Dynamic re-composition of patch groups using stream clustering

1. A system, comprising:

a memory that stores computer executable components; and

a processor that executes the computer executable components stored in the memory, wherein the computer executable components comprise:

an adjustment component that:

identifies a subset of server devices that share at least one common vulnerability from a plurality of server devices on a network; and

adds the subset of server devices to a server group;

a risk assessment component that:

in response to a first risk associated with a first server device of the server group, patches the server devices of the server group to mitigate the first risk to the server group, wherein the server group is comprised of at least the first server device and a second server device; and

a monitoring component that:

monitors data associated with a second risk to the server group to mitigate the second risk to the server group.

2. The system of claim 1 , wherein the first risk is associated with a vulnerability of the first server device to a malware attack.

3. The system of claim 1 , wherein the adjustment component modifies the server group to mitigate the second risk of the server group, resulting in a server group modification.

4. The system of claim 3 , wherein the server group modification removes the second server device from the server group to mitigate the second risk.

5. The system of claim 1 , wherein the monitoring component receives an indication that the server group has been modified.

6. The system of claim 1 , wherein the risk assessment component receives risk data representative of a risk associated with the first server device.

7. The system of claim 1 , wherein the server group is a first server group, and wherein the risk assessment component assesses a third risk for a second server group that is not the first server group.

8. A computer program product that facilitates server group patching, the computer program product comprising a computer readable storage medium having program instructions embodied therewith, the program instructions executable by a processor to cause the processor to:

identify a subset of server devices that share at least one common vulnerability from a plurality of server devices on a network;

add the subset of server devices to a server group;

in response to a first risk associated with a first server device of the server group, patch the server devices of the server group to mitigate the first risk to the server group, wherein the server group is comprised of at least the first server device and a second server device; and

monitor data associated with a second risk to the server group to mitigate the second risk to the server group.

9. The computer program product of claim 8 , wherein the first risk is associated with a vulnerability of the first server device to a malware attack.

10. The computer program product of claim 8 , wherein the program instructions are further executable by the processor to cause the processor to:

modify the server group to mitigate the second risk of the server group, resulting in a server group modification.

11. The computer program product of claim 10 , wherein the server group modification removes the second server device from the server group to mitigate the second risk.

12. The computer program product of claim 8 , wherein the program instructions are further executable by the processor to cause the processor to:

receive an indication that the server group has been modified.

13. The computer program product of claim 8 , wherein a risk assessment component receives risk data representative of a risk associated with the first server device.

14. The computer program product of claim 8 , wherein the server group is a first server group, and wherein a risk assessment component assesses a third risk for a second server group that is not the first server group.

15. A computer-implemented method, comprising:

identifying, by a device operatively coupled to a processor, a subset of server devices that share at least one common vulnerability from a plurality of server devices on a network;

adding, by the device, the subset of server devices to a server group;

in response to a first risk associated with a first server device of the server group, patching, by the device, the server devices of the server group to mitigate the first risk to the server group, wherein the server group is comprised of at least the first server device and a second server device; and

monitoring, by the device, data associated with a second risk to the server group to mitigate the second risk to the server group.

16. The computer-implemented method of claim 15 , wherein the first risk is associated with a vulnerability of the first server device to a malware attack.

17. The computer-implemented method of claim 15 , further comprising:

modifying, by the device, the server group to mitigate the second risk of the server group, resulting in a server group modification.

18. The computer-implemented method of claim 17 , wherein the server group modification removes the second server device from the server group to mitigate the second risk.

19. The computer-implemented method of claim 15 , further comprising:

receiving an indication that the server group has been modified.

20. The computer-implemented method of claim 15 , wherein a risk assessment component receives risk data representative of a risk associated with the first server device.

21. A system, comprising:

a memory that stores computer executable components; and

a processor that executes the computer executable components stored in the memory, wherein the computer executable components comprise:

an adjustment component that:

identifies a subset of server devices that share at least one common vulnerability from a plurality of server devices on a network; and

adds the subset of server devices to a server group;

a risk assessment component that:

in response to a first risk associated with a first server device of the server group, patches the server devices of the server group to mitigate the first risk to the server group, wherein the server group is comprised of at least the first server device and a second server device;

a monitoring component that:

monitors data associated with a second risk to the server group to mitigate the second risk to the server group; and

a learning component that:

analyzes risk data associated with a previous risk received from a workstation device, resulting in a risk prediction.

22. The system of claim 21 , wherein the risk prediction is used as an input to the monitoring component to mitigate a third risk to the server group.

23. The system of claim 21 , wherein the first risk is associated with a vulnerability of the first server device to a malware attack.

24. A computer program product that facilitates server group patching, the computer program product comprising a computer readable storage medium having program instructions embodied therewith, the program instructions executable by a processor to cause the processor to:

identify a subset of server devices that share at least one common vulnerability from a plurality of server devices on a network;

add the subset of server devices to a server group;

in response to a first risk associated with a first server device of the server group, patch the server devices of the server group to mitigate the first risk to the server group, wherein the server group is comprised of at least the first server device and a second server device;

monitor data associated with a second risk to the server group to mitigate the second risk to the server group; and

analyze risk data associated with a previous risk received from a workstation device, resulting in a risk prediction.

25. The computer program product of claim 24 , wherein the risk prediction is used as an input to mitigate a third risk to the server group.