Vulnerability management via a graphical interface

1 . A computer-implemented method for vulnerability management via a user interface, the method comprising:

displaying, by a computing machine, a first interface region comprising indications of one or more original software blocks and corresponding one or more original vulnerability metrics;

displaying, by the computing machine, a second interface region comprising one or more subregions corresponding to the one or more original software blocks, wherein each subregion comprises: an element for indicating one or more replacement software blocks from one or more compatible replacement software blocks, and one or more replacement vulnerability metrics associated with the one or more indicated replacement software blocks;

displaying, by the computing machine, aggregate vulnerability metrics comprising: a first aggregate metric representing a count of vulnerabilities across the one or more original software blocks, and a second aggregate metric representing a count of vulnerabilities across the one or more indicated replacement software blocks across the one or more subregions;

receiving, by the computing machine, a user selection of a set of replacement software blocks for a particular subregion;

updating, by the computing machine and in response to the user selection, the one or more replacement vulnerability metrics for the particular subregion to reflect vulnerabilities associated with the selected set of the replacement software blocks, and the second aggregate metric to reflect the updated one or more replacement vulnerability metrics;

displaying, by the computing machine, a severity breakdown of the vulnerabilities associated with at least one of the first aggregate metric or the second aggregate metric;

displaying, by the computing machine, a control element for resetting the set of the replacement software blocks across the one or more subregions to their corresponding original software blocks; and

updating, by the computing machine, the second aggregate metric in response to selection of the control element.

2 . The method of claim 1 , further comprising:

generating, by the computing machine in response to a user input, an exportable report indicating at least the one or more original software blocks, the selected set of the replacement software blocks across the one or more subregions, vulnerability metrics of the one or more original software blocks, and vulnerability metrics of the selected set of the replacement software blocks across the one or more subregions.

3 . The method of claim 1 , further comprising:

storing, by the computing machine, the user selection in a persistent data structure that maintains the selection across multiple user sessions.

4 . The method of claim 1 , further comprising:

determining, by the computing machine, a priority score corresponding to a given original software block being replaced by a given set of replacement software blocks, wherein determining the priority score comprises:

calculating an exploitability metric based on: one or more of current vulnerability exploit data associated with the given set of the replacement software blocks, and predicted future exploit probability data associated with the given set of the replacement software blocks,

calculating an impact metric based on contextual data associated with the given original software block, and

determining the priority score based on at least one of the exploitability metric or the impact metric.

5 . The method of claim 1 , further comprising:

determining, by the computing machine, an original software block priority score for a first original software block, wherein determining the original software block priority score comprises:

calculating an original exploitability metric based on one or more of: current vulnerability exploit data associated with the first original software block, and predicted future exploit probability data associated with the first original software block,

analyzing availability of compatible replacement software blocks for the first original software block,

calculating an original impact metric based on contextual data associated with the first original software block, and

determining the original software block priority score based on at least one of the original exploitability metric, the availability of compatible replacement software blocks, or the original impact metric.

6 . A non-transitory computer-readable medium for vulnerability management via a user interface, the computer-readable medium storing instructions which, when executed by processing circuitry, cause the processing circuitry to perform operations comprising:

displaying, by a computing machine, a first interface region comprising indications of one or more original software blocks and corresponding one or more original vulnerability metrics;

displaying, by the computing machine, a second interface region comprising one or more subregions corresponding to the one or more original software blocks, wherein each subregion comprises: an element for indicating one or more replacement software blocks from one or more compatible replacement software blocks, and one or more replacement vulnerability metrics associated with the one or more indicated replacement software blocks;

displaying, by the computing machine, aggregate vulnerability metrics comprising: a first aggregate metric representing a count of vulnerabilities across the one or more original software blocks, and a second aggregate metric representing a count of vulnerabilities across the one or more indicated replacement software blocks across the one or more subregions;

receiving, by the computing machine, a user selection of a set of replacement software blocks for a particular subregion;

updating, by the computing machine and in response to the user selection, the one or more replacement vulnerability metrics for the particular subregion to reflect vulnerabilities associated with the selected set of the replacement software blocks, and the second aggregate metric to reflect the updated one or more replacement vulnerability metrics;

displaying, by the computing machine, a severity breakdown of the vulnerabilities associated with at least one of the first aggregate metric or the second aggregate metric;

displaying, by the computing machine, a control element for resetting the set of the replacement software blocks across the one or more subregions to their corresponding original software blocks; and

updating, by the computing machine, the second aggregate metric in response to selection of the control element.

7 . The non-transitory computer-readable medium of claim 6 , the operations further comprising:

generating, by the computing machine in response to a user input, an exportable report indicating at least the one or more original software blocks, the selected set of the replacement software blocks across the one or more subregions, vulnerability metrics of the one or more original software blocks, and vulnerability metrics of the selected set of the replacement software blocks across the one or more subregions.

