VULNERABILITY VECTOR INFORMATION ANALYSIS

• US 20150207811A1
• Filed: 07/31/2012
• Published: 07/23/2015
• Est. Priority Date: 07/31/2012
• Status: Abandoned Application

• Current Assignee: Hewlett Packard Enterprise Development LP (Hewlett-Packard Enterprise Company)
• Original Assignee: Hewlett-Packard Development Company, L.P. (HP Inc.)
• Inventors: Shezaf, Ofer, Feher, Ben
• Application Number:
  US14/418,863
• Publication Number:
  US 20150207811A1
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

Analyzing vulnerability vector information includes collecting information for a test performed by a vulnerability assessment tool to detect a vulnerability. Attributes of the test are determined from the collected information and are used to determine if there any matches with information in a security vulnerabilities information source.

Claims

1. A method of analyzing vulnerability vector information comprising:

collecting information for a test performed by a vulnerability assessment tool to detect a vulnerability;

determining attributes of the test from the collected information;

comparing, by a processor, the attributes with entries in a security vulnerabilities information source describing vulnerabilities;

determining, from the comparison, whether the attributes match an entry of the entries in the security vulnerabilities information source for one of the vulnerabilities; and

if a matching entry is determined, storing information from the matching entry with the collected information in a vulnerability management data storage system.

2. The method of claim 1, wherein if a matching entry is not identified from the entries in the security vulnerabilities information source, storing an indication of no matching entry and a date of a determination of no matching entry with the collected information in the vulnerability management data storage system.

3. The method of claim 1, wherein the attributes comprise an identifier of a system that is vulnerable or causing the vulnerability, a vulnerability location, and a vulnerability type.

4. The method of claim 1, wherein the vulnerability detectable by the vulnerability assessment tool comprises an action performable on a computer system that violates a security policy or rule related to security of information stored on a computer system.

5. The method of claim 1, wherein the determining of the attributes comprises:

extracting information from fields in a descriptive text; and

storing the extracted information as one of the attributes.

6. The method of claim 1, wherein the determining of the attributes comprises pattern matching structural elements of one of the attributes with the collected information.

7. The method of claim 1, wherein the determining of the attributes comprises comparing the collected information to predetermined values of the attributes.

8. The method of claim 1, wherein the collected information comprises a title of the test, and the determining of the attributes comprises:

identifying a vulnerability location or a vulnerability type from the title; and

assuming a remaining portion of the title, not including the vulnerability location or the vulnerability type, corresponds to an identifier of a system that is vulnerable or causing the vulnerability.

9. The method of claim 1, wherein the determining of the attributes comprises determining one of the attributes from logic used by the vulnerability assessment tool to execute the test to detect the vulnerability.

10. The method of claim 1, wherein the determining of whether the attributes match an entry of the entries in the security vulnerabilities information source comprises:

determining if not all the attributes are in the entry; and

determining the attributes match the entry if a majority of the attributes are in the entry.

11. The method of claim 1, wherein the determining of whether the attributes match an entry of the entries in the security vulnerabilities information source comprises:

determining text for one of the attributes is partially included in the entry; and

if the text for the one of the attributes is partially included in the entry, determining the one of the attributes is in the entry.

12. The method of claim 1, wherein the determining of whether the attributes match an entry of the entries in the security vulnerabilities information source comprises:

comparing one of the attributes to a hierarchal taxonomy in the security vulnerabilities information source; and

determining the one of the attributes is in the entry if a parent or child of the entry in the security vulnerabilities information source includes the one of the attributes.

13. A vulnerability management system comprising:

a vulnerability data management storage system; and

a processor executing;

an attribute extraction module to determine attributes of a test performed by a vulnerability assessment tool to detect a vulnerability, wherein the attributes are determined from information collected from the vulnerability assessment tool describing the test, and

a vulnerability assessment tool to compare the attributes with entries in a security vulnerabilities information source describing vulnerabilities and determine, from the comparison, whether the attributes match an entry of the entries in the security vulnerabilities information source for one of the vulnerabilities, and if a matching entry is determined, storing information from the matching entry with the collected information in the vulnerability management data storage system.

14. The vulnerability management system of claim 13, wherein the attributes comprise an identifier of a system that is vulnerable or causing the vulnerability, a vulnerability location, and a vulnerability type.

15. A non-transitory computer readable medium including machine readable instructions that when executed by a processor cause the processor to:

determine attributes of a test performed by a vulnerability assessment tool to detect a vulnerability, wherein the attributes are determined from information collected from the vulnerability assessment tool describing the test, and the attributes include an identifier of a system that is vulnerable or causing the vulnerability, a vulnerability location, and a vulnerability type;

determine whether the attributes match information for a vulnerability stored in a security vulnerabilities information source; and

if a matching entry is determined, store information from the matching entry with the collected information in a vulnerability management data storage system, wherein the stored information includes a vulnerability ID used by the security vulnerabilities information source to identify the vulnerability and an identification of a patch to remediate the vulnerability.