Combining policy compliance and vulnerability management for risk assessment

Abstract

Apparatus, methods, and computer program products are provided that combine policy compliance with vulnerability management to provide a more accurate risk assessment of an environment. The method includes training a policy machine learning model using a first training data set to generate a policy machine learning model for generating a mitigation technique classification, and training a vulnerability machine learning model using a second training data set to generate a vulnerability machine learning model for generating a weakness type classification. The method also includes mapping the mitigation technique classification to an attack technique to generate a policy mapping, and mapping the weakness type classification to an attack technique to generate a vulnerability mapping. The method further includes generating a vulnerability risk assessment based on the policy mapping and the vulnerability mapping.

Description

[Technical field]

[0001] The present disclosure relates to risk assessment, and more particularly, to combining policy compliance and vulnerability management to provide a more accurate risk assessment of an environment.

[0002] Enterprise security is a complex problem that requires the coordination of security policies, controls, threat models, and threat detection scenarios (use cases). Enforcement of these policies, models, and controls requires the extensive use of threat monitoring technologies, security devices, and resources with security, business, and technical skills. The large and ever-growing number of threats requires automation to support the analysts tasked with preventing, detecting, and responding to these threats. Often, analysts must manually search extensive data sources, review past threat events and how they were handled, and check knowledge databases for duplicate events, current open events, and appropriate response procedures for handling the information.

[0003] A variety of tools for threat monitoring currently exist to analyze a wide range of data sources, including structured, unstructured, semi-structured, and reference data, to identify patterns that indicate threats, security policies, and control anomalies. When such threats and / or anomalies are detected, an "actionable" alert is created. Once the contributing factors have been taken into account, the security analyst can determine the optimal disposition for a particular alert. Summary of the Invention

[0004] An embodiment of the present disclosure includes a method for combining policy compliance and vulnerability management to provide a more accurate risk assessment of an environment. The method includes training a policy machine learning model using a first training data set to generate a policy machine learning model for generating a mitigation technique classification, and training a vulnerability machine learning model using a second training data set to generate a vulnerability machine learning model for generating a weakness type classification. The method also includes mapping the mitigation technique classification to an attack technique to generate a policy mapping, and mapping the weakness type classification to an attack technique to generate a vulnerability mapping. The method further includes generating a risk assessment of the vulnerability based on the policy mapping and the vulnerability mapping.

[0005] Additional embodiments of the present disclosure include a computer program product for combining policy compliance and vulnerability management to provide a more accurate risk assessment of an environment, a computer readable storage medium having a computer readable program stored thereon, the computer readable program, when executed on a computing device, causing the computing device to train a policy machine learning model using a first training data set to generate a policy machine learning model for producing a mitigation technique classification, and to train a vulnerability machine learning model using a second training data set to generate a vulnerability machine learning model for producing a weakness type classification. The computer program also causes the computing device to map the mitigation technique classification to an attack technique to generate a policy mapping, and to map the weakness type classification to an attack technique to generate a vulnerability mapping. The computer program also causes the computing device to generate a vulnerability risk assessment based on the policy mapping and the vulnerability mapping.

[0006] Further embodiments of the present disclosure include an apparatus for dynamically selecting features and machine learning models to combine policy compliance and vulnerability management to provide a more accurate risk assessment of an environment. The apparatus includes a memory, a processor, and a local data storage having computer executable code stored thereon. The computer executable code includes program instructions executable by the processor to cause the processor to perform the above-described method. This summary is not intended to describe each aspect, every implementation, or every embodiment or combination of the present disclosure.

[0007] These and other features, aspects, and advantages of the embodiments of the present disclosure will become better understood with regard to the following description, appended claims, and accompanying drawings. [Brief description of the drawings]

[0008] [Figure 1] FIG. 2 is a block diagram illustrating the operation of major operational elements of an improved computing tool used in accordance with one or more embodiments of the present disclosure. [Diagram 2] FIG. 1 is a block diagram illustrating the operation of a trained machine learning model during runtime operation in determining a risk assessment for an environment and used by one or more embodiments of the present disclosure. [Diagram 3] FIG. 1 is a flow diagram illustrating a process performed in accordance with an embodiment of the present disclosure that combines policy compliance and vulnerability management to provide a more accurate risk assessment of an environment. [Figure 4] FIG. 1 is a high-level block diagram illustrating an exemplary computer system that may be used in implementing one or more of the methods, tools, modules, and any associated functionality described herein in which the present disclosure may be practiced. [Diagram 5] FIG. 1 is a diagram of a cloud computing environment according to an embodiment of the present disclosure. [Figure 6] FIG. 2 is a diagram of an abstract model layer according to an embodiment of the present disclosure. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0009] While the present disclosure is susceptible to various modifications and alternative forms, specific examples thereof have been shown by way of example in the drawings and will be described in detail. It should be understood, however, that no intention is intended to be limited to the particular embodiments described. On the contrary, the intention is to cover all modifications, equivalents, and alternatives falling within the scope of the present disclosure. In the accompanying drawings, like reference numerals are used to designate like parts.

