Identifying vulnerabilities in processing nodes

1. A method comprising:

scanning a subset of a plurality of processing nodes in a network for vulnerabilities;

selecting a first processing node of the plurality of processing nodes not in the subset;

determining a similarity measure between the first processing node and at least a second processing node of the plurality of processing nodes in the subset, the second processing node being identified as having a given vulnerability, wherein determining the similarity measure comprises determining a first similarity between one or more vulnerabilities previously detected on the first processing node and the second processing node and determining a second similarity between one or more attributes of the first processing node and the second processing, the similarity measure being based at least in part on the first and second similarities;

identifying that the first processing node has the given vulnerability based at least in part on the similarity measure between the first processing node and the second processing node; and

modifying access to the first processing node responsive to identifying that the first processing node has the given vulnerability;

wherein identifying that the first processing node has the given vulnerability is further based at least in part on a combination of the similarity measure between the first processing node and the second processing node and one or more additional similarity measures between the first processing node and one or more additional processing nodes of the plurality of processing nodes in the subset, each of the one or more additional processing nodes having: (i) determined similarity with the first processing node exceeding a first threshold similarity; and (ii) scanning results more recent than a latest scanning result for the first processing node;

wherein the method is performed by at least one processing device comprising a processor coupled to a memory.

2. The method of claim 1 wherein the first processing node is not connected to the network during scanning of the subset of the plurality of processing nodes.

3. The method of claim 1 wherein a scan of the first processing node was not completed during scanning of the subset of the plurality of processing nodes.

4. The method of claim 1 wherein the subset of processing nodes comprise respective representative processing nodes.

5. The method of claim 4 wherein the representative processing nodes in the subset are selected based on the first similarity and the second similarity.

6. The method of claim 1 wherein the first processing node comprises an Internet of Things (IoT) processing device.

7. The method of claim 1 wherein the first processing node comprises at least one of a virtual machine and a container.

8. The method of claim 1 wherein scanning the subset of the plurality of processing nodes comprises utilizing one or more vulnerability scanning tools to provide scan results for each of the processing nodes in the subset, the scan result comprising a time stamp, a unique identifier for that processing node, and a list of vulnerabilities found on that processing node.

9. The method of claim 1 wherein determining the first similarity comprises:

generating a first vulnerability vector for the first processing node, the first vulnerability vector comprising entries indicating whether respective ones of a set of vulnerabilities have been detected on the first processing node;

generating a second vulnerability vector for the second processing node, the second vulnerability vector comprising entries indicating whether respective ones of the set of vulnerabilities were detected on the second processing node;

computing the first similarity between the first vulnerability vector and the second vulnerability vector.

10. The method of claim 9 wherein computing the first similarity between the first vulnerability vector and the second vulnerability vector comprises computing a cosine similarity.

11. The method of claim 1 wherein determining the second similarity comprises:

generating a first attribute vector for the first processing node, the first attribute vector comprising entries indicating values for respective ones of a set of attributes;

generating a second attribute vector for the second processing node, the second attribute vector comprising entries indicating values for respective ones of the set of attributes;

computing the second similarity between the first attribute vector and the second attribute vector.

12. The method of claim 11 further comprising obtaining the attributes of the first processing node and the second processing node from a vulnerability database storing asset records for the plurality of processing nodes, the asset records comprising attributes including one or more of an operating system, a criticality, and a location of a corresponding processing node.

13. The method of claim 1 wherein identifying that the first processing node has the given vulnerability comprises selecting a designated number of the one or more additional processing nodes in the subset having: (i) determined similarity with the first processing node exceeding the first threshold similarity; and (ii) scanning results more recent than the latest scanning result for the first processing node.

14. The method of claim 13 wherein identifying that the first processing node has the given vulnerability further comprises computing a weighted function of the similarities between the first processing node and the selected processing nodes in the subset, the selected processing nodes in the subset comprising the second processing node and the designated number of the one or more additional processing nodes in the subset.

15. The method of claim 14 further comprising identifying that the first processing node has the given vulnerability when the weighted function of the selected processing nodes in the subset with the given vulnerability exceeds a second threshold similarity.

