Granted Patent B2

US 12,413,615 · App. 18/600,442 · Granted Sep 9, 2025

Inventors: Mayuresh Vishwas Dani (Fremont, CA); Ankur S. Tyagi (Foster City, CA); Rishikesh Jayaram Bhide (Pune, IN)

Assignee: Qualys, Inc.

H04L63/1433

Abstract

Claims (103)

1. A method comprising:

determining user information associated with or based on one or more user attributes associated with a vulnerability of a computing device, wherein the one or more user attributes associated with the vulnerability of the computing device comprises first data associated with at least two of:

a website or application,

a browser or application history,

a downloaded or executed file, or

a password, privilege, or configuration;

quantifying the user information associated with or based on the one or more user attributes associated with the vulnerability of the computing device, thereby generating quantified user information;

determining system exploitability information of the computing device, the system exploitability information associated with or based on one or more of:

the vulnerability of the computing device, and

a security window associated with the computing device;

quantifying the system exploitability information of the computing device, thereby generating quantified system exploitability information;

determining system criticality information of the computing device, the system criticality information associated with or based on one or more of:

an asset associated with the computing device, and

a first service associated with the computing device;

quantifying the system criticality information of the computing device, thereby generating quantified system criticality information; and

generating a risk profile for the computing device based on the quantified user information, the quantified system exploitability information, and the quantified system criticality information.

2. The method of claim 1 , wherein the one or more user attributes associated with the vulnerability of the computing device comprises at least one of:

a type of a website a user visits;

browser history data associated with the user;

a first file type the user downloads;

a second file type the user runs;

a password the user stores in a browser of the user;

an application or system credential of the user;

a sensitive user credential including an internet information services (IIS) application pool;

a user credential stored in plain-text on the computing device;

a number of browser extension plugins associated with the browser of the user;

a plugin associated with the browser of the user;

a privilege of the user on the computing device;

a whitelisted application within a security infrastructure associated with the user; or

an automatic logon configuration associated with the user.

3. The method of claim 1 , wherein the vulnerability of the computing device is based on second data relating to vulnerability or patching associated with the computing device.

4. The method of claim 3 , wherein the second data relating to vulnerability or patching includes one or more of:

a hardware specification of the computing device;

whether an operating system of the computing device is up to date;

a list of shared directories on the computing device;

whether the computing device has a latest patch;

whether the computing device has a second service enabled;

one or more connectivity types associated with the computing device; and

a type of security solution associated with the computing device.

5. The method of claim 1 , wherein the security window comprises an exposure window associated with or based on an amount of time where the computing device remains unpatched after a new patch associated with the computing device is released.

6. The method of claim 1 , wherein the security window comprises a protection window associated with or based on an amount of time where a security infrastructure associated with the computing device does not have one or more of a definition, a patch, or a signature.

7. The method of claim 1 , wherein the risk profile is determined based on combining the quantified user information, the quantified system exploitability information, and the quantified system criticality information.

8. The method of claim 1 , further comprising initiating generation of an attack path based on the risk profile, the attack path associated with or based on a route through which an attacker accesses the computing device.

9. A computer program product comprising a non-transitory computer useable medium including a computer readable code, wherein the computer readable code when executed using one or more computing device processors, causes the one or more computing device processors to:

determine user information associated with or based on one or more user attributes associated with a vulnerability of a computing device, wherein the one or more user attributes associated with the vulnerability of the computing device comprises first data associated with at least two of:

a website or application,

a browser or application history,

a downloaded or executed file, or

a password, privilege, or configuration;

quantify the user information associated with or based on the one or more user attributes associated with the vulnerability of the computing device, thereby generating quantified user information;

determine system exploitability information of the computing device, the system exploitability information associated with or based on one or more of:

the vulnerability of the computing device, and

a security window associated with the computing device;

quantify the system exploitability information of the computing device, thereby generating quantified system exploitability information;

determine system criticality information of the computing device, the system criticality information associated with or based on one or more of:

an asset associated with the computing device, and

a service associated with the computing device;

quantify the system criticality information of the computing device, thereby generating quantified system criticality information; and

generate a risk profile for the computing device based on the quantified user information, the quantified system exploitability information, and the quantified system criticality information.

