Automated vulnerability intelligence generation and application

US 9,846,780 B2
Filed: 02/25/2015
Issued: 12/19/2017
Est. Priority Date: 02/25/2014
Status: Active Grant

First Claim

Patent Images

1. A method comprising:

obtaining, by a computer system, over a computer network, and from a computer security data provider, distributable vulnerability data comprising, for each of a plurality of software packages and associated vulnerabilities, threat mitigation information and a threat priority parameter,wherein the distributable vulnerability data is derived from an intelligence graph depicting a plurality of attacks by a plurality of attackers against a plurality of entities and comprising a plurality of fundamental instance nodes, a plurality of document nodes, and a plurality of edges,wherein the plurality of fundamental instance nodes include a first fundamental instance node that is associated with common vulnerability and exposure information,wherein the plurality of fundamental instance nodes further include a second fundamental instance node that is associated with one of;

an internet protocol (IP) address,a domain name,a uniform resource locator,a file system path,a software vulnerability,a software,a name of a person,an account handle,an email address,a malware family,an attack campaign,an event,an organization,a network,a file,a country,a region, oran autonomous system number, andwherein the plurality of document nodes include a document node associated with one of;

an intelligence report,a communication,an analysis, ora context;

identifying installed software packages on the computer system;

correlating, by the computer system, a plurality of the installed software packages with the distributable vulnerability data to obtain an identified plurality of installed software packages and respective associated vulnerabilities;

ordering, by the computer system, at least one of the identified plurality of installed software packages and respective associated vulnerabilities according to threat priority parameters to obtain an ordered plurality of installed software packages and associated vulnerabilities; and

providing mitigation information for the ordered plurality of installed software packages and associated vulnerabilities.

View all claims

3 Assignments

Timeline View

Assignment View

0 Petitions

Accused Products

Abstract

Techniques for providing computer security vulnerability intelligence are disclosed. The techniques include obtaining distributable vulnerability data that includes, for each of a plurality of software packages and associated vulnerabilities, threat mitigation information and a threat priority parameter, where the distributable vulnerability data was derived from an intelligence graph including a plurality of fundamental instance nodes, a plurality of document nodes, and a plurality of edges. The techniques also include identifying installed software packages on a computer system, correlating a plurality of the installed software packages with the distributable vulnerability data to obtain a plurality of installed software packages and associated vulnerabilities, ordering at least some of the plurality of installed software packages and associated vulnerabilities according to threat priority parameters, such that an ordered plurality of installed software packages and associated vulnerabilities is obtained, and providing mitigation information for the ordered plurality of installed software packages and associated vulnerabilities.

111 Citations

View as Search Results

20 Claims

1. A method comprising:
- obtaining, by a computer system, over a computer network, and from a computer security data provider, distributable vulnerability data comprising, for each of a plurality of software packages and associated vulnerabilities, threat mitigation information and a threat priority parameter,wherein the distributable vulnerability data is derived from an intelligence graph depicting a plurality of attacks by a plurality of attackers against a plurality of entities and comprising a plurality of fundamental instance nodes, a plurality of document nodes, and a plurality of edges,wherein the plurality of fundamental instance nodes include a first fundamental instance node that is associated with common vulnerability and exposure information,wherein the plurality of fundamental instance nodes further include a second fundamental instance node that is associated with one of;
  
  an internet protocol (IP) address,a domain name,a uniform resource locator,a file system path,a software vulnerability,a software,a name of a person,an account handle,an email address,a malware family,an attack campaign,an event,an organization,a network,a file,a country,a region, oran autonomous system number, andwherein the plurality of document nodes include a document node associated with one of;
  
  an intelligence report,a communication,an analysis, ora context;
  
  identifying installed software packages on the computer system;
  
  correlating, by the computer system, a plurality of the installed software packages with the distributable vulnerability data to obtain an identified plurality of installed software packages and respective associated vulnerabilities;
  
  ordering, by the computer system, at least one of the identified plurality of installed software packages and respective associated vulnerabilities according to threat priority parameters to obtain an ordered plurality of installed software packages and associated vulnerabilities; and
  
  providing mitigation information for the ordered plurality of installed software packages and associated vulnerabilities.
- View Dependent Claims (2, 3, 4, 5)
- - 2. The method of claim 1, wherein each threat priority parameter, of the threat priority parameters, comprises at least one of:
    - an indication of whether a vulnerability is actively exploited;
      
      an indication of whether a workaround is available;
      
      an indication of whether a patch is available;
      
      an indication of a potential impact;
      
      an indication of a software package popularity;
      
      oran indication of vulnerability badness.
  - 3. The method of claim 1, wherein obtaining the distributable vulnerability data comprises:
    - periodically automatically communicating with a computer security data provider to obtain the distributable vulnerability data.
  - 4. The method of claim 1, wherein identifying the installed software packages comprises:
    - automatically scanning an enterprise computer system to identify the installed software packages.
  - 5. The method of claim 1, wherein the computer system is not represented in the intelligence graph.

