System and method for detecting cybersecurity vulnerabilities via device attribute resolution
A system and method for vulnerability detection. A method includes: tokenizing device attribute data for a device into at least one set of first tokens, wherein each of the first tokens is formatted according to a token schema; creating at least one device attribute string, each device attribute string including one of the first tokens; matching each of the at least one device attribute string to combinations of device attributes stored in a vulnerabilities database in order to identify at least one matching combination of device attributes for the device, wherein the vulnerabilities database stores mappings between combinations of device attributes and vulnerabilities, wherein each combination of device attributes in the vulnerabilities database includes second tokens formatted according to the token schema; detecting at least one vulnerability of the device based on the at least one matching combination of device attributes and the mappings in the vulnerabilities database.
1. A method for vulnerability detection, comprising:
obtaining, from one or more data sources, device attribute data, the device attribute data comprising one or more attributes, each attribute related to a hardware type, operating system, or application of a device;
cleaning the device attribute data by removing non-character symbols, punctuation, and/or duplicate portions of data from the device attribute data;
tokenizing, using a tokenizer function, the cleaned device attribute data for the device into one or more first tokens, the one or more first tokens formatted according to a token schema, and each first token representing an attribute of the one or more attributes, wherein a null token is created for an attribute that is not included in the obtained device attribute data;
creating at least one device attribute string based on the one or more first tokens, wherein each of the at least one device attribute string corresponds to a respective entity of the device, wherein each entity of the device has a type selected from: hardware, operating system, or application, and wherein each at least one device attribute string comprises a token indicating the entity type to which the at least one device attribute string corresponds;
matching, by applying one or more matching rules based on the token indicating the entity type, each of the at least one device attribute string to a combination of device attributes of a plurality of combinations of device attributes stored in a vulnerabilities database, wherein the vulnerabilities database stores mappings between each combination of device attributes of the plurality of combinations of device attributes and one or more vulnerabilities, wherein each combination of device attributes in the vulnerabilities database is defined by a second token formatted according to the token schema; and
detecting at least one vulnerability of the device based on the matching of the device attribute strong to the combination of device attributes and the corresponding mapping in the vulnerabilities database.
2. The method of claim 1 , further comprising:
performing at least one mitigation action with respect to the device based on the detected at least one vulnerability.
3. The method of claim 1 , wherein the at least one device attribute string is at least one first device attribute string, wherein each combination of device attributes in the vulnerabilities database is a second device attribute string.
4. The method of claim 1 , wherein the vulnerabilities in the vulnerabilities database are identified by respective common vulnerabilities and exposures identifiers.
5. The method of claim 1 , wherein matching each of the at least one device attribute string to the plurality of combinations of device attributes stored in the vulnerabilities database further comprises:
comparing the set of first tokens included in the device attribute string to each of the plurality of combinations of device attributes.
6. A non-transitory computer readable medium having stored thereon instructions for causing a processing circuitry to execute a process, the process comprising:
obtaining, from one or more data sources, device attribute data, the device attribute data comprising one or more attributes, each attribute related to a hardware type, operating system, or application of a device;
cleaning the device attribute data by removing non-character symbols, punctuation, and/or duplicate portions of data from the device attribute data;
tokenizing, using a tokenizer function, the cleaned device attribute data for the device into one or more first tokens, the one or more first tokens formatted according to a token schema, and each first token representing an attribute of the one or more attributes, wherein a null token is created for an attribute that is not included in the obtained device attribute data;
creating at least one device attribute string based on the one or more first tokens, wherein each of the at least one device attribute string corresponds to a respective entity of the device, wherein each entity of the device has a type selected from: hardware, operating system, or application, and wherein each at least one device attribute string comprises a token indicating the entity type to which the at least one device attribute string corresponds;
matching, by applying one or more matching rules based on the token indicating the entity type, each of the at least one device attribute string to a combination of device attributes of a plurality of combinations of device attributes stored in a vulnerabilities database, wherein the vulnerabilities database stores mappings between each combination of device attributes of the plurality of combinations of device attributes and one or more vulnerabilities, wherein each combination of device attributes in the vulnerabilities database is defined by a second token formatted according to the token schema; and
detecting at least one vulnerability of the device based on the matching of the device attribute strong to the combination of device attributes and the corresponding mapping in the vulnerabilities database.
7. A system for vulnerability detection, comprising:
a processing circuitry; and
a memory, the memory containing instructions that, when executed by the processing circuitry, configure the system to:
obtain, from one or more data sources, device attribute data, the device attribute data comprising one or more attributes, each attribute related to a hardware type, operating system, or application of a device;
clean the device attribute data by removing non-character symbols, punctuation, and/or duplicate portions of data from the device attribute data;
tokenize, using a tokenizer function, the cleaned device attribute data for the device into one or more first tokens, the one or more first tokens formatted according to a token schema, and each first token representing an attribute of the one or more attributes, wherein a null token is created for an attribute that is not included in the obtained device attribute data;
create at least one device attribute string based on the one or more first tokens, wherein each of the at least one device attribute string corresponds to a respective entity of the device, wherein each entity of the device has a type selected from: hardware, operating system, or application, and wherein each at least one device attribute string comprises a token indicating the entity type to which the at least one device attribute string corresponds;
match, by applying one or more matching rules based on the token indicating the entity type, each of the at least one device attribute string to a combination of device attributes of a plurality of combinations of device attributes stored in a vulnerabilities database, wherein the vulnerabilities database stores mappings between each combination of device attributes of the plurality of combinations of device attributes and one or more vulnerabilities, wherein each combination of device attributes in the vulnerabilities database is defined by a second token formatted according to the token schema; and
detect at least one vulnerability of the device based on the matching of the device attribute strong to the combination of device attributes and the corresponding mapping in the vulnerabilities database.
8. The system of claim 7 , wherein the system is further configured to:
perform at least one mitigation action with respect to the device based on the detected at least one vulnerability.
9. The system of claim 7 , wherein the at least one device attribute string is at least one first device attribute string, wherein each combination of device attributes in the vulnerabilities database is a second device attribute string.
10. The system of claim 7 , wherein the vulnerabilities in the vulnerabilities database are identified by respective common vulnerabilities and exposures identifiers.
11. The system of claim 7 , wherein the system is further configured to:
compare the set of first tokens included in the device attribute string to each of the plurality of combinations of device attributes.