[0010] The present disclosure relates to risk assessment, and more particularly to combining policy compliance and vulnerability management to provide a more accurate risk assessment of an environment. The present disclosure is not necessarily limited to such applications, but various aspects of the present disclosure will be understood through a discussion of various examples using such a context.

[0011] Information system security (ISS) seeks to protect information and the systems that store and process information. This protection is against risks that may lead to unauthorized access, use, disclosure, interference, modification, or destruction of information. Organizations adopt security policies designed to protect information against risks. Policy compliance management, or governance, is implemented to ensure adherence to these policies, processes, standards, and guidelines. Compliance with policies provides some assurance that critical information is being properly managed. In addition, regulators can examine policy compliance to see whether risks to shareholders, customers, and the general public are being properly managed by the organization.

[0012] Compliance testing can provide consistent and comparable insight into governance processes. Regular and consistent testing allows organizations to compare improvements over time. Administrators can refine processes over time and make changes that refine and improve the process. For example, a policy on system configurations can help mitigate a particular vulnerability or potentially eliminate the risk of the vulnerability entirely. Ensuring compliance with policies can help organizations better protect their information.

[0013] Security policies, or simply policies, can be thought of as business requirements for actions or processes to be performed by an organization. These policies can set rules for users and define the consequences of violations, minimizing risks to the organization. Security policies can also take the form of standards, which are established norms or practices, which can be procedural or technical standards that are implemented across the organization. Policies can also include procedures that describe the steps required to implement the policy, and guidelines that detail the parameters for the implementation of such policies. For example, guidelines can make a policy optional for some users and mandatory for others.

[0014] In addition to policy compliance management, organizations can also perform vulnerability management to protect against potential vulnerabilities within their information technology (IT) infrastructure. Removing known vulnerabilities makes it more difficult for attackers to compromise endpoints and gain a foothold within the environment. Vulnerability management is crucial because policy compliance management may not fully protect systems from attackers if vulnerabilities exist.

[0015] Vulnerability management can attempt to protect against vulnerabilities by including a patch management system. Patch management can work with a software configuration management (SCM) system to track version and patch levels of servers and endpoints across the enterprise. This allows remote patching and keeping systems up to date. Although useful, patch management assumes that patches are available for certain vulnerabilities and that there is sufficient time and manpower to apply those patches. However, in a real-world environment, such conditions may not exist and certain components may not be detectable by SCM. For example, components such as routers, firewalls, test machines, abandoned servers, and devices running incompatible operating systems may not be detectable and may be out of date. Given this situation, vulnerability management attempts to manage risk by assessing the full range of vulnerabilities present in network equipment and determining which vulnerabilities pose the highest risk to the security of the organization. Once a risk assessment has been performed, mitigation techniques can be implemented.

[0016] However, limitations remain because policy compliance management and vulnerability management look at these two security components separately when assessing the risk to an environment. There may be situations in an environment where a vulnerability does not necessarily put the environment at risk because policies exist that reduce the risk of the vulnerability. Currently, no correlation is made between a given vulnerability and the mitigation checks that are in place.

[0017] Embodiments of the present disclosure may overcome the above and other problems by providing a mechanism that combines policy compliance and vulnerability management to provide a more accurate risk assessment of an environment. In such a mechanism, policy compliance logs may be utilized to train and utilize machine learning models in classifying mitigation techniques. Additionally, vulnerability logs (e.g., Common Vulnerabilities and Exposures (CVE) logs) are used to train and utilize machine learning models in classifying vulnerabilities (e.g., Common Weakness Enumeration (CWE)). A mapping may be created between mitigation technique classifications and known attack techniques. Additionally, another mapping may be created between vulnerability classifications and known attack techniques. During runtime operation, as risk assessment is performed, discovered attack techniques may be matched with corresponding mitigation techniques to provide a more accurate assessment of the overall risk to the environment.

[0018] More specifically, machine learning models are used to identify the relationship between compliance security checks and vulnerabilities in the environment. When a vulnerability is detected in the environment, the corresponding policies in place are matched against a risk assessment to give a rating that takes into account not only the weaknesses in the environment, but also the policies in place that may mitigate such risks. For example, a vulnerability may be discovered with respect to mounting devices (e.g., portable hard drives, flash drives, etc.) to a server. However, there may be policies in place that restrict and prevent users from being able to mount devices to a server. Therefore, when considering policies along with risk, the overall risk rating may be considered low since measures are already in place to prevent the vulnerability from being exploited.