8 . The non-transitory computer-readable medium of claim 6 , the operations further comprising:

identifying, by the computing machine, the one or more compatible replacement software blocks for an original software block of the one or more original software blocks by analyzing dependency relationships defined in a software bill of materials.

9 . The non-transitory computer-readable medium of claim 6 , the operations further comprising:

storing, by the computing machine, the user selection in a persistent data structure that maintains the selection across multiple user sessions.

10 . The non-transitory computer-readable medium of claim 6 , wherein the severity breakdown comprises categorizing the vulnerabilities into a plurality of severity levels.

11 . The non-transitory computer-readable medium of claim 6 , wherein:

the first interface region comprises a first column having a first cell for a first original software block of the one or more original software blocks,

the second interface region comprises a second column, having a second cell for a subregion corresponding to the first original software block, and

the first cell and the second cell are in a same row for the first original software block.

12 . The non-transitory computer-readable medium of claim 11 , wherein the second column is adjacent to the first column.

13 . The non-transitory computer-readable medium of claim 6 , wherein the aggregate vulnerability metrics are displayed in a third interface region, wherein the third interface region is positioned above the first interface region and the second interface region.

14 . The non-transitory computer-readable medium of claim 6 , wherein the aggregate vulnerability metrics are displayed in a third interface region, the operations further comprising:

displaying, by the computing machine, a scroll bar for scrolling through the first interface region and the second interface region without scrolling through the third interface region.

15 . The non-transitory computer-readable medium of claim 6 , wherein updating the one or more replacement vulnerability metrics and the second aggregate metric occurs in real-time in response to the user selection.

16 . The non-transitory computer-readable medium of claim 6 , wherein a user interface element for receiving the selection comprises a pull-down menu displaying identifiers for each of the one or more compatible replacement software blocks.

17 . The non-transitory computer-readable medium of claim 6 , the operations further comprising:

accessing, by the computing machine, a software application for analysis;

identifying, by the computing machine, the one or more original software blocks through automated image scanning of the software application;

generating a software bill of materials based on the one or more original software blocks, wherein the software bill of materials comprises a data structure mapping relationships between the one or more original software blocks;

calculating the one or more original vulnerability metrics by:

identifying, for each original software block, vulnerabilities associated with a specific version of the original software block, and

determining the first aggregate metric based on the identified vulnerabilities;

identifying the one or more compatible replacement software blocks based on:

querying one or more software repositories for stored patches, and

verifying compatibility between the stored patches and the one or more original software blocks based on the mapped relationships in the software bill of materials; and

calculating the one or more replacement vulnerability metrics based on vulnerability remediations provided by the one or more compatible replacement software blocks.

18 . The non-transitory computer-readable medium of claim 6 , the operations further comprising:

displaying, by the computing machine, an additional interface region comprising one or more additional subregions, each additional subregion corresponding to a respective subregion of the one or more subregions of the second interface region and corresponding to a same original software block as the respective subregion of the second interface region, wherein:

each additional subregion comprises a second element for indicating one or more second replacement software blocks from the one or more compatible replacement software blocks, and one or more second replacement vulnerability metrics associated with the one or more indicated second replacement software blocks,

the one or more second replacement software blocks indicated in a respective additional subregion are independent from the one or more replacement software blocks indicated in the corresponding respective subregion of the second interface region, and the second aggregate metric is separately calculated and displayed for each of the second interface region and the additional interface region; and

displaying, by the computing machine, a second control element for adding another interface region for selecting other replacement software blocks.

19 . The non-transitory computer-readable medium of claim 6 , the operations further comprising:

determining, by the computing machine, a priority score corresponding to a given original software block being replaced by a given set of replacement software blocks, wherein determining the priority score comprises:

calculating an exploitability metric based on: one or more of current vulnerability exploit data associated with the given set of the replacement software blocks, and predicted future exploit probability data associated with the given set of the replacement software blocks,

calculating an impact metric based on contextual data associated with the given original software block, and

determining the priority score based on at least one of the exploitability metric or the impact metric.

20 . The non-transitory computer-readable medium of claim 19 , the operations further comprising:

displaying, by the computing machine and within each subregion of the second interface region, the one or more compatible replacement software blocks in an order based on their respective priority scores.

21 . The non-transitory computer-readable medium of claim 6 , the operations further comprising:

determining, by the computing machine, an original software block priority score for a first original software block, wherein determining the original software block priority score comprises:

calculating an original exploitability metric based on one or more of: current vulnerability exploit data associated with the first original software block, and predicted future exploit probability data associated with the first original software block,

analyzing availability of compatible replacement software blocks for the first original software block,

calculating an original impact metric based on contextual data associated with the first original software block, and

determining the original software block priority score based on at least one of the original exploitability metric, the availability of compatible replacement software blocks, or the original impact metric.