6. A system comprising:
- one or more electronic processors to;
  
  obtain, over a computer network and from a computer security data provider, distributable vulnerability data comprising, for each of a plurality of software packages and associated vulnerabilities, threat mitigation information and a threat priority parameter,wherein the distributable vulnerability data is derived from an intelligence graph depicting a plurality of attacks by a plurality of attackers against a plurality of entities and comprising a plurality of fundamental instance nodes, a plurality of document nodes, and a plurality of edges,wherein the plurality of fundamental instance nodes include a first fundamental instance node that is associated with common vulnerability and exposure information,wherein the plurality of fundamental instance nodes further include a second fundamental instance node that is associated with one of;
  
  an internet protocol (IP) address,a domain name,a uniform resource locator,a file system path,a software vulnerability,a software,a name of a person,an account handle,an email address,a malware family,an attack campaign,an event,an organization,a network,a file,a country,a region, oran autonomous system number, andwherein the plurality of document nodes include a document node associated with one of;
  
  an intelligence report,a communication,an analysis, ora context;
  
  identify installed software packages on the system;
  
  correlate a plurality of the installed software packages with the distributable vulnerability data to obtain an identified plurality of installed software packages and respective associated vulnerabilities;
  
  order at least one of the identified plurality of installed software packages and respective associated vulnerabilities according to threat priority parameters to obtain an ordered plurality of installed software packages and respective associated vulnerabilities is obtained; and
  
  provide mitigation information for the ordered plurality of installed software packages and associated vulnerabilities.
- View Dependent Claims (7, 8, 9, 10)
- - 7. The system of claim 6, wherein each threat priority parameter, of the threat priority parameters, comprises at least one of:
    - an indication of a vulnerability is actively exploited;
      
      an indication of whether a workaround is available;
      
      an indication of whether a patch is available;
      
      an indication of a potential impact;
      
      an indication of a software package popularity;
      
      oran indication of vulnerability badness.
  - 8. The system of claim 6, wherein, when obtaining the distributable vulnerability data, the one or more electronic processors are to:
    - periodically automatically communicate with a computer security data provider to obtain the distributable vulnerability data.
  - 9. The system of claim 6, wherein, when identifying the installed software packages, the one or more electronic processors are to:
    - automatically scan an enterprise computer system to identify the installed software packages.
  - 10. The system of claim 6, wherein the system is not represented in the intelligence graph.

11. A method comprising:
- obtaining an intelligence graph, depicting a plurality of attacks by a plurality of attackers against a plurality of entities, and comprising a plurality of fundamental instance nodes, a plurality of document nodes, and a plurality of edges;
  
  deriving, from the intelligence graph, distributable vulnerability data comprising, for each of a plurality of software packages and associated vulnerabilities, threat mitigation information and a threat priority parameter,wherein the plurality of fundamental instance nodes include a first fundamental instance node that is associated with common vulnerability and exposure information,wherein the plurality of fundamental instance nodes include a second fundamental instance node that is associated with one of;
  
  an internet protocol (IP) address,a domain name,a uniform resource locator,a file system path,a software vulnerability,a software,a name of a person,an account handle,an email address,a malware family,an attack campaign,an event,an organization,a network,a file,a country,a region, oran autonomous system number, andwherein the plurality of document nodes include a document node associated with one of;
  
  an intelligence report,a communication,an analysis, ora context; and
  
  providing, over a computer network, the distributable vulnerability data to an entity having a computer system with installed software packages to correlate a plurality of the installed software packages with the distributable vulnerability data to obtain an identified plurality of installed software packages and respective associated vulnerabilities and to order at least one of the identified plurality of installed software packages and associated vulnerabilities according to threat priority parameters, to obtain an ordered plurality of installed software packages and associated vulnerabilities and mitigation information for the ordered plurality of installed software packages and associated vulnerabilities.
- View Dependent Claims (12, 13, 14, 15)
- - 12. The method of claim 11, wherein each threat priority parameter, of the threat priority parameters, comprises at least one of:
    - an indication of whether a vulnerability is actively exploited;
      