[0019] In some embodiments, generating the risk assessment includes initially generating a risk assessment based on a vulnerability mapping. The initial risk assessment can be based on vulnerabilities detected in the environment. Once generated, the attack techniques mapped to the vulnerability mapping can be compared to the attack techniques mapped to the policy mapping. Based on the comparison, it can be determined that the policy mapping includes at least one attack technique as a vulnerability mapping. Because there is at least one policy mapping that corresponds to an attack technique in association with a vulnerability, the initial risk assessment can be adjusted to provide a more accurate assessment of the factors of the policy being implemented.

[0020] In some embodiments, a machine learning model is used to facilitate the mapping of mitigation techniques to attack techniques. Initially, a mitigation mapping machine learning model is trained using a third training data set to generate attack technique classifications. The third training data set can include mitigation techniques converted into feature vectors with corresponding classifications of attack techniques. The mitigation technique classifications can be input into the mitigation mapping machine learning model to generate attack technique classifications during runtime operation. A policy mapping can be generated based on the mitigation technique classifications mapped to corresponding attack technique classifications.

[0021] In some embodiments, a machine learning model is used to facilitate the mapping of weakness types to attack techniques. First, a weakness mapping machine learning model is trained using a third training data set to generate attack technique classifications. The third training data set can include weakness types converted into feature vectors with corresponding classifications of attack techniques. The weakness type classifications can be input into the weakness mapping machine learning model to generate attack technique classifications during runtime operation. Vulnerability mappings can be generated based on the weakness type classifications mapped to the corresponding attack technique classifications.

[0022] Machine learning (ML) model-based policy compliance and vulnerability management mechanisms can be implemented to classify the policies and vulnerabilities of a computer system into an overall risk assessment of an environment. A variety of different ML models can be used to classify the policies and vulnerabilities of a computer system, and in some cases, ensembles of such ML models, such as random forests, gradient boosting, and ensembles of deep learning machine learning models, also referred to as "classifiers," can be utilized to classify the state of a computing system from policy and vulnerability log data structures with respect to determining a risk assessment and to determine which ML models to use in the particular policy compliance and / or vulnerability management mechanism being implemented.

[0023] FIG. 1 is a block diagram illustrating the operation of the main operational elements of an improved computing tool 100 for providing risk assessment combining policy compliance checks with vulnerability management results, according to an embodiment of the present disclosure. The computing tool 100 includes a monitored computing environment 102, a policy compliance check 110, a mitigation technique 120, a policy machine learning model 130, a policy training data set 132, a mitigation machine learning model 140, a mitigation training data set 142, a vulnerability list 150, a weakness type list 160, a vulnerability machine learning model 170, a vulnerability training data set 172, a weakness machine learning model 180, a weakness training data set 182, and a risk assessor 190. For purposes of this description, it is assumed that the exemplary embodiment is implemented as part of a computer security mechanism and is specifically directed to risk assessment combining policy compliance and vulnerability management. However, this is merely one possible implementation and is not intended to limit the present disclosure. Other embodiments capable of identifying anomalous patterns in input data may be used without departing from the spirit and scope of the present disclosure.

[0024] The policy compliance check 110 is a scan of the monitored computing environment 102 to check whether components, computers, modules, devices, etc. comply with the security policies implemented by the enterprise. The policy compliance check 110 includes security policies within a policy framework that are enforced on the monitored computing environment 102. A security policy, or simply policy, specifies the requirements for protecting information and the systems that store and process information. Policies can be thought of as requirements for actions or processes implemented by an organization. Protection is against risks that may lead to unauthorized access, use, disclosure, interference, modification, or destruction of information. These policies seek to ensure the protection of information wherever and in whatever form it is. The creation of policies can be determined by many factors regarding the monitored computing environment 102. Factors include the size of the organization, the processes, the type of information, and the laws and regulations that the organization must follow.

[0025] The policy compliance check 110 scans the monitored computing environment 102 to verify that requirements in the security policy are applied to security controls and information. The policy compliance check 110 can measure compliance to a set of controls. These controls can define how information is protected. In some embodiments, the policy compliance check 110 can report the number of devices that are compliant with each policy to determine the level of compliance. The level of compliance can take into account device usage and traffic throughput. For example, three firewalls are compliant with the policy, but a fourth firewall is not. However, the fourth firewall handles 70% of the Internet traffic. Handling this traffic throughput means that the organization is only compliant with 30% of the policies.

[0026] In some embodiments, the policy compliance check includes different domain policy requirements within the monitored computing environment 102. For example, the monitored computing environment 102 may include different domains, such as a local area network (LAN) domain, a wide area network (WAN) domain, a user domain, a workstation domain, a remote access domain, a LAN-to-WAN domain, a system / application domain, etc. Each of these domains may have its own policy requirements based on factors such as its equipment and operations. The policy compliance check 110 may include information about each of these domains individually, separately, or both.

