Detecting a root cause for a vulnerability using subjective logic in social media

1. A computing device comprising:

a processor;

a network interface coupled to the processor to enable communication over a network;

a storage device coupled to the processor;

a vulnerability engine code stored in the storage device, wherein an execution of the code by the processor configures the computing device to perform acts comprising:

monitoring social media communication;

identifying social media threads that relate to a discussion about a vulnerability of a computing device, based on the monitored social media communication;

filtering the identified social media threads by removing SPAM postings therefrom;

categorizing the filtered identified social media threads into one or more predetermined categories of computing device vulnerabilities;

upon determining that a number of social media posts of the social media threads related to the vulnerability is above a first predetermined threshold:

searching one or more dependable social media threads in a same one or more categories of the vulnerability;

determining one or more possible root causes of the vulnerability from the searched dependable social media threads;

assigning a validity score for each of the one or more possible root causes; and

selecting a possible root cause from the one or more possible root causes that has a highest validity score that is above a second predetermined threshold, to be the root cause of the vulnerability; and

upon determining the root cause of the vulnerability, sending a notification to one or more computing devices that are deemed to be affected or are at risk to be affected by the identified vulnerability.

2. The computing device of claim 1 , wherein monitoring social media communication comprises receiving social media from one or more social media hosts at a predetermined interval via the network interface.

3. The computing device of claim 1 , wherein identifying social media threads that are related to a vulnerability of a computing device comprises:

during a given training phase, receiving historic data of social media communication related to one or more vulnerabilities, from a database;

using the historic data for machine learning to construct an algorithm that can identify one or more vulnerabilities of a computing device from social media; and

during a given monitoring phase, applying the algorithm to the monitored social media communication, wherein the given monitoring phase is after the given training phase.

4. The computing device of claim 1 , wherein filtering the identified social media threads by removing SPAM postings therefrom comprises:

determining an intent of each monitored social media communication via concept expansion; and

removing any monitored social media communication that has been determined to have a marketing intent.

5. The computing device of claim 1 , wherein the first predetermined threshold is different for each predetermined category of computing device vulnerabilities.

6. The computing device of claim 1 , wherein the categories include at least one of:

Denial of Service (DOS);

SQL Injection;

code execution; or

memory corruption.

7. The computing device of claim 1 , wherein identifying dependable social media threads for the one or more predetermined categories comprises, during a training phase, receiving a training social media communication, wherein the monitoring and resolution phases are after the training phase.

8. The computing device of claim 1 , further comprising, upon determining the root cause of the vulnerability, sending a notification to one or more computing devices that are deemed to be affected or are at risk to be affected by the identified vulnerability.

9. The computing device of claim 8 , wherein the notification includes a patch to the identified vulnerability.

10. The computing device of claim 1 , wherein subjective logic is used for assigning a validity score for each of the one or more possible root causes.

11. A non-transitory computer readable storage medium tangibly embodying a computer readable program code having computer readable instructions that, when executed, causes a computer device to carry out a method of identifying a computing device vulnerability, the method comprising:

monitoring social media communication;

identifying social media threads that relate to a discussion about a vulnerability of a computing device, based on the monitored social media communication;

filtering the identified social media threads by removing SPAM postings therefrom;

categorizing the filtered identified social media threads into one or more predetermined categories of computing device vulnerabilities;

upon determining that a number of social media posts of the social media threads related to the vulnerability is above a first predetermined threshold:

searching one or more dependable social media threads in a same one or more categories of the vulnerability;

determining one or more possible root causes of the vulnerability from the searched dependable social media threads;

assigning a validity score for each of the one or more possible root causes; and

selecting a possible root cause from the one or more possible root causes that has a highest validity score that is above a second predetermined threshold, to be the root cause of the vulnerability; and

upon determining the root cause of the vulnerability, sending a notification to one or more computing devices that are deemed to be affected or are at risk to be affected by the identified vulnerability, wherein the notification includes a patch to the identified vulnerability.

12. The non-transitory computer readable storage medium of claim 11 , wherein identifying social media threads that are related to a vulnerability of a computing device comprises:

during a given training phase, receiving historic data of social media communication related to one or more vulnerabilities, from a database;

using the historic data for machine learning to construct an algorithm that can identify one or more vulnerabilities of a computing device from social media; and

during a given monitoring phase, applying the algorithm to the monitored social media communication, wherein the given monitoring phase is after the given training phase.

13. The non-transitory computer readable storage medium of claim 12 , wherein identifying social media threads that are related to a vulnerability of a computing device further comprises:

extracting meaningful sentences from the monitored social media communication via natural learning processing (NLP); and

determining an intent of each monitored social media communication via concept expansion.

14. The non-transitory computer readable storage medium of claim 11 , wherein filtering the identified social media threads by removing SPAM postings therefrom comprises:

determining an intent of each monitored social media communication via concept expansion; and

removing any monitored social media communication that has been determined to have a marketing intent.

15. The non-transitory computer readable storage medium of claim 11 , wherein the first predetermined threshold is different for each predetermined category of computing device vulnerabilities.

16. The non-transitory computer readable storage medium of claim 11 , wherein the categories include at least one of:

Denial of Service (DOS);

SQL Injection;

code execution; or

memory corruption.

17. The non-transitory computer readable storage medium of claim 11 , wherein identifying dependable social media threads for the one or more predetermined categories comprises, during a training phase, receiving a training social media communication, wherein the monitoring and resolution phases are after the training phase.

18. The non-transitory computer readable storage medium of claim 11 , wherein subjective logic is used for assigning a validity score for each of the one or more possible root causes.

19. The computing device of claim 3 , wherein identifying social media threads that are related to a vulnerability of a computing device further comprises:

extracting meaningful sentences from the monitored social media communication via natural learning processing (NLP); and

determining an intent of each monitored social media communication via concept expansion.