Granted Patent B2

US 12,192,228 · App. 18/332,529 · Granted Jan 7, 2025

Inventors: Pradeep Cruz (Issaquah, WA); Jan Olav Opedal (Ellensburg, WA); Srikrishna Srinivasan (Issaquah, WA); Yanbing Su (Frisco, TX)

Assignee: T-Mobile USA, Inc.

H04L63/1433G06F8/65

Abstract

Claims (66)

1. A method for adaptive vulnerability management of a computer system, the method comprising:

collecting vulnerability information over a network, from a networked source,

wherein the vulnerability information includes a known vulnerability of a first computer asset, and

wherein the vulnerability information includes a set of cybersecurity vulnerabilities and exposures (CVEs);

collecting system information of the computer system,

wherein the system information includes information about the first computer asset of the computer system; and

processing the vulnerability information and the system information by:

interpreting at least some of the CVEs of the set of CVEs with natural language processing (NLP);

identifying a potential vulnerability of the first computer asset based on a correlation between the at least some of the interpreted CVEs and the system information;

storing, in a database, a subset of the vulnerability information,

wherein the subset of the vulnerability information does not match the system information; and

generating, based on text extracted from the subset of the vulnerability information stored in the database, a search index that enables access to processed analytics of the vulnerability information.

2. The method of claim 1 , wherein the first computer asset includes a hardware asset, a software asset, or a configuration of the computer system.

3. The method of claim 1 , wherein processing the vulnerability information and the system information comprises:

correlating the at least some of the interpreted CVEs with the system information in accordance with a machine learning (ML) model, the ML model being trained based on the system information of the computer system.

4. The method of claim 1 , wherein the correlation comprises:

calculating a Levenshtein distance of the known vulnerability in the vulnerability information to the first computer asset;

ranking the Levenshtein distance as a measure of relevance between the known vulnerability and the first computer asset; and

identifying the potential vulnerability based on a rank of the Levenshtein distance to the first computer asset.

5. The method of claim 1 , further comprising correlating the at least some of the interpreted CVEs with the system information by performing a similarity analysis between the first computer asset and a second computer asset associated with the vulnerability information.

6. The method of claim 5 , wherein the correlating comprises:

determining a relevance score of the first computer asset based on the known vulnerability in the vulnerability information; and

identifying the potential vulnerability based on the relevance score.

7. The method of claim 1 further comprising:

performing a risk classification and prioritization of the potential vulnerability based on a multi-class boosted decision forests algorithm.

8. The method of claim 1 further comprising:

estimating a financial risk of the potential vulnerability by performing a risk valuation of the potential vulnerability based on a Monte Carlo simulation by using a beta-PERT distribution.

9. The method of claim 1 further comprising:

estimating a financial risk of the potential vulnerability by performing a risk valuation of the potential vulnerability.

10. The method of claim 1 , wherein the vulnerability information comprises a file formatted in JavaScript Object Notation (JSON), Hypertext Markup Language (HTML), or Extensible Markup Language (XML).

11. The method of claim 1 , wherein the vulnerability information is collected from a publishing source, and wherein the publishing source comprises a public national vulnerability database (NVD) that obtains the vulnerability information from a vendor of the first computer asset.

12. The method of claim 11 , wherein the publishing source comprises a vendor of a second computer asset associated with the vulnerability information and the vulnerability information is obtained directly from the vendor.

13. The method of claim 1 , wherein the potential vulnerability is a first potential vulnerability, and the at least some of the interpreted CVEs are in a machine-readable format, the method further comprising:

identifying a second potential vulnerability of a second computer asset of the computer system based on a correlation between the at least some of the interpreted CVEs in the machine-readable format and the system information.

14. The method of claim 1 , wherein the vulnerability information is collected from a publishing source, and wherein the publishing source comprises is a vendor of a second computer asset associated with the vulnerability information, and collecting the vulnerability information comprises:

automatically obtaining the vulnerability information periodically over the network from a website administered by the vendor.

15. The method of claim 1 further comprising:

periodically extracting the vulnerability information from an online portal.

16. The method of claim 1 , wherein the first computer asset is a software asset, the method further comprising:

obtaining a software patch over the network for the software asset.

17. The method of claim 1 further comprising:

receiving an indication that the potential vulnerability was validated as a vulnerability based on a manual review.

18. A vulnerability management system for a computer system, the system comprising:

a network interface through which to obtain vulnerability information for computer assets over a network;

one or more processors configured to identify vulnerabilities of the computer system based on the vulnerability information for the computer assets and inventory information of the computer assets for the computer system; and

a non-transitory, computer-readable storage medium comprising instructions recorded thereon that, when executed by the one or more processors, cause the system to:

cause the network interface to automatically collect the vulnerability information periodically over the network;

perform a matching process of the vulnerability information to the inventory information of the computer assets for the computer system;

identify a vulnerability of the computer system as a match between a known vulnerability included in the inventory information and a computer asset listed in the inventory information of the computer system;

store, in a cloud-based results database, a subset of the vulnerability information,

wherein the subset of the vulnerability information does not match the inventory information; and

generate, based on text extracted from the subset of the vulnerability information, a search index that enables access to processed analytics of the vulnerability information.

19. The system of claim 18 , wherein the instructions further cause the system to:

classify a risk of the vulnerability based on a decision algorithm; and

estimate a financial risk of the vulnerability based on a risk valuation of the vulnerability.

20. At least one non-transitory computer-readable storage medium carrying instructions that, when executed by a vulnerability management system, cause the vulnerability management system to perform operations for identifying a vulnerability of a computer asset, the operations comprising:

collecting cybersecurity vulnerabilities and exposures (CVEs) from a networked source;

collecting feature information of the computer asset subject to vulnerability management;

processing the CVEs and the feature information by:

interpreting at least some of the CVEs using natural language processing (NLP) to understand a known vulnerability of a known computer asset;

calculating a Levenshtein distance between the known computer asset and the computer asset;

ranking the Levenshtein distance as a measure of relevance of the known computer asset to the computer asset; and

identifying a potential vulnerability of the computer asset based on a rank of the Levenshtein distance;

storing, in a database, a subset of the interpreted CVEs,

wherein the subset of the interpreted CVEs does not match the feature information; and

generating, based on text extracted from the subset of the feature information, a search index that enables access to processed analytics of the CVEs.

Assignments (1)

Continuity (2)

References Cited (13)