VULNERABILITY FUNNEL
A vulnerability funneling method that comprises performing, by a processor, multi-stage filtering a target to identify vulnerabilities; filtering, by the processor, non-Known Exploited Vulnerabilities (non-KEVs) from the identified vulnerabilities to identify Known Exploited Vulnerabilities (KEVs) in the identified vulnerabilities; and generating, by the processor, vulnerability information with the identified vulnerabilities and the KEVs classified into filtering stages.
1 . A vulnerability classification method, the method comprising:
performing, by a processor, multi-stage filtering a target to identify vulnerabilities;
filtering, by the processor, non-Known Exploited Vulnerabilities (non-KEVs) from the identified vulnerabilities to identify Known Exploited Vulnerabilities (KEVs) in the identified vulnerabilities; and
generating, by the processor, vulnerability information with the identified vulnerabilities and the KEVs classified into filtering stages.
2 . The method of claim 1 , wherein the processor is configured to perform the multi-stage filtering by:
performing vulnerability scanning to identify a plurality of vulnerabilities;
performing first stage filtering on the plurality of vulnerabilities to identify non-triaged vulnerabilities; and
performing second stage filtering on the non-triaged vulnerabilities to identify running vulnerabilities associated with workloads that are actively running.
3 . The method of claim 2 , wherein the processor is configured to perform the multi-stage filtering by further performing:
performing third stage filtering on the running vulnerabilities to identify in-use vulnerabilities associated with workloads that are in use; and
performing fourth stage filtering on the in-use vulnerabilities to identify Common Vulnerability Scoring System (CVSS) vulnerabilities that exceed a CVSS threshold.
4 . The method of claim 3 , wherein the processor is configured to perform the multi-stage filtering by further performing:
performing fifth stage filtering on the CVSS vulnerabilities to identify in-production vulnerabilities associated with workloads that are in a production environment; and
performing sixth stage filtering on the running vulnerabilities to identify publicly exposed vulnerabilities.
5 . The method of claim 4 , wherein the processor is configured to perform the multi-stage filtering by further performing:
performing seventh stage filtering on the publicly exposed vulnerabilities to identify vulnerabilities with an exploitable Proof of Concept (PoC); and
performing eighth stage filtering on the vulnerabilities with the exploitable PoC to identify Exploit Prediction Scoring System-based (EPSS-based) vulnerabilities that exceed an EPSS threshold.
6 . The method of claim 5 , wherein the seventh stage filtering comprises cross-referencing the publicly exposed vulnerabilities against an exploit database.
7 . The method of claim 6 , wherein the filtering stages comprise (i) the first stage filtering to the eighth stage filtering; and (ii) non-KEV filtering.
8 . The method of claim 6 , further comprising:
generating, by the processor, a recommendation based on the identified vulnerabilities and/or the KEVs using an Artificial Intelligence (AI) model,
wherein the recommendation comprises (i) a recommendation directed to a group of vulnerabilities identified in any of the first stage filtering to the fifth stage filtering; and/or (ii) a targeted recommendation directed to a vulnerability identified in any of the sixth stage filtering to non-KEV filtering.
9 . The method of claim 1 , wherein the processor is configured to filter the non-KEVs from the identified vulnerabilities by cross-referencing the identified vulnerabilities against a KEV catalog to identify the KEVs, wherein the KEV catalog includes a list of Common Vulnerabilities and Exposures (CVEs) known to have been actively exploited.
10 . The method of claim 1 , wherein the performing the multi-stage filtering is triggered by one or more conditions comprising: (i) receipt of at least one Software Bill of Materials (SBOMs) that forms the target; or (ii) receipt of a user request to initiate vulnerability classification.
11 . The method of claim 1 , wherein the vulnerability information comprises a funnel diagram that visualizes the identified vulnerabilities and the KEVs classified in the filtering stages.
12 . A non-transitory computer readable medium, storing instructions for performing vulnerability classification to be executed by a processor, the instructions comprising:
performing multi-stage filtering a target to identify vulnerabilities;
filtering non-Known Exploited Vulnerabilities (non-KEVs) from the identified vulnerabilities to identify Known Exploited Vulnerabilities (KEVs) in the identified vulnerabilities; and
generating vulnerability information with the identified vulnerabilities and the KEVs classified into filtering stages.
13 . The non-transitory computer readable medium of claim 12 , wherein the performing the multi-stage filtering the target to identify the vulnerabilities comprises:
performing vulnerability scanning to identify a plurality of vulnerabilities;
performing first stage filtering on the plurality of vulnerabilities to identify non-triaged vulnerabilities; and
performing second stage filtering on the non-triaged vulnerabilities to identify running vulnerabilities associated with workloads that are actively running.
14 . The non-transitory computer readable medium of claim 13 , wherein the performing the multi-stage filtering the target to identify the vulnerabilities further comprises:
performing third stage filtering on the running vulnerabilities to identify in-use vulnerabilities associated with workloads that are in use; and
performing fourth stage filtering on the in-use vulnerabilities to identify Common Vulnerability Scoring System (CVSS) vulnerabilities that exceed a CVSS threshold.
15 . The non-transitory computer readable medium of claim 14 , wherein the performing the multi-stage filtering the target to identify the vulnerabilities further comprises:
performing fifth stage filtering on the CVSS vulnerabilities to identify in-production vulnerabilities associated with workloads that are in a production environment; and
performing sixth stage filtering on the running vulnerabilities to identify publicly exposed vulnerabilities.
16 . The non-transitory computer readable medium of claim 15 , wherein the performing the multi-stage filtering the target to identify the vulnerabilities further comprises:
performing seventh stage filtering on the publicly exposed vulnerabilities to identify vulnerabilities with an exploitable Proof of Concept (PoC); and
performing eighth stage filtering on the vulnerabilities with the exploitable PoC to identify Exploit Prediction Scoring System-based (EPSS-based) vulnerabilities that exceed an EPSS threshold.
17 . The non-transitory computer readable medium of claim 16 , wherein the seventh stage filtering comprises cross-referencing the publicly exposed vulnerabilities against an exploit database.
18 . The non-transitory computer readable medium of claim 17 , wherein the filtering stages comprise (i) the first stage filtering to the eighth stage filtering; and (ii) non-KEV filtering.
19 . The non-transitory computer readable medium of claim 17 , further comprising:
generating, by the processor, a recommendation based on the identified vulnerabilities and/or the KEVs using an Artificial Intelligence (AI) model,
wherein the recommendation comprises (i) a recommendation directed to a group of vulnerabilities identified in any of the first stage filtering to the fifth stage filtering; and/or (ii) a targeted recommendation directed to a vulnerability identified in any of the sixth stage filtering to non-KEV filtering.
20 . The non-transitory computer readable medium of claim 12 , wherein the processor is configured to filter the non-KEVs from the identified vulnerabilities by cross-referencing the identified vulnerabilities against a KEV catalog to identify the KEVs, wherein the KEV catalog includes a list of Common Vulnerabilities and Exposures (CVEs) known to have been actively exploited.