10. The computer program product of claim 9 , wherein the computer readable code further causes the one or more computing device processors to initiate generation of an attack path based on the risk profile, the attack path associated with or based on a route through which an attacker accesses the computing device, wherein the route comprises one of a digital route, a digital pathway, and one or more computer systems through which an attacker attacks or accesses the computing device.

11. The computer program product of claim 9 , wherein the vulnerability of the computing device is based on second data relating to vulnerability or patching associated with the computing device.

12. The computer program product of claim 11 , wherein the second data relating to vulnerability or patching includes one or more of:

a hardware specification of the computing device;

whether an operating system of the computing device is up to date;

a list of shared directories on the computing device;

whether the computing device has a latest patch;

whether the computing device has an enabled service;

one or more connectivity types associated with the computing device; and

a type of security solution associated with the computing device.

13. The computer program product of claim 9 , wherein the security window comprises an exposure window associated with or based on an amount of time where the computing device remains unpatched after a new patch associated with the computing device is released.

14. The computer program product of claim 9 , wherein the security window comprises a protection window associated with or based on an amount of time where a security solution of a security infrastructure associated with the computing device does not have one or more of a definition, a patch, and a signature.

15. The computer program product of claim 9 , wherein the risk profile is determined based on combining the quantified user information, the quantified system exploitability information, and the quantified system criticality information.

16. A system comprising:

one or more computing system processors; and

memory storing instructions that, when executed by the one or more computing system processors, causes the system to:

determine user information associated with or based on one or more user attributes associated with a vulnerability of a computing device, wherein the one or more user attributes associated with the vulnerability of the computing device comprises first data associated with at least one of:

a website or application,

a browser or application history,

a downloaded or executed file, or

a password, privilege, or configuration;

quantify the user information associated with or based on the one or more user attributes associated with the vulnerability of the computing device, thereby generating quantified user information;

determine system exploitability information of the computing device, the system exploitability information associated with or based on one or more of:

the vulnerability of the computing device, and

a security window associated with the computing device;

determine system criticality information of the computing device, the system criticality information associated with or based on one or more:

assets associated with the computing device, and

services associated with the computing device;

quantify the system exploitability information of the computing device, thereby generating quantified system exploitability information;

quantify the system criticality information of the computing device, thereby generating quantified system criticality information; and

generate a risk profile for the computing device based on the quantified user information, the quantified system exploitability information, and the quantified system criticality information.

17. The system of claim 16 , wherein the vulnerability of the computing device is based on second data relating to vulnerability or patching associated with the computing device.

18. The system of claim 17 , wherein the second data relating to vulnerability or patching includes one or more of:

a hardware specification of the computing device;

whether an operating system of the computing device is up to date;

a list of shared directories on the computing device;

whether the computing device has a latest patch;

whether the computing device has an enabled service;

one or more connectivity types associated with the computing device; and

a type of security solution associated with the computing device.

19. The system of claim 16 , wherein the security window comprises a protection window associated with or based on an average time where a security of a security infrastructure associated with the computing device does not have one or more of a definition, a patch, and a signature.

20. The system of claim 16 , wherein the risk profile is determined based on the quantified user information, the quantified system exploitability information, and the quantified system criticality information.

21. The system of claim 16 , wherein the system is further caused to: initiate generation of an attack path based on the risk profile, the attack path associated with or based on a route through which an attacker accesses the computing device.

22. The system of claim 16 , wherein the system is further caused to: initiate generation of at least one attack operation based on the risk profile, the at least one attack operation associated with or based on a procedure through which an attacker accesses the computing device.

Assignments (1)

Continuity (3)

References Cited (31)