Systems and methods for distributed extended common vulnerabilities and exposures data management
In one aspect, the present disclosure is directed to systems and methods for validating and securely storing security entry updates. The security entry update is received from a contributor, and broadcast to a plurality of computing nodes. It then is determined whether to validate the received security update at each computing node of the plurality of computing nodes. If the received security entry update is validated, information relating to the received security update is added as transaction information in a current block, the current block is included in a blockchain that is stored in a datastore of each computing node of the plurality of computing nodes. Other aspects also are described.
1. A method for validating and securely storing security updates amongst a threat intelligence community, comprising:
receiving a security update submitted from one or more contributors to members of the threat intelligence community;
broadcasting the received security update to a plurality of computing nodes in communication with one or more networks, each of the computing nodes managed by one or more of the members of the threat intelligence community and including a memory configured to store a blockchain;
determining whether to validate the received security update at each computing node of the plurality of computing nodes, including:
determining whether the received security update includes one or more required fields; and
initiating voting among members of the threat intelligence community and receiving votes for validation or denial of the received security update from at least some of the members of the threat intelligence community; and
if the received security update is validated by a selected number of votes or weighted votes from the members of the threat intelligence community:
adding information relating to the received security update as transaction information in a current block; and
including the current block in the blockchain stored in the memory of each computing node of the plurality of computing nodes; and
if the received security update did not receive the selected number of votes or weighted votes, deny validation of the received security update.
2. The method of claim 1 , wherein if the received security update is validated, the method further comprises:
providing an incentivizing award to at least one contributor of the one or more contributors of the received security update.
3. The method of claim 2 , wherein the incentivizing award comprises one or more digital tokens.
4. The method of claim 1 , further comprising:
generating hash value of a previous block in the blockchain and including the hash value in the current block.
5. The method of claim 1 , wherein the one or more required fields include information related to an identifier, a description, and at least one public reference.
6. The method of claim 1 , further comprising:
receiving a staked amount of digital tokens for the votes for validation or denial of the received security update from each computing node of the plurality of computing nodes; and
weighting the votes based on the staked amount of digital tokens for each vote to determine whether to validate or deny the received security update.
7. The method of claim 1 , further comprising:
generating an amount of digital tokens staked for the security update by the one or more contributors, and
if the submitted security update is validated, providing a digital token award from the generated digital tokens award to the one or more contributors.
8. The method of claim 1 , further comprising locking or deactivating generation of new or additional digital tokens during validation of the received security update.
9. The method of claim 1 , wherein the security update comprises a Common Vulnerabilities and Exposures (CVE) update and/or an Extended Common Vulnerabilities and Exposures (ECVE) update.
10. A system for validating and securely storing security updates amongst a threat intelligence community, comprising:
a distributed network including a plurality of computing nodes, each of the computing nodes managed by one or more members of the threat intelligence community;
one or more processors at a series of computing nodes of a distributed network, wherein each of the computing nodes includes a memory having a datastore configured to store and manage a blockchain comprising a plurality of security updates; and
a non-transitory memory storing computer readable instructions that are accessed and executed by the one or more processors of the computing nodes to cause the computing nodes to:
receive a security update broadcast to the distributed network of computing nodes from at least one contributor;
determine whether to validate the received security update based on a set of rules, the set of rules including, at least, a determination that the received security update includes selected fields, and on votes or weighted votes received from members of the threat intelligence community to validate or deny the received security update; and
if the received security update is validated:
add information relating to the received security update as transaction information in a current block; and
include the current block in the blockchain in the datastore of each computing node of the plurality of computing nodes.
11. The system of claim 10 , wherein the computer readable instructions that are accessed and executed by the one or more processors of the computing nodes further cause the computing nodes to generate hash value of a previous block in the blockchain and include the hash value in the current block.
12. The system of claim 10 , wherein the one or more selected fields include information related to an identifier, a description, and at least one public reference.
13. The system of claim 10 , wherein the computer readable instructions that are accessed and executed by the one or more processors of the computing nodes to determine whether a majority of votes or weighted votes received from members of the threat intelligence community is in favor of validation of the received security update comprise instructions configured to:
receive votes for validation or denial of the received security update from each computing node of the distributed network;
determine a total number of votes or weighted votes for validation or denial of the received security update; and
validate the received security update if a majority of received votes or weighted votes are in favor of validation of the received security update.
14. The system of claim 10 , wherein the computer readable instructions that are accessed and executed by the one or more processors of the computing nodes further cause the computing nodes to:
generate an amount of digital tokens staked for the security update by the contributor, and
if the submitted security update is validated, provide a digital token award from the amount of generated digital tokens to the contributor.
15. The system of claim 14 , wherein the computer readable instructions that are accessed and executed by the one or more processors of the computing nodes further cause the computing nodes to lock or deactivate generation of new or additional digital tokens during validation of the received security update.
16. The system of claim 10 , wherein the security update comprises a Common Vulnerabilities and Exposures (CVE) update and/or an Extended Common Vulnerabilities and Exposures (ECVE) update.
17. The system of claim 10 , wherein the computer readable instructions that are accessed and executed by the one or more processors of the computing nodes further cause the computing nodes:
if the received security update does not include the specific fields, transmit a notification to the contributor indicating that the received security update was denied due to lack of at least one field of the specific fields.