Method of distributed discovery of vulnerabilities in applications

• US 9,824,222 B1
• Filed: 05/06/2014
• Issued: 11/21/2017
• Est. Priority Date: 05/06/2014
• Status: Active Grant

• Current Assignee: Synack, Inc.
• Original Assignee: Synack, Inc.
• Inventors: Kaplan, Jay, Kuhr, Mark
• Primary Examiner(s): Potratz, Daniel
• Application Number:
  US14/271,088
• Time in Patent Office: 1,295 Days
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: G06F 2221/033 Test or assess software
• CPC Class Codes: G06F 2221/034 Test or assess a computer or a system
• CPC Class Codes: G06Q 30/0208 Trade or exchange of goods or services in exchange for incentives or rewards
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1433 Vulnerability analysis

Abstract

In one aspect, the disclosure provides: A method comprising: inviting a distributed plurality of researchers to participate in one or more computer vulnerability research projects directed to identifying computer vulnerabilities of one or more networks and/or computers that are owned or operated by a third party; assessing reputation and skills of one or more of the researchers, and accepting a subset of the researchers who have a positive reputation and sufficient skills to perform the investigations of the computer vulnerabilities; assigning a particular computer vulnerability research project, relating to a particular network under test, to a particular researcher from among the subset of the researchers; using a computer that is logically interposed between the particular researcher and the particular network under test, monitoring communications between the particular researcher and the particular network under test, wherein the communications relate to attempting to identify a candidate security vulnerability of the particular network under test; validating a report of the candidate security vulnerability of the particular network under test that is received from the particular researcher; determining and providing an award to the particular researcher in response to successfully validating the report of the candidate security vulnerability of the particular network under test that is received from the particular researcher.

Claims

1. A method comprising:

inviting a distributed plurality of researchers to participate in one or more computer vulnerability research projects directed to identifying computer vulnerabilities of one or more networks and/or computers that are owned or operated by a third party;

assessing reputation and skills of one or more of the researchers, and accepting a subset of the researchers who have a positive reputation and sufficient skills to perform the investigations of the computer vulnerabilities;

assigning a particular computer vulnerability research project, relating to a particular network under test, to a particular researcher from among the subset of the researchers;

using a computer that is logically interposed between a researcher computer used by the particular researcher and the particular network under test, monitoring communications between the researcher computer used by the particular researcher and the particular network under test, wherein the communications relate to attempting to identify a candidate security vulnerability of the particular network under test, and wherein control logic is implemented by the computer in a manner to perform the monitoring of electronic communications between the researcher computer used by the particular researcher and the particular network under test;

validating a report of the candidate security vulnerability of the particular network under test that is received from the particular researcher;

determining and providing an award to the particular researcher in response to successfully validating the report of the candidate security vulnerability of the particular network under test that is received from the particular researcher.

2. The method of claim 1 comprising:

determining a vulnerability score for the candidate security vulnerability of the particular network under test that is received from the particular researcher, wherein the vulnerability score indicates a relative importance of the candidate security vulnerability;

based upon the vulnerability score, determining and providing the award.

3. The method of claim 1 comprising:

determining a vulnerability score for the candidate security vulnerability of the particular network under test that is received from the particular researcher, wherein the vulnerability score indicates a relative importance of the candidate security vulnerability;

mapping the vulnerability score to a particular award that is within a range of a minimum award value and a maximum award value that are stored in a record identifying the candidate security vulnerability in a database;

based upon the mapping, determining and providing the particular award.

4. The method of claim 3 wherein the particular award is a fee.

5. The method of claim 3 wherein the particular award is an amount of a virtual currency.

6. The method of claim 3 wherein the particular award is an amount of points.

7. The method of claim 6 comprising:

determining and providing a plurality of awards of different amounts of points to the particular researcher in response to validating a plurality of different reports of different candidate security vulnerabilities that are received from the particular researcher at different times within a period;

determining and providing an additional award to the particular researcher when a sum of the different amounts of points awarded within the period is greater than a specified threshold.