[0027] Mitigation techniques 120 are techniques for vulnerabilities that a technique potentially mitigates when implemented in the monitored computing environment 102. Each policy in the policy framework can be associated with a mitigation technique for the potential vulnerability that the policy prevents. Mitigation techniques 120 can represent classes of security concepts and techniques that can be used to prevent a vulnerability technique or sub-technique from successfully executing. Mitigation techniques 120 include, but are not limited to, data backup, encryption, anti-virus, boot integrity, execution prevention, hardware / software installation restrictions, network segmentation, operating system configuration, password policies, registry restrictions, software updates, and user account control.

[0028] The policy machine learning model 130 is a component of the computing tool 100 configured as a machine learning model and is trained to identify mitigation techniques for policies within a policy framework. The policy machine learning model 130 can be configured as various types of machine learning (ML) models. These ML models include convolutional neural networks (CNNs), deep neural networks (DNNs), recurrent neural networks (RNNs), or other types of machine learning models. For example, the policy machine learning model 130 can be a deep learning model, a random forest model, a gradient boosting model, a support vector machine, etc. The policy ML model 130 is trained to input a policy and classify mitigation techniques associated with the policy. Although there is a direct mapping between policies and mitigation techniques, some policies may be associated with mitigation techniques that are not directly mapped. It should be understood that this is just one possible implementation and other embodiments may be configured to provide classifications of different levels of granularity and complexity. For example, the policy machine learning model 130 may provide separate classifications for different types of mitigation techniques, such as a vector output where each vector slot corresponds to a different classification and the value of each vector slot indicates the probability that the corresponding classification applies to a particular input.

[0029] The policy machine learning model 130 requires training to classify features in policies into mitigation techniques from a training dataset 132 so that the policy machine learning model 130 can identify mitigation techniques from policies during runtime operation. For training, the training dataset 132 is provided from a training dataset source (not shown). The training data of the training dataset 132 includes training data entries representing policies, each of which may represent a policy 134 implementable on the monitored computing environment 102. Each training data entry also has a classification 136, e.g., a mitigation technique, corresponding to that training data entry. In addition, the training dataset 132 may also include additional policies 134 that may or may not currently be implemented on the monitored computing environment 102, along with their corresponding correct classifications 136, or ground truth classifications.

[0030] The mitigation machine learning model 140 is a component of the computing tool 100 configured as a machine learning model and trained to identify attack techniques from the mitigation techniques produced by the policy machine learning model 130. An attack technique is a technique for how an adversary achieves a tactical goal when performing an action. For example, access token manipulation is an attack technique in which an adversary can modify an access token and operate under a different user or system security context to perform an action and bypass access controls. Mitigation techniques that limit the ability of users to create tokens, such as privileged account management and user account management, can be mitigation techniques against access token manipulation attacks.

[0031] The mitigation machine learning model 140 can be configured as various types of ML models. These ML models include CNN, DNN, RNN, or other types of machine learning models. For example, the mitigation machine learning model 140 can be a deep learning model, a random forest model, a gradient boosting model, a support vector machine, etc. The mitigation ML model 140 is trained to input mitigation techniques and classify attack techniques associated with the input mitigation techniques. While there is a direct mapping between mitigation techniques and attack techniques, some mitigation techniques may be associated with attack techniques that do not map directly. It should be understood that this is only one possible implementation and other embodiments may be configured to provide classifications of different levels of granularity and complexity. For example, the mitigation machine learning model 140 can provide separate classifications for different types of mitigation techniques, such as a vector output where each vector slot corresponds to a different classification and the value of each vector slot indicates the probability that the corresponding classification applies to a particular input.

[0032] The mitigation machine learning model 140 requires training to classify features in mitigation techniques into attack techniques from a training dataset 142 so that it can distinguish attack techniques from mitigation techniques during runtime operation. For training, the training dataset 142 is provided from a training dataset source (not shown). The training data of the training dataset 142 includes training data entries representing mitigation techniques, each of which may represent a mitigation technique 144 implementable on the monitored computing environment 102. Each training data entry also has a classification 146, e.g., attack technique, corresponding to that training data entry. In addition, the training dataset 142 may also include additional mitigation techniques 144 that may or may not currently be implemented on the monitored computing environment 102, along with corresponding ground truth classifications 146.

