CVSS Information Update by Analyzing Vulnerability Information

• US 20140215629A1
• Filed: 01/31/2013
• Published: 07/31/2014
• Est. Priority Date: 01/31/2013
• Status: Active Grant

• Current Assignee: Micro Focus LLC (Open Text Corporation)
• Original Assignee: Hewlett-Packard Development Company, L.P. (HP Inc.)
• Inventors: Raz, Barak, Feher, Ben
• Granted Patent: US 9,003,537 B2
• Time in Patent Office: Days
• US Class Current: 726/25
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security

Abstract

An automated system for automatic update of a Common Vulnerability Scoring System (CVSS) score, the system including vulnerability information analyzing functionality to analyze preexisting vulnerability information, the preexisting vulnerability information relating to at least one of at least one vulnerability and at least one attack vector thereof, the at least one vulnerability having a preexisting CVSS score, the preexisting CVSS score being based at least partially on the preexisting vulnerability information, vulnerability information extraction functionality, responsive to the analyzing preexisting vulnerability information, to extract new vulnerability information, the new vulnerability information relating to the at least one of the at least one vulnerability and the at least one attack vector thereof, and CVSS score updating functionality to employ the new vulnerability information to update the preexisting CVSS score.

Claims

1. An automated system for automatic update of a Common Vulnerability Scoring System (CVSS) score, said system comprising:

vulnerability information analyzing functionality to analyze preexisting vulnerability information, said preexisting vulnerability information relating to at least one of at least one vulnerability and at least one attack vector thereof, said at least one vulnerability having a preexisting CVSS score, said preexisting CVSS score being based at least partially on said preexisting vulnerability information;

vulnerability information extraction functionality, responsive to said analyzing preexisting vulnerability information, to extract new vulnerability information, said new vulnerability information relating to said at least one of said at least one vulnerability and said at least one attack vector thereof; and

CVSS score updating functionality to employ said new vulnerability information to update said preexisting CVSS score.

2. An automated system for automatic update of a Common Vulnerability Scoring System (CVSS) score according to claim 1 and wherein said system also comprises a vulnerability database comprising a collection of vulnerability records and a collection of CVSS score records, each of said vulnerability records comprising information pertaining to a particular vulnerability relevant to the enterprise, each of said vulnerability records having a corresponding CVSS score record.

3. An automated system for automatic update of a Common Vulnerability Scoring System (CVSS) score according to claim 2 and wherein said preexisting vulnerability information is stored in at least one of said database and at least one publicly available web page.

4. An automated system for automatic update of a Common Vulnerability Scoring System (CVSS) score according to claim 3 and wherein said vulnerability information analyzing functionality is to analyze said preexisting vulnerability information from said least one publicly available web page by employing at least one of:

parsing the text of said least one publicly available web page;

matching elements of the text of said at least one publicly available web page to at least one predefined textual pattern, which at least one predefined textual pattern is associated with vulnerability information; and

heuristic detection of said preexisting vulnerability information found in the text of said at least one publicly available web page.

5. An automated system for automatic update of a Common Vulnerability Scoring System (CVSS) score according to claim 1 and wherein said new vulnerability information is stored in at least one publicly available web page.

6. An automated system for automatic update of a Common Vulnerability Scoring System (CVSS) score according to claim 5 and wherein said vulnerability information extraction functionality is to extract said new vulnerability information from said least one publicly available web page by employing at least one of:

parsing the text of said least one publicly available web page;

matching elements of the text of said at least one publicly available web page to at least one predefined textual pattern, which at least one predefined textual pattern is associated with vulnerability information; and

heuristic detection of said new vulnerability information found in the text of said at least one publicly available web page.

7. A computer product for automatic update of a Common Vulnerability Scoring System (CVSS) score, including a non-transitory, tangible computer-readable medium in which computer program instructions are stored, which instructions, when read by a computer, cause the computer:

to analyze preexisting vulnerability information, said preexisting vulnerability information relating to at least one of at least one vulnerability and at least one attack vectors thereof, said vulnerability having a preexisting CVSS score, said preexisting CVSS score being based at least partially on said preexisting vulnerability information;

responsive to said analyzing preexisting vulnerability information, to extract new vulnerability information, said new vulnerability information relating to said at least one of said at least one vulnerability and said at least one attack vector thereof; and

to employ said new vulnerability information to update said preexisting CVSS score.

8. A computer product for automatic update of a Common Vulnerability Scoring System (CVSS) score according to claim 7 and wherein said preexisting vulnerability information is stored in at least one publicly available web page.

9. A computer product for automatic update of a Common Vulnerability Scoring System (CVSS) score according to claim 8 and wherein when analyzing preexisting vulnerability information, said computer employs at least one of:

parsing the text of said least one publicly available web page;

matching elements of the text of said at least one publicly available web page to at least one predefined textual pattern, which at least one predefined textual pattern is associated with vulnerability information; and

heuristic detection of said preexisting vulnerability information found in the text of said at least one publicly available web page.

10. A computer product for automatic update of a Common Vulnerability Scoring System (CVSS) score according to claim 7 and wherein said new vulnerability information is stored in at least one publicly available web page.

11. A computer product for automatic update of a Common Vulnerability Scoring System (CVSS) score according to claim 10 and wherein when extracting preexisting vulnerability information, said computer employs at least one of:

parsing the text of said least one publicly available web page;

matching elements of the text of said at least one publicly available web page to at least one predefined textual pattern, which at least one predefined textual pattern is associated with vulnerability information; and

heuristic detection of said new vulnerability information found in the text of said at least one publicly available web page.

12. A method for automatic update of a Common Vulnerability Scoring System (CVSS) score, said method comprising:

analyzing preexisting vulnerability information, said preexisting vulnerability information relating to at least one of at least one vulnerability and at least one attack vector thereof, said at least one vulnerability having a preexisting CVSS score, said preexisting CVSS score being based at least partially on said preexisting vulnerability information;

responsive to said analyzing preexisting vulnerability information, extracting new vulnerability information, said new vulnerability information relating to said at least one of said at least one vulnerability and said at least one attack vector thereof; and

employing said new vulnerability information to update said preexisting CVSS score.

13. A method for automatic update of a Common Vulnerability Scoring System (CVSS) score according to claim 12 and wherein said preexisting vulnerability information and said new vulnerability information are each stored in at least one publicly available web page.

14. A method for automatic update of a Common Vulnerability Scoring System (CVSS) score according to claim 13 and wherein when analyzing preexisting vulnerability information, said computer employs at least one of:

parsing the text of said least one publicly available web page;

matching elements of the text of said at least one publicly available web page to at least one predefined textual pattern, which at least one predefined textual pattern is associated with vulnerability information; and

heuristic detection of said preexisting vulnerability information found in the text of said at least one publicly available web page.

15. A method for automatic update of a Common Vulnerability Scoring System (CVSS) score according to claim 13 and wherein when extracting preexisting vulnerability information, said computer employs at least one of:

parsing the text of said least one publicly available web page;

matching elements of the text of said at least one publicly available web page to at least one predefined textual pattern, which at least one predefined textual pattern is associated with vulnerability information; and

heuristic detection of said new vulnerability information found in the text of said at least one publicly available web page.