (Open Text Corporation)
• Inventors: Abramovsky, Ori, Weingart, Ori, Yosef, Maor
• Primary Examiner(s): Feild, Lynn D
• Assistant Examiner(s): Lakhia, Viral S
• Application Number:
  US15/574,628
• Publication Number:
  US 20180150639A1
• Time in Patent Office: 1,776 Days
• Field of Search: 713170
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: G06F 2221/033 Test or assess software

Abstract

In one example in accordance with tie present disclosure, a method for security vulnerability detection includes indexing a variety of internet sources comprising third party submitted information, to extract security vulnerabilities based on the third party submitted information. The method includes generating a security vulnerabilities list comprising security vulnerabilities from the internet source and generating a software components list comprising a software component used in an application. The method includes determining that a security vulnerability in the security vulnerabilities list affects the software component and determining a risk score of the security vulnerability. The method includes presenting the security vulnerability, the risk score and the software component via a user interface.

Claims

1. A method comprising:

indexing, by a system comprising a hardware processor, a plurality of internet sources comprising third party submitted information, to extract security vulnerabilities based on the third party submitted information;

generating, by the system, a security vulnerabilities list comprising the security vulnerabilities extracted from the plurality of internet sources, the security vulnerabilities list further identifying software components affected by respective security vulnerabilities in the security vulnerabilities list;

generating, by the system, a software components list comprising a software component used in an application;

determining, by the system based on matching the software components identified in the security vulnerabilities list with the software component in the software components list, that a security vulnerability in the security vulnerabilities list affects the software component;

determining, by the system, a risk score of the security vulnerability;

generating information for presentation, via a user interface, of the security vulnerability, the risk score, and the software component; and

adjusting, by the system, the risk score based on a number of security vulnerabilities found for the software component and whether a fix has been provided for each security vulnerability of the number of security vulnerabilities.

2. The method of claim 1, further comprising:

determining a reliability metric for each respective internet source of the plurality of internet sources, wherein the reliability metric is based on an accuracy of information provided by the respective internet source,

wherein the adjusting of the risk score of the security vulnerability is further based on the determined reliability metrics for the plurality of internet sources.

3. The method of claim 1, further comprising:

determining an amount of use of the software component,

wherein the adjusting of the risk score of the security vulnerability is further based on the determined amount of use of the software component.

4. The method of claim 1, wherein the generating of the software components list is based on scanning a resource of the application.

5. The method of claim 1, wherein the adjusting of the risk score is further based on one or more of a number of comments from an internet source of the plurality of internet sources, or an amount of internet traffic to an internet source of the plurality of internet sources.

6. The method of claim 1, wherein the indexing of the plurality of internet sources comprises indexing one or more of:

a web site where individual users can submit information, a forum, a blog, a news site, or a social network.

7. The method of claim 1, wherein the indexing of the plurality of internet sources comprises indexing a community internet source comprising information that originates from a community member.

8. The method of claim 1, wherein the indexing of the plurality of internet sources comprises indexing an unstructured data source comprising third party submitted information regarding security vulnerabilities.

15. The method of claim 1, further comprising:

detecting a change of the application; and

scanning the application to generate the software components list in response to detecting the change of the application.

16. The method of claim 15, further comprising:

updating the security vulnerabilities list in response to detecting the change of the application.

9. A system comprising:

a processor; and

a non-transitory storage medium storing instructions executable on the processor to;

index a plurality of internet sources comprising third party submitted information, to extract security vulnerabilities based on the third party submitted information;

generate a security vulnerabilities list comprising the security vulnerabilities extracted from the plurality of internet sources, the security vulnerabilities list further identifying software components affected by respective security vulnerabilities in the security vulnerabilities list;

generate a software components list comprising a software component used in an application, and a version of the software component;

determine, based on matching the software components identified in the security vulnerabilities list with the software component in the software components list, that a security vulnerability in the security vulnerabilities list affects the version of the software component from the software components list;

determine a risk score of the security vulnerability;

generate information for presentation, via a user interface, of the security vulnerability, the risk score, the software component, and the version of the software component;

determine a reliability metric for each respective internet source of the plurality of internet sources, wherein the reliability metric is based on an accuracy of information provided by the respective internet source; and

adjust the risk score of the security vulnerability based on the determined reliability metrics for the plurality of internet sources.

10. The system of claim 9, wherein the instructions are executable on the processor to index the plurality of internet sources that comprise an unstructured data source comprising third party submitted information regarding security vulnerabilities.

11. The system of claim 9, wherein the instructions are executable on the processor to adjust the risk score further based on a number of security vulnerabilities found for the software component, and whether a fix has been provided for each security vulnerability of the number of security vulnerabilities.

17. The system of claim 9, wherein the instructions are executable on the processor to:

detect a change of the application; and

scan the application to generate the software components list in response to detecting the change of the application.

18. The system of claim 17, wherein the instructions are executable on the processor to:

update the security vulnerabilities list in response to detecting the change of the application.

12. A non-transitory machine-readable storage medium comprising instructions that upon execution cause a system to:

index a plurality of internet sources comprising third party submitted information, to extract security vulnerabilities based on the third party submitted information, wherein a third party is a party other than an original software vendor of a development platform;

generate a security vulnerabilities list comprising the security vulnerabilities extracted from the plurality of internet sources, the security vulnerabilities list further identifying software components affected by respective security vulnerabilities in the security vulnerabilities list;

generate a software components list comprising a software component used in the development platform, and a version of the software component;

determine, based on matching the software components identified in the security vulnerabilities list with the software component in the software components list, that a security vulnerability in the security vulnerabilities list affects the version of the software component from the software components list;

adjust a risk score of the security vulnerability based on a number of security vulnerabilities found for the software component and whether a fix has been provided for each security vulnerability of the number of security vulnerabilities; and

generate information for presentation, via a user interface, of the security vulnerability, the risk score, the software component, and the version of the software component.

13. The non-transitory machine-readable storage medium of claim 12, wherein the indexing of the plurality of internet sources comprises indexing an unstructured data source comprising third party submitted information regarding security vulnerabilities.

14. The non-transitory machine-readable storage medium of claim 12, wherein the instructions upon execution cause the system to:

adjust the risk score further based on one or more of a number of comments from an internet source of the plurality of internet sources, or an amount of internet traffic to an internet source of the plurality of internet sources.

19. The non-transitory machine-readable storage medium of claim 12, wherein the instructions upon execution cause the system to:

detect a change of the development platform;

scan the development platform to generate the software components list in response to detecting the change of the development platform; and

update the security vulnerabilities list in response to detecting the change of the development platform.