[0033] The vulnerability list 150 is an aggregation of cybersecurity vulnerabilities. These vulnerabilities can be detected and aggregated by collecting information from the monitored computing environment 102. This information includes information about hosts, endpoints, and network devices on the network. Host information can be collected from exploratory scans using network mapping tools (e.g., Nmap), asset database tools, or configuration management databases (CMDBs). Vulnerability scanners can be implemented to discover vulnerabilities by interacting with devices, either through network-based scans or host-based agents. Detected vulnerabilities can be added to the vulnerability list 150. Network scanners can also be used to access all Internet Protocol (IP) addresses in a range, or a specific list of IPs, to determine which ports are open, what services are running on those ports, the operating system (OS) version, associated configuration, and software packages running on each device. Host-based scanless agents can interrogate systems in the monitored computing environment 102 to determine running services and version information. These scans and vulnerability checks can be performed periodically to ensure that the vulnerability list 150 contains current vulnerabilities. It should be noted that other scans and methods may be used to detect vulnerabilities.

[0034] In some embodiments, vulnerability list 150 includes a Common Vulnerabilities and Exposures (CVE) list that includes publicly disclosed computer security flaws. CVE provides a standardized identifier for a vulnerability or exposure. This identifier can be used to access information about the issue from multiple sources that are CVE compatible. For example, a security tool whose reports include references to CVE IDs can access fixed information in a separate database that is also CVE compatible. In some embodiments, vulnerability list 150 analyzes current publicly known vulnerabilities and vulnerabilities that have been detected within monitored computing environment 102. Publicly known vulnerabilities can be treated separately or together with detected vulnerabilities.

[0035] The Weakness Type List 160 is a collection of software and hardware weakness types that have a detrimental effect on security. A "weakness" may be considered a flaw, fault, bug, or other error in software or hardware implementation, code, design, or architecture that, if left unaddressed, may render a system, network, or hardware vulnerable to attack. Each weakness type may include a description, an associated weakness, a description of how the weakness is introduced into the environment, and a potential vulnerability that may result if the weakness is not addressed.

[0036] In some embodiments, the vulnerability type list 160 includes a Common Weakness Enumeration (CWE) list that includes publicly disclosed common vulnerability types and hardware vulnerability types. These vulnerability types are divided into software vulnerability types and hardware vulnerability types, and are further classified by vulnerability type. For example, the software vulnerability type category may include authentication errors, encapsulation problems, privilege problems, random number problems, signal problems, and type errors. Within each of these categories, various vulnerability types may be listed.

[0037] The vulnerability machine learning model 170 is a component of the computing tool 100 that is configured as a machine learning model and trained to identify weakness types from vulnerabilities in the vulnerability list 150. The vulnerability machine learning model 170 can be configured as various types of ML models. These ML models include CNN, DNN, RNN, or other types of machine learning models. For example, the vulnerability machine learning model 170 can be a deep learning model, a random forest model, a gradient boosting model, a support vector machine, etc. The vulnerability ML model 170 is trained to input vulnerabilities and classify weakness types associated with the input vulnerabilities. Although there is a direct mapping between vulnerabilities and weakness types, some vulnerabilities may be associated with weakness types that are not directly mapped. It should be understood that this is just one possible implementation and other embodiments may be configured to provide classifications of different levels of granularity and complexity. For example, a vulnerability machine learning model 179 may provide separate classifications for different types of vulnerabilities, such as a vector output where each vector slot corresponds to a different classification and the value of each vector slot indicates the probability that the corresponding classification applies to a particular input.

[0038] The vulnerability machine learning model 170 requires training to classify features in mitigation techniques into attack techniques from a training dataset 172 so that it can distinguish exploit types from vulnerabilities during runtime operation. For training, the training dataset 172 is provided from a training dataset source (not shown). The training data of the training dataset 172 includes training data entries representing vulnerabilities, each of which may represent a vulnerability 174 discovered on the monitored computing environment 102. Each training data entry also has a classification 176, e.g., exploit type, corresponding to that training data entry. In addition, the training dataset 172 may also include additional vulnerabilities 174 that may or may not currently be discovered in the monitored computing environment 102, along with corresponding ground truth classifications 146.

[0039] The weakness machine learning model 180 is a component of the computing tool 100 configured as a machine learning model and trained to identify attack techniques from the weakness types produced by the vulnerability machine learning model 170. An attack technique is a technique for how an adversary achieves a tactical goal when performing an action. For example, access token manipulation is an attack technique in which an adversary can modify an access token and operate under a different user or system security context to perform an action and bypass access controls. Weak file system access control, weak system access control, and weak user account control are weaknesses that potentially give rise to access token manipulation.

[0040] The weakness machine learning model 180 can be configured as various types of ML models. These ML models include CNN, DNN, RNN, or other types of machine learning models. For example, the weakness machine learning model 180 can be a deep learning model, a random forest model, a gradient boosting model, a support vector machine, etc. The weakness ML model 180 is trained to input mitigation techniques and classify attack techniques associated with the input mitigation techniques. Although there is a direct mapping between weakness types and attack techniques, some weakness types may be associated with attack techniques that do not map directly. It should be understood that this is only one possible implementation and other embodiments may be configured to provide classifications of different levels of granularity and complexity. For example, the weakness machine learning model 180 can provide separate classifications for different types of attack techniques, such as a vector output where each vector slot corresponds to a different classification and the value of each vector slot indicates the probability that the corresponding classification applies to a particular input.

