Method for translating product banners
A method for automatically translating a banner information, the method may include receiving by a computer the banner information, wherein the banner information is included in at least one banner and describes an identity of a software product; and translating by the computer the banner information into a unique software product identifier using a content of knowledgebase that comprises an attributes schema and translation rules; wherein each software product is associated with a single unique software product identifier; wherein the unique software product identifier comprises a structured set of attributes; wherein at least one translation rule is a pattern based translation rule; wherein the attributes schema specifies a set of allowable attributes and of allowable values of the attributes.
1. A method for automatically translating a banner information, the method comprises:
receiving by a computer the banner information, wherein the banner information is included in at least one banner and describes an identity of a software product; and
translating by the computer the banner information into a unique software product identifier using a content of knowledgebase that comprises an attributes schema and translation rules; wherein each software product is associated with a single unique software product identifier; wherein the unique software product identifier comprises a structured set of attributes; wherein at least one translation rule is a pattern based translation rule; wherein the attributes schema specifies a set of allowable attributes and of allowable values of the attributes;
wherein the translating comprises applying alternative sequences of translating and validation rules to the banner information and to attributes extracted from the banner information;
wherein applying of alternative sequences comprises generating and using search nodes that represent attribute extraction alternatives that were explored during the applying of the translating.
2. The method according to claim 1 comprising determining the allowable values of the attributes by applying one or more validation rules.
3. The method according to claim 2 wherein the validation rules determine allowable values of an attribute name by specifying at least one pattern for the attribute values.
4. The method according to claim 2 , wherein the validation rules define allowable content for attributes associated with at least one out of a certain vendor and a certain software product.
5. The method according to claim 1 wherein the pattern based translation rule specifies an allowable translation of a pattern of the banner information to value of an attribute of the unique software product identifier.
6. The method according to claim 5 wherein a translation rule comprises at least one pair of attribute name and an attribute value extracted from the pattern.
7. The method according to claim 1 wherein the attributes schema specifies a set of allowable attributes that complies with the Common Platform Enumeration (CPE) standard.
8. The method according to claim 1 wherein the translating comprises outputting a banner information coverage rate indication.
9. The method according to claim 1 wherein the translating comprises outputting a translation confidence score.
10. The method according to claim 1 wherein each search node holds a set of values of attributes that have already been extracted according to the alternative and status information relating to the attributes.
11. The method according to claim 1 wherein the generating of the search nodes comprises iteratively selecting an existing search node and applying validation or translation rules to the banner information or to already extracted attributes in order to validate an already extracted attribute or in order to extract additional attribute.
12. The method according to claim 1 , comprising selecting extracted attribute values found by one of the alternative sequences of translating and validating rules.
13. The method according to claim 1 , wherein the receiving of banner information is preceded by receiving by the computer at least one vulnerability that is capable of affecting the software product; and wherein the translating is followed by associating the at least one vulnerability with the unique software product identifier.
14. The method according to claim 13 further comprising evaluating a parameter of an attack that involves a computer that hosts the software product.
15. A non-transitory computer readable medium that stores instructions for:
receiving by a computer, banner information, wherein the banner information is included in at least one banner and describes an identity of a software product; and
translating by the computer the banner information into a unique software product identifier using a content of knowledgebase that comprises an attributes schema and translation rules; wherein each software product is associated with a single unique software product identifier; wherein the unique software product identifier comprises a structures set of attributes; wherein at least one translation rule is a pattern based translation rule; wherein the attributes schema specific a set of allowable attributes and of allowable values of the attributes;
wherein the translating comprises applying alternative sequences of translating and validation rules to the banner information and to attributes extracted from the banner information;
wherein applying of alternative sequences comprises generating and using search nodes that represent attribute extraction alternatives that were explored during the applying of the translating.