      an indication of whether a workaround is available;
      
      an indication of whether a patch is available;
      
      an indication of a potential impact;
      
      an indication of a software package popularity;
      
      oran indication of vulnerability badness.
  - 13. The method of claim 11, further comprising:
    - periodically deriving the threat priority parameter.
  - 14. The method of claim 11, wherein providing the distributable vulnerability data comprises providing a web services interface.
  - 15. The method of claim 11, wherein the computer system is not represented in the intelligence graph.

16. An electronic computer system comprising:
- one or more electronic processors to;
  
  obtain an intelligence graph depicting a plurality of attacks by a plurality of attackers against a plurality of entities and comprising a plurality of fundamental instance nodes, a plurality of document nodes, and a plurality of edges;
  
  derive, from the intelligence graph, distributable vulnerability data comprising, for each of a plurality of software packages and associated vulnerabilities, threat mitigation information and a threat priority parameter,wherein the plurality of fundamental instance nodes include a first fundamental instance node that is associated with common vulnerability and exposure information,wherein the plurality of fundamental instance nodes further include a second fundamental instance node that is associated with one of;
  
  an internet protocol (IP) address,a domain name,a uniform resource locator,a file system path,a software vulnerability,a software,a name of a person,an account handle,an email address,a malware family,an attack campaign,an event,an organization,a network,a file,a country,a region, oran autonomous system number, andwherein the plurality of document nodes include a document node associated with one of;
  
  an intelligence report,a communication,an analysis, ora context; and
  
  provide, over a computer network, the distributable vulnerability data to an entity having a computer system with installed software packages to correlate a plurality of the installed software packages with the distributable vulnerability data to obtain an identified plurality of installed software packages and associated vulnerabilities and to order at least one of the identified plurality of installed software packages and associated vulnerabilities according to threat priority parameters, whereby the entity obtains an ordered plurality of installed software packages and associated vulnerabilities and mitigation information for the ordered plurality of installed software packages and associated vulnerabilities.
- View Dependent Claims (17, 18, 19, 20)
- - 17. The electronic computer system of claim 16, wherein each threat priority parameter, of the threat priority parameters, comprises at least one of:
    - an indication of a vulnerability is actively exploited;
      
      an indication of whether a workaround is available;
      
      an indication of whether a patch is available;
      
      an indication of a potential impact;
      
      an indication of a software package popularity;
      
      oran indication of vulnerability badness.
  - 18. The electronic computer system of claim 16, wherein, when deriving the threat priority parameter, the one or more electronic processors are to:
    - periodically derive the threat priority parameter.
  - 19. The electronic computer system of claim 16, further comprising a web services interface configured to provide the distributable vulnerability data.
  - 20. The electronic computer system of claim 16, wherein the computer system is not represented in the intelligence graph.

Specification

Resources

Litigation Campaign Assessment

Current Assignee
Accenture Global Solutions Limited (Accenture PLC)
Original Assignee
Accenture Global Solutions Limited (Accenture PLC)
Inventors
Tonn, Trevor, Chang, Ray-yu
Primary Examiner(s)
Dada, Beemnet
Assistant Examiner(s)
GUNDRY, STEPHEN T

Application Number

US14/631,309
Publication Number

US 20150242637A1
Time in Patent Office

1,028 Days
Field of Search
US Class Current
CPC Class Codes

G06F 21/577   Assessing vulnerabilities a...

G06F 2221/033   Test or assess software

H04L 63/1433   Vulnerability analysis

H04L 63/1441   Countermeasures against mal...

Automated vulnerability intelligence generation and application

First Claim

3 Assignments

0 Petitions

Accused Products

Abstract

111 Citations

20 Claims

Specification

Solutions

Use Cases

Quick Links

Automated vulnerability intelligence generation and application

First Claim

3 Assignments

Subscription Required

Subscription Required

0 Petitions

Subscription Required

Accused Products

Subscription Required

Abstract

111 Citations

20 Claims

Specification

Subscription Required

Solutions

Use Cases

Quick Links