8. The method of claim 1 comprising:

assigning two different particular computer vulnerability research projects, relating to two different particular networks under test, to two different geographically distant particular researchers from among the subset of the researchers;

using a computer that is logically interposed between the two different particular researchers and the particular network under test, monitoring communications between the two different particular researchers and the two different particular networks under test, wherein the communications relate to attempting to identify two different candidate security vulnerabilities of the two different particular networks under test;

validating two different reports of the two different candidate security vulnerability of the two different particular networks under test that are received respectively from the two different particular researchers;

determining and providing two different awards to the two different particular researchers in response to successfully validating the reports.

9. The method of claim 1 comprising validating the particular security vulnerability by re-performing, on a target computer of the particular network under test, one or more operations that are identified in the report;

providing a validated report of the security vulnerability to an administrator computer that is associated with the particular network under test.

10. The method of claim 1 comprising:

assigning one particular computer vulnerability research project, relating to a particular network under test, to two different particular researchers from among the subset of the researchers;

using the computer that is logically interposed between the two different particular researchers and the particular network under test, monitoring communications between the two different particular researchers and the particular network under test, wherein the communications relate to attempting to identify a candidate security vulnerability of the particular network under test;

receiving two different reports of the same candidate security vulnerability of the particular network under test from the two different particular researchers respectively;

validating a first report of the candidate security vulnerability of the particular network under test that is received from a first particular researcher;

determining that a second report, received from a second particular researcher, of the candidate security vulnerability is a duplicate report;

determining and providing the award only to the first particular researcher in response to successfully validating the first report.

11. A method comprising:

inviting a distributed plurality of researchers to participate in one or more computer vulnerability research projects directed to identifying computer vulnerabilities of one or more computer application programs that are owned or operated by a third party;

assessing one or more of the researchers, and accepting a subset of the researchers who have a positive reputation and sufficient skills to perform the investigations of the computer vulnerabilities;

assigning a particular computer vulnerability research project, relating to a particular computer application program under test, to a particular researcher from among the subset of the researchers;

using a computer that is logically interposed between a researcher computer used by the particular researcher and the particular network under test, monitoring communications between the researcher computer used by the particular researcher and the particular network under test, wherein the communications relate to attempting to identify a candidate security vulnerability of the particular computer application program under test, and wherein control logic is implemented by the computer in a manner to perform the monitoring of electronic communications between the researcher computer used by the particular researcher and the particular network under test;

validating a report of the candidate security vulnerability of the particular computer application program under test that is received from the particular researcher;

determining and providing a fee to the particular researcher in response to successfully validating the report of the candidate security vulnerability of the particular network under test that is received from the particular researcher.

12. The method of claim 11 comprising:

determining a vulnerability score for the candidate security vulnerability of the particular computer application program under test that is received from the particular researcher, wherein the vulnerability score indicates a relative importance of the candidate security vulnerability;

based upon the vulnerability score, determining and providing the fee.

13. The method of claim 11 comprising:

determining a vulnerability score for the candidate security vulnerability of the particular computer application program under test that is received from the particular researcher, wherein the vulnerability score indicates a relative importance of the candidate security vulnerability;

mapping the vulnerability score to a particular award that is within a range of a minimum award value and a maximum award value that are stored in a record identifying the candidate security vulnerability in a database;

based upon the mapping, determining and providing the particular award.

14. The method of claim 11 comprising:

determining and providing a plurality of fees of different amounts of value to the particular researcher in response to validating a plurality of different reports of different candidate security vulnerabilities that are received from the particular researcher at different times within a period;

determining and providing an additional fee to the particular researcher when a sum of the total fees previously awarded within the period is greater than a specified threshold.

15. The method of claim 11 comprising:

assigning two different particular computer vulnerability research projects, relating to two different particular computer application programs under test, to two different geographically distant particular researchers from among the subset of the researchers;

using the computer that is logically interposed between the two different particular researchers and the particular computer application program under test, monitoring communications between the two different particular researchers and the two different particular computer application programs under test, wherein the communications relate to attempting to identify two different candidate security vulnerabilities of the two different particular computer application programs under test;

validating two different reports of the two different candidate security vulnerability of the two different particular computer application programs under test that are received respectively from the two different particular researchers;

determining and providing two different awards to the two different particular researchers in response to successfully validating the reports.

16. The method of claim 11 comprising validating the particular security vulnerability by re-performing, on a target computer application program under test, one or more operations that are identified in the report;

providing a validated report of the security vulnerability to an administrator computer that is associated with the particular computer application program under test.