[0041] The weakness machine learning model 180 requires training from a training dataset 182 to classify features in weakness types into attack techniques so that the weakness machine learning model 180 can distinguish attack techniques from weakness types during runtime operation. For training, the training dataset 182 is provided by a training dataset source (not shown). The training data of the training dataset 182 includes training data entries representing weakness types 184, each of which may represent a weakness type 184 discovered on the monitored computing environment 102. Each training data entry also has a classification 186, e.g., attack technique, corresponding to that training data entry. In addition, the training dataset 182 may also include additional weakness types 184 that may or may not currently be discovered on the monitored computing environment 102, along with corresponding ground truth classifications 186.

[0042] The risk assessor 190 is a component of the computing tool 100 configured to provide a risk assessment of the monitored computing environment 102. The risk assessment can provide additional information necessary to measure the overall security strength of the environment and to make changes to the security risk. The risk assessment can include an objective analysis of the effectiveness of current security controls protecting the organization's assets and a determination of the probability of loss of those assets. In addition, the risk assessment can review the threat environment of the monitored computing environment 102, asset values, system criticality, security control vulnerabilities, and expected loss impacts, and can also provide recommendations regarding additional controls to reduce security risks to an acceptable level. Based on this information, a determination can be made as to whether additional security controls are required.

[0043] The risk assessor may generate a risk assessment by analyzing the vulnerabilities in the vulnerability list, the corresponding weakness types, and the vulnerability mapping between the weakness types and the attack techniques. The risk assessor may further adjust the risk assessment by comparing the attack techniques mapped to the vulnerability mapping with the attack techniques mapped to the policy mapping between the attack techniques and the mitigation techniques. The mitigation techniques may represent security measures already implemented in the monitored computing environment 102. Once the attack techniques are mapped to these mitigation techniques, the risk assessor 190 may reduce the severity of the risk based on the mitigation techniques already implemented. For example, a network denial of service (DOS) attack technique may be discovered from the vulnerability and weakness types that create a risk to the monitored computing environment 102. However, mitigation techniques, such as filtering the network traffic, reduce the network traffic and prevent such attacks from occurring.

[0044] The risk assessor 190 can adjust the risk assessment to greater or lesser risk based on the vulnerabilities and weaknesses of the monitored environment 102 on a risk basis, as well as the mitigation techniques and policies implemented within the monitored computing environment 102. The policy mapping can be used in conjunction with the vulnerability mapping to adjust the risk based on the similarity of attack techniques in the two mappings.

[0045] It should be noted that Figure 1 is intended to depict major representative components of improved computing tool 100. However, in some embodiments, the individual components may be more or less complex than those depicted in Figure 1, there may be components other than or in addition to those shown in Figure 1, and the number, type, and configuration of such components may vary.

[0046] After training the policy machine learning model 130, the mitigation machine learning model 140, the vulnerability machine learning model 170, and the weakness machine learning model 180 in the manner described above, during runtime operation, as shown in Figure 2, the policy machine learning model 130 may receive incoming data in the form of the policy compliance list 110 from the monitored computing environment 102 having a number of computing system resources, e.g., hardware and / or software resources, data structures, etc., that may be evaluated to produce the policy compliance list 110 in the manner described above. Additionally, the vulnerability machine learning model 170 may receive incoming data in the form of the vulnerability list 150 from the monitored computing environment 102 by evaluating the computing system resources to produce the vulnerability list 150 in the manner described above.

[0047] The policy machine learning model 130 can generate classifications of the incoming policy compliance list 110 and predictions of mitigation techniques 120 that correspond to the classifications. The mitigation techniques 120 are then used as incoming data for the mitigation machine learning model 140. The mitigation machine learning model 140 can generate classifications of the incoming mitigation techniques 120 and predictions of attack techniques that correspond to the classifications. The association of mitigation techniques with attack techniques can be thought of as a policy mapping.

[0048] The vulnerability machine learning model 170 can generate a classification of the incoming vulnerability list 150 and a prediction of the weakness type 160 that corresponds to the classification. The weakness type 160 can then be used as incoming data for the weakness machine learning model 180. The weakness machine learning model 180 can generate a classification of the incoming weakness type 160 and a prediction of the attack technique that corresponds to the classification. The association of weakness types and attack techniques can be thought of as a vulnerability mapping.

[0049] This process may be repeated for each policy and vulnerability in policy compliance list 110 and vulnerability list 150, respectively, to generate multiple classifications, one for each policy and vulnerability. In some embodiments, a combination of these classifications may be used to generate a single classification for policy compliance list 110 and / or vulnerability list 150, such as by using a logical "OR" operation. In some cases, the probability / confidence values ​​or scores may be combined using an appropriate function to generate an overall probability / confidence score for policy compliance list 110 or vulnerability list 150, such as an average of the individual probability / confidence scores, a weighted average that may give greater weight to certain ML models than others, etc.

