Vulnerability assessment based on machine inference
Techniques related to vulnerability assessment based on machine inference are disclosed. A vulnerability assessment server may receive, from a client device, a set of metadata corresponding to a program stored on the client device. Further, the vulnerability assessment server may extract a program name from the set of metadata. Still further, the vulnerability assessment server may determine one or more vulnerabilities of the program based on searching for the program name in one or more storage systems that maintain sets of vulnerability data.
1. A vulnerability assessment method comprising:
receiving, from a client device, at a vulnerability assessment server, a set of metadata corresponding to a program stored on the client device;
extracting, at the vulnerability assessment server, at least a program name and a vendor name from the set of metadata corresponding to the program;
performing a search, in one or more storage systems that maintain sets of unstructured vulnerability data, for a set of unstructured vulnerability data corresponding to the program, wherein performing the search comprises:
determining a set of query tokens that includes the program name;
modifying, based on machine learning, the set of query tokens;
generating a query that includes the modified set of query tokens;
executing the query to identify the set of unstructured vulnerability data corresponding to the program;
searching the one or more storage systems for a standardized program identifier that includes the program name;
correlating the standardized program identifier to the set of unstructured vulnerability data corresponding to the program;
identifying, at the vulnerability assessment server, one or more vulnerabilities of the program based on the set of unstructured vulnerability data corresponding to the program,
wherein the method is performed by one or more computing devices.
2. The vulnerability assessment method of claim 1 , further comprising:
providing the client device with an update that prevents exploitation of the one or more vulnerabilities.
3. The vulnerability assessment method of claim 1 , wherein the set of metadata is received from a third-party agent that executes on the client device to collect sets of metadata corresponding to a plurality of programs stored on the client device.
4. The vulnerability assessment method of claim 1 , wherein the one or more storage systems maintains a mapping between the program name and the standardized program identifier.
5. The vulnerability assessment method of claim 1 , wherein the set of unstructured vulnerability data corresponding to the program includes a token corresponding to the program name.
6. The vulnerability assessment method of claim 5 , wherein the one or more storage systems maintains a mapping between the program name and the set of unstructured vulnerability data corresponding to the program.
7. The vulnerability assessment method of claim 1 , wherein executing the query comprises comparing the set of query tokens to tokens of the sets of unstructured vulnerability data by:
storing the tokens of the sets of unstructured vulnerability data in a set of vectors;
storing the set of query tokens in a query vector;
comparing the query vector to a vector of the set of vectors to determine whether the vector corresponds to the program.
8. The vulnerability assessment method of claim 7 , wherein the vector is determined to correspond to the program based on computing a distance between the vector and the query vector.
9. A vulnerability assessment server system comprising:
one or more processors; and
one or more non-transitory storage media storing instructions which, when executed by the one or more processors, cause:
receiving, at a vulnerability assessment server from a client device, a set of metadata corresponding to a program stored on the client device;
extracting, at the vulnerability assessment server, at least a program name and a vendor name from the set of metadata corresponding to the program;
determining, at the vulnerability assessment server, one or more vulnerabilities of the program based on searching, in one or more storage systems that maintain sets of unstructured vulnerability data, for a set of unstructured vulnerability data corresponding to the program, wherein searching comprises:
determining a set of query tokens that includes the program name;
modifying, based on machine learning, the set of query tokens;
generating a query that includes the modified set of query tokens;
executing the query to identify the set of unstructured vulnerability data corresponding to the program;
searching the one or more storage systems for a standardized program identifier that includes the program name;
correlating the standardized program identifier to the set of unstructured vulnerability data corresponding to the program.
10. The vulnerability assessment server system of claim 9 , wherein the instructions, when executed by the one or more processors, further cause:
providing the client device with an update that prevents exploitation of the one or more vulnerabilities.
11. The vulnerability assessment server system of claim 9 , wherein the set of metadata is received from a third-party agent that executes on the client device to collect sets of metadata corresponding to a plurality of programs stored on the client device.
12. The vulnerability assessment server system of claim 9 , wherein the one or more storage systems maintains a mapping between the program name and the standardized program identifier.
13. The vulnerability assessment server system of claim 9 , wherein the set of unstructured vulnerability data corresponding to the program includes a token corresponding to the program name.
14. The vulnerability assessment server system of claim 13 , wherein the one or more storage systems maintains a mapping between the program name and the set of unstructured vulnerability data corresponding to the program.
15. The vulnerability assessment server system of claim 9 , wherein executing the query comprises comparing the set of query tokens to tokens of the sets of unstructured vulnerability data by:
storing the tokens of the sets of unstructured vulnerability data in a set of vectors;
storing the set of query tokens in a query vector;
comparing the query vector to a vector of the set of vectors to determine whether the vector corresponds to the program.
16. The vulnerability assessment server system of claim 15 , wherein the vector is determined to correspond to the program based on computing a distance between the vector and the query vector.
17. The vulnerability assessment method of claim 1 , wherein the set of query tokens are a set of weighted tokens, and wherein machine learning is used to determine a weighting for a query token in the set of query tokens.
18. The vulnerability assessment server system of claim 9 , wherein the set of query tokens are a set of weighted tokens, and wherein machine learning is used to determine a weighting for a query token in the set of query tokens.
19. The vulnerability assessment method of claim 1 , wherein the sets of unstructured vulnerability data include one or more tokens that are not included in the set of query tokens.
20. The vulnerability assessment server system of claim 9 , wherein the sets of unstructured vulnerability data include one or more tokens that are not included in the set of query tokens.