Method and system for performing a local vulnerability check of an application upgrade to be downloaded before initiating the upgrade
In general, embodiments relate to a method for performing a local vulnerability check of an application upgrade to be downloaded, comprising: receiving an application upgrade download request from a client device; sending, by a client device upgrade manager, information related to the application upgrade download request to a local vulnerability validator; determining by the local vulnerability validator, based on impact score information, that a specific version of the application upgrade to be downloaded has vulnerabilities; sending the impact score information to the client device upgrade manager; and notifying, based on the impact score information, the client device that the application upgrade to be downloaded has vulnerabilities.
1. A method for performing a local vulnerability check of an application upgrade to be downloaded, the method comprising:
receiving an application upgrade download request from a client device;
sending, by a client device upgrade manager, information related to the application upgrade download request to a local vulnerability validator, wherein the information related to the request comprises device configuration information of the client device,
wherein the device configuration information comprises configurations of a set of client devices that has requested the application upgrade;
determining, by the local vulnerability validator and based on impact score information that is generated using the information related to the request, that a specific version of the application upgrade to be downloaded has vulnerabilities,
wherein the local vulnerability validator performs the determining based on a common vulnerability scoring system,
wherein, when generating the impact score information, the local vulnerability validator further considers a set of impact factor parameters comprising an attack vector and an attack complexity;
sending the impact score information to the client device upgrade manager; and
notifying, based on the impact score information, the client device that the application upgrade to be downloaded has vulnerabilities.
2. The method of claim 1 , wherein the local vulnerability validator determines vulnerabilities of the application upgrade to be downloaded.
3. The method of claim 1 , wherein the local vulnerability validator comprises a forest tree database, wherein the forest tree database comprises an impact score of a subcomponent of the application upgrade to be downloaded.
4. The method of claim 3 , wherein the impact score information is calculated based on the impact score of the subcomponent of the application upgrade to be downloaded.
5. The method of claim 3 , wherein the subcomponent of the application upgrade to be downloaded is a dynamically linked library or an archive file.
6. The method of claim 1 , wherein the information related to the application upgrade download request further comprises application version information of the application upgrade to be downloaded.
7. The method of claim 1 , wherein the local vulnerability validator is in sync with a vulnerability validator.
8. A non-transitory computer readable medium comprising computer readable program code, which when executed by a computer processor enables the computer processor to perform a method, the method comprising:
receiving an application upgrade download request from a client device;
sending, by a client device upgrade manager, information related to the application upgrade download request to a local vulnerability validator, wherein the information related to the request comprises device configuration information of the client device,
wherein the device configuration information comprises configurations of a set of client devices that has requested the application upgrade;
determining, by the local vulnerability validator and based on impact score information that is generated using the information related to the request, that a specific version of the application upgrade to be downloaded has vulnerabilities,
wherein the local vulnerability validator performs the determining based on a common vulnerability scoring system,
wherein, when generating the impact score information, the local vulnerability validator further considers a set of impact factor parameters comprising an attack vector and an attack complexity;
sending the impact score information to the client device upgrade manager; and
notifying, based on the impact score information, the client device that the application upgrade to be downloaded has vulnerabilities.
9. The non-transitory computer readable medium of claim 8 , wherein the local vulnerability validator determines vulnerabilities of the application upgrade to be downloaded.
10. The non-transitory computer readable medium of claim 8 , wherein the local vulnerability validator comprises a forest tree database, wherein the forest tree database comprises an impact score of a subcomponent of the application upgrade to be downloaded.
11. The non-transitory computer readable medium of claim 10 , wherein the impact score information is calculated based on the impact score of the subcomponent of the application upgrade to be downloaded.
12. The non-transitory computer readable medium of claim 10 , wherein the subcomponent of the application upgrade to be downloaded is a dynamically linked library or an archive file.
13. The non-transitory computer readable medium of claim 8 , wherein the information related to the application upgrade download request further comprises application version information of the application upgrade to be downloaded.
14. The non-transitory computer readable medium of claim 8 , wherein the local vulnerability validator is in sync with a vulnerability validator.
15. A system for performing a local vulnerability check of an application upgrade to be downloaded, the system comprising:
a processor of a client device upgrade manager (CDUM) comprising circuitry;
memory of the CDUM comprising instructions, which when executed perform a method, the method comprising:
receiving an application upgrade download request from a client device;
sending information related to the application upgrade download request to a local vulnerability validator (LVV), wherein the information related to the request comprises device configuration information of the client device, wherein the device configuration information comprises configurations of a set of client devices that has requested the application upgrade,
wherein, based on impact score information that is generated using the information related to the request, the LVV determines that a specific version of the application upgrade to be downloaded has vulnerabilities, wherein the LVV performs the determining based on a common vulnerability scoring system, wherein, when generating the impact score information, the LVV further considers a set of impact factor parameters comprising an attack vector and an attack complexity,
wherein the LVV sends the impact score information to the CDUM; and
notifying, based on the impact score information, the client device that the application upgrade to be downloaded has vulnerabilities.
16. The system of claim 15 , wherein the LVV determines vulnerabilities of the application upgrade to be downloaded.
17. The system of claim 15 , wherein the LVV comprises a forest tree database, wherein the forest tree database comprises an impact score of a subcomponent of the application upgrade to be downloaded.
18. The system of claim 17 , wherein the impact score information is calculated based on the impact score of the subcomponent of the application upgrade to be downloaded.
19. The system of claim 17 , wherein the subcomponent of the application upgrade to be downloaded is a dynamically linked library or an archive file.
20. The system of claim 15 , wherein the information related to the application upgrade download request further comprises application version information of the application upgrade to be downloaded.