[0050] The risk assessor 190 can evaluate the policy compliance list 110, the vulnerability list 150, the mitigation techniques 120, the weakness types 160, the policy mappings, and the vulnerability mappings to generate an overall risk assessment 195. The risk assessor 190 can consider attack techniques present in both the policy mappings and the vulnerability mappings in generating the risk assessment.

[0051] The resulting risk assessment 195 generated by the risk assessor 190 may be output to a SIEM system or other downstream computing system for implementation of a response action. The response action may take any form now known or later developed, including outputting a notification, such as via a user interface, to a human analyst of the risk assessment that requires escalation. The user interface may include user interface elements for drilling down into the details of the notification, including identifying individual vulnerabilities and weakness types within the risk assessment. In this manner, the human analyst may identify which vulnerabilities and policies in the risk assessment contributed to the escalation. Moreover, probability / confidence values, weighting values, etc. for the classification of the risk assessment may also be provided in the notification to provide further justification for the classification of the incoming data. User interface elements may be provided to allow a user to provide input indicating the correctness or incorrectness of the classification of the vulnerability, policy, mitigation technique, and weakness type, and this information may be stored to create a new training dataset for updating the training of the ML model in the future.

[0052] In this manner, the exemplary embodiments provide a mechanism for combining policy compliance with vulnerability management to provide a more accurate risk assessment of the monitored computing system environment. Additionally, the mechanisms of the exemplary embodiments may work in conjunction with a SIEM system or other downstream computing systems or both to perform response actions when a classification indicates a need to escalate the processing of the risk assessment, which may include outputting notifications via a user interface that may provide the ability to drill down into the details of individual policies, vulnerabilities, their classifications, etc.

[0053] 3 is a flow diagram illustrating a process 300 of combining policy compliance and vulnerability management to provide a more accurate risk assessment of an environment, according to an embodiment of the present disclosure. As shown in FIG. 3, the process 300 begins with training a policy machine learning model 130 using a training dataset 132 having entries corresponding to policies, e.g., access control, domain enforcement, firewall restrictions, etc., and their corresponding correct classifications, e.g., mitigation techniques. This is shown in step 310. A vulnerability machine learning model 170 is trained using a training dataset 172 having entries corresponding to vulnerabilities, e.g., overflow vulnerabilities, code execution, denial of service overflows, etc., and their corresponding correct classifications, e.g., exploit types. This is shown in step 320.

[0054] The mitigation machine learning model 140 is trained using a training dataset 142 with entries corresponding to mitigation techniques and their corresponding attack techniques. This is shown in step 330. In some embodiments, a direct mapping between mitigation techniques and attack techniques is used. This mapping can be thought of as a policy mapping that can be used in place of the mitigation machine learning model 140. The weakness machine learning model is trained using a training dataset 186 with entries corresponding to weakness types and their corresponding attack techniques. This is shown in step 340. In some embodiments, a direct mapping between weakness types and attack techniques is used. This mapping can be thought of as a vulnerability mapping that can be used in place of the weakness machine learning model 180.

[0055] The risk assessor 190 generates a risk assessment based at least in part on a combination of the mapping of attack techniques produced from the mitigation machine learning model 140 and the mapping of attack techniques from the exploitation machine learning model 180. In some embodiments, the risk assessor 190 utilizes a direct mapping to generate the risk assessment, which is shown in step 350.

[0056] 4, there is shown a high-level block diagram of an exemplary computer system 400 (e.g., improved computing tool 100) that may be used (e.g., using one or more processor circuits or computer processors of a computer) in implementing one or more of the methods, tools, and modules described herein, and any associated functionality, in accordance with embodiments of the present disclosure. In some embodiments, the major components of computer system 400 may include one or more processors 402, memory 404, terminal interface 412, I / O (input / output) device interface 414, storage interface 416, and network interface 418, all of which may be communicatively coupled, directly or indirectly, for inter-component communication via memory bus 403, I / O bus 408, and I / O bus interface 410.

[0057] Computer system 400 may include one or more general purpose programmable central processing units (CPUs) 402-1, 402-2, 402-3, and 402-N, collectively referred to herein as processors 402. In some embodiments, computer system 400 may include multiple processors as is typical in relatively large systems, although in other embodiments computer system 400 may alternatively be a single CPU system. Each processor 402 may execute instructions stored in memory 404 and may include one or more levels of on-board cache.