16. The method of claim 1 wherein modifying access to the first processing node comprises at least one of:

blocking the first processing node from connecting to the network;

removing the given vulnerability from the first processing node; and

generating an alert indicating that the first processing node has the given vulnerability.

17. A computer program product comprising a non-transitory processor-readable storage medium having stored therein program code of one or more software programs, wherein the program code when executed by at least one processing device causes the at least one processing device:

to scan a subset of a plurality of processing nodes in a network for vulnerabilities;

to select a first processing node of the plurality of processing nodes not in the subset;

to determine a similarity measure between the first processing node and at least a second processing node of the plurality of processing nodes in the subset, the second processing node being identified as having a given vulnerability, wherein determining the similarity measure comprises determining a first similarity between one or more vulnerabilities previously detected on the first processing node and the second processing node and determining a second similarity between one or more attributes of the first processing node and the second processing node, the similarity measure being based at least in part on the first and second similarities;

to identify that the first processing node has the given vulnerability based at least in part on the similarity measure between the first processing node and the second processing node; and

to modify access to the first processing node responsive to identifying that the first processing node has the given vulnerability;

wherein identifying that the first processing node has the given vulnerability is further based at least in part on a combination of the similarity measure between the first processing node and the second processing node and one or more additional similarity measures between the first processing node and one or more additional processing nodes of the plurality of processing nodes in the subset, each of the one or more additional processing nodes having: (i) determined similarity with the first processing node exceeding a first threshold similarity; and (ii) scanning results more recent than a latest scanning result for the first processing node.

18. The computer program product of claim 17 wherein identifying that the first processing node has the given vulnerability comprises:

selecting a designated number of the one or more additional processing nodes in the subset having: (i) determined similarity with the first processing node exceeding the first threshold similarity; and (ii) scanning results more recent than the latest scanning result for the first processing node;

computing a weighted function of the similarities between the first processing node and the selected processing nodes in the subset, the selected processing nodes in the subset comprising the second processing node and the designated number of the one or more additional processing nodes in the subset; and

identifying that the first processing node has the given vulnerability when the weighted function of the selected processing nodes in the subset with the given vulnerability exceeds a second threshold similarity.

19. An apparatus comprising:

at least one processing device comprising a processor coupled to a memory;

the at least one processing device being configured:

to scan a subset of a plurality of processing nodes in a network for vulnerabilities;

to select a first processing node of the plurality of processing nodes not in the subset;

to determine a similarity measure between the first processing node and at least a second processing node of the plurality of processing nodes in the subset, the second processing node being identified as having a given vulnerability, wherein determining the similarity measure comprises determining a first similarity between one or more vulnerabilities previously detected on the first processing node and the second processing node and determining a second similarity between one or more attributes of the first processing node and the second processing node, the similarity measure being based at least in part on the first and second similarities;

to identify that the first processing node has the given vulnerability based at least in part on the similarity measure between the first processing node and the second processing node; and

to modify access to the first processing node responsive to identifying that the first processing node has the given vulnerability;

wherein identifying that the first processing node has the given vulnerability is further based at least in part on a combination of the similarity measure between the first processing node and the second processing node and one or more additional similarity measures between the first processing node and one or more additional processing nodes of the plurality of processing nodes in the subset, each of the one or more additional processing nodes having: (i) determined similarity with the first processing node exceeding a first threshold similarity; and (ii) scanning results more recent than a latest scanning result for the first processing node.

20. The apparatus of claim 19 wherein identifying that the first processing node has the given vulnerability comprises:

selecting a designated number of the one or more additional processing nodes in the subset having: (i) determined similarity with the first processing node exceeding the first threshold similarity; and (ii) scanning results more recent than the latest scanning result for the first processing node;

computing a weighted function of the similarities between the first processing node and the selected processing nodes in the subset, the selected processing nodes in the subset comprising the second processing node and the designated number of the one or more additional processing nodes in the subset; and

identifying that the first processing node has the given vulnerability when the weighted function of the selected processing nodes in the subset with the given vulnerability exceeds a second threshold similarity.