Systems and methods for determining vulnerability criticality

1 . A method comprising:

creating exploit combinations for known vulnerabilities within a software system;

inputting new vulnerabilities into the software system;

determining whether the new vulnerabilities fit into an existing exploit combination or create a new exploit combination;

updating the exploit combinations based on the new vulnerabilities;

applying a risk score to the updated exploit combinations for determining a priority of remediation efforts; and

determining whether the risk score of the updated exploit combinations is greater than the exploit combinations prior to updating.

2 . The method of claim 1 , wherein the updated exploit combinations comprise vulnerabilities that allow for an executable stack.

3 . The method of claim 1 , further comprising identifying vulnerabilities within the software system, the vulnerabilities comprising high-risk vulnerabilities that have a risk score at or above a predetermined threshold, and low-risk vulnerabilities that have a risk score below the predetermined threshold, wherein the known vulnerabilities comprise the low-risk vulnerabilities.

4 . The method of claim 1 , further comprising identifying the updated exploit combinations with a risk score at or above the predetermined threshold.

5 . The method of claim 1 , further comprising determine automated actions to be taken, wherein the automated actions include at least one of: sending a message to a vehicle display, a personal device, a third-party service provider, or a security operation center; disable the vehicle.

6 . The method of claim 5 , wherein the automated actions are determined based on a risk score applied to the updated exploit combinations for determining a priority of remediation efforts.

7 . A computer program product comprising a non-transitory computer useable medium including a computer readable code, wherein the computer readable code when executed using one or more computing device processors, causes the one or more computing processors to:

create exploit combinations for known vulnerabilities within a software system;

input new vulnerabilities into the software system;

determine whether the new vulnerabilities fit into an existing exploit combination or create a new exploit combination; and

update the exploit combinations based on the new vulnerabilities;

apply a risk score to the updated exploit combinations for determining a priority of remediation efforts, and

determine whether the risk score of the updated exploit combinations is greater than the exploit combinations prior to updating.

8 . The computer program product of claim 7 , wherein the updated exploit combinations comprise vulnerabilities that allow for an executable stack.

9 . The computer program product of claim 7 , wherein the computer readable code when executed using one or more computing device processors, causes the one or more computing processors to: identify vulnerabilities within the software system, the vulnerabilities comprising high-risk vulnerabilities that have a risk score at or above a predetermined threshold, and low-risk vulnerabilities that have a risk score below the predetermined threshold, wherein the known vulnerabilities comprise the low-risk vulnerabilities.

10 . The computer program product of claim 7 , wherein the computer readable code when executed using one or more computing device processors, causes the one or more computing processors to: determine automated actions to be taken, wherein the automated actions include at least one of: sending a message to a vehicle display, a personal device, a third-party service provider, or a security operation center; disable the vehicle.

11 . The computer program product of claim 10 , wherein the automated actions are determined based on a risk score applied to the updated exploit combinations for determining a priority of remediation efforts.

12 . A system comprising:

one or more computing system processors; and

memory storing instructions that, when executed by the one or more computing system processors, causes the system to:

create exploit combinations for known vulnerabilities within a software system;

input new vulnerabilities into the software system;

determine whether the new vulnerabilities fit into an existing exploit combination or create a new exploit combination;

update the exploit combinations based on the new vulnerabilities;

apply a risk score to the updated exploit combinations for determining a priority of remediation efforts; and

determine whether the risk score of the updated exploit combinations is greater than the exploit combinations prior to updating.

13 . The system of claim 12 , wherein the updated exploit combinations comprise vulnerabilities that allow for an executable stack.

14 . The system of claim 12 , wherein the instructions when executed using one or more computing device processors, causes the one or more computing processors to: identify vulnerabilities within the software system, the vulnerabilities comprising high-risk vulnerabilities that have a risk score at or above a predetermined threshold, and low-risk vulnerabilities that have a risk score below the predetermined threshold, wherein the known vulnerabilities comprise the low-risk vulnerabilities.

15 . The system of claim 12 , wherein the instructions when executed using one or more computing device processors, causes the one or more computing processors to: determine automated actions to be taken, wherein the automated actions include at least one of: sending a message to a vehicle display, a personal device, a third-party service provider, or a security operation center; disable the vehicle.

16 . The system of claim 15 , wherein the automated actions are determined based on a risk score applied to the updated exploit combinations for determining a priority of remediation efforts.