22 . The non-transitory computer-readable medium of claim 21 , the operations further comprising:

displaying, by the computing machine and in the first interface region, the indications of the one or more original software blocks in an order based on original software block priority scores determined for at least one of the one or more original software blocks, wherein the at least one of the one or more original software blocks include the first original software block, wherein the original software block priority scores include the original software block priority score for the first original software block.

23 . A system for vulnerability management via a user interface, the system comprising:

processing circuitry; and

a memory subsystem storing instructions which, when executed by the processing circuitry, cause the processing circuitry to perform operations comprising:

displaying, by a computing machine, a first interface region comprising indications of one or more original software blocks and corresponding one or more original vulnerability metrics;

displaying, by the computing machine, a second interface region comprising one or more subregions corresponding to the one or more original software blocks, wherein each subregion comprises: an element for indicating one or more replacement software blocks from one or more compatible replacement software blocks, and one or more replacement vulnerability metrics associated with the one or more indicated replacement software blocks;

displaying, by the computing machine, aggregate vulnerability metrics comprising: a first aggregate metric representing a count of vulnerabilities across the one or more original software blocks, and a second aggregate metric representing a count of vulnerabilities across the one or more indicated replacement software blocks across the one or more subregions;

receiving, by the computing machine, a user selection of a set of replacement software blocks for a particular subregion;

updating, by the computing machine and in response to the user selection, the one or more replacement vulnerability metrics for the particular subregion to reflect vulnerabilities associated with the selected set of the replacement software blocks, and the second aggregate metric to reflect the updated one or more replacement vulnerability metrics;

displaying, by the computing machine, a severity breakdown of the vulnerabilities associated with at least one of the first aggregate metric or the second aggregate metric;

displaying, by the computing machine, a control element for resetting the set of the replacement software blocks across the one or more subregions to their corresponding original software blocks; and

updating, by the computing machine, the second aggregate metric in response to selection of the control element.

24 . The system of claim 23 , wherein the aggregate vulnerability metrics are displayed in a third interface region, wherein the third interface region is positioned above the first interface region and the second interface region.

25 . The system of claim 23 , wherein updating the one or more replacement vulnerability metrics and the second aggregate metric occurs in real-time in response to the user selection.

26 . The system of claim 23 , wherein a user interface element for receiving the selection comprises a pull-down menu displaying identifiers for each of the one or more compatible replacement software blocks.

27 . The system of claim 23 , the operations further comprising:

accessing, by the computing machine, a software application for analysis;

identifying, by the computing machine, the one or more original software blocks through automated image scanning of the software application;

generating a software bill of materials based on the one or more original software blocks, wherein the software bill of materials comprises a data structure mapping relationships between the one or more original software blocks;

calculating the one or more original vulnerability metrics by:

identifying, for each original software block, vulnerabilities associated with a specific version of the original software block, and

determining the first aggregate metric based on the identified vulnerabilities;

identifying the one or more compatible replacement software blocks based on:

querying one or more software repositories for stored patches, and

verifying compatibility between the stored patches and the one or more original software blocks based on the mapped relationships in the software bill of materials; and

calculating the one or more replacement vulnerability metrics based on vulnerability remediations provided by the one or more compatible replacement software blocks.

28 . The system of claim 23 , the operations further comprising:

displaying, by the computing machine, an additional interface region comprising one or more additional subregions, each additional subregion corresponding to a respective subregion of the one or more subregions of the second interface region and corresponding to a same original software block as the respective subregion of the second interface region, wherein:

each additional subregion comprises a second element for indicating one or more second replacement software blocks from the one or more compatible replacement software blocks, and one or more second replacement vulnerability metrics associated with the one or more indicated second replacement software blocks,

the one or more second replacement software blocks indicated in a respective additional subregion are independent from the one or more replacement software blocks indicated in the corresponding respective subregion of the second interface region, and the second aggregate metric is separately calculated and displayed for each of the second interface region and the additional interface region; and

displaying, by the computing machine, a second control element for adding another interface region for selecting other replacement software blocks.

29 . The system of claim 23 , the operations further comprising:

generating, by the computing machine in response to a user input, an exportable report indicating at least the one or more original software blocks, the selected set of the replacement software blocks across the one or more subregions, vulnerability metrics of the one or more original software blocks, and vulnerability metrics of the selected set of the replacement software blocks across the one or more subregions.

30 . The system of claim 23 , the operations further comprising:

storing, by the computing machine, the user selection in a persistent data structure that maintains the selection across multiple user sessions.