[0058] Memory 404 may include computer system readable media in the form of volatile memory such as random access memory (RAM) 422 or cache memory 424. Computer system 400 may further include other removable / non-removable, volatile / non-volatile computer system storage media. By way of example only, storage system 426 may be provided for reading from and writing to non-removable, non-volatile magnetic media such as a "hard drive." Although not shown, a magnetic disk drive may be provided for reading from and writing to a removable, non-volatile magnetic disk (e.g., a "floppy disk"), or an optical disk drive may be provided for reading from or writing to a removable, non-volatile optical disk (e.g., a CD-ROM, DVD-ROM, or other optical media). In addition, memory 404 may include flash memory, such as a flash memory stick drive or flash drive. Memory devices may be connected to memory bus 403 by one or more data media interfaces. The memory 404 can include at least one program product having a set (eg, at least one) of program modules configured to perform functions of the various embodiments.

[0059] Although memory bus 403 is shown in FIG. 4 as a single bus structure providing a direct communication path between processor 402, memory 404, and I / O bus interface 410, memory bus 403 may, in some embodiments, include multiple different buses or communication paths, which may be arranged in any of a variety of configurations, such as point-to-point links in a hierarchical, star, or web configuration, multiple hierarchical buses, parallel and redundant paths, or any other suitable type of configuration. Additionally, while I / O bus interface 410 and I / O bus 408 are shown as single respective units, computer system 400 may, in some embodiments, include multiple I / O bus interface units, multiple I / O buses, or both. Additionally, although multiple I / O interface units are shown, which separate I / O bus 408 from the various communication paths running to the various I / O devices, in other embodiments, some or all of the I / O devices may be directly connected to one or more system I / O buses.

[0060] In some embodiments, computer system 400 may be a multi-user mainframe computer system, a single-user system, or a server computer or similar device that has little or no direct user interface but receives requests from other computer systems (clients). Further, in some embodiments, computer system 400 may be implemented as a desktop computer, a portable computer, a laptop or notebook computer, a tablet computer, a pocket computer, a telephone, a smartphone, a network switch or router, or any other suitable type of electronic device.

[0061] It should be noted that Figure 4 is intended to depict major representative components of an exemplary computer system 400. However, in some embodiments, the individual components may be more or less complex than those depicted in Figure 4, there may be components other than or in addition to those depicted in Figure 4, and the number, type, and configuration of such components may vary.

[0062] One or more programs / utilities 428, each having at least one set of program modules 430 (e.g., improved computing tool 100), can be stored in memory 404. The programs / utilities 428 can include a hypervisor (also called a virtual machine monitor), one or more operating systems, one or more application programs, other program modules, and program data. Each of the operating system, one or more application programs, other program modules, and program data, or any combination thereof, can include an implementation of a network environment. The programs 428 and / or program modules 430 generally perform the functions or methodologies of the various embodiments.

[0063] Although this disclosure includes detailed descriptions of cloud computing, it should be understood that implementation of the teachings described herein is not limited to a cloud computing environment. Rather, embodiments of the present disclosure may be practiced in conjunction with any other type of computing environment now known or later developed.

[0064] Cloud computing is a service delivery model for enabling convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, network bandwidth, servers, processing, memory, storage, applications, virtual machines, and services) that can be rapidly provisioned and released with minimal management effort or interaction with the service provider. This cloud model can include at least five characteristics, at least three service models, and at least four deployment models.

[0065] Its features are as follows:

[0066] On-Demand Self-Service: Cloud consumers can unilaterally provision computing capacity, such as server time and network storage, automatically as needed without requiring human interaction with the service provider.

[0067] Broad network access: Functionality is available over the network and accessed through standard mechanisms that facilitate use by heterogeneous thin-client and thick-client platforms (e.g., cell phones, laptops, and PDAs).

[0068] Pooling of resources: Provider computing resources are pooled to serve multiple consumers using a multi-tenant model, with different physical and virtual resources dynamically allocated and reallocated depending on demand. There is a sense of location independence in that consumers typically have no control or information about the exact location of the resources provided, although at a higher level of abstraction the location may be specified (e.g. country, state, or data center).

[0069] Rapid Scalability: Capabilities can be provisioned quickly and scalably, in some cases automatically, quickly scaled out, and quickly released and quickly scaled in. To the consumer, the capabilities available for provisioning often appear unlimited, and any amount can be purchased at any time.

[0070] Metering of Services: Cloud systems automatically control and optimize resource usage by leveraging metering capabilities at some level of abstraction appropriate to the type of service (e.g., storage, processing, bandwidth, and active user accounts). Resource usage can be monitored, controlled, and reported, providing transparency to both providers and consumers of the services being used.

[0071] The service model is as follows:

[0072] Software as a Service (SaaS): The functionality provided to the consumer is the use of the provider's applications running on a cloud infrastructure. The applications are accessible from a variety of client devices through thin-client interfaces such as web browsers (e.g., web-based email). The consumer does not manage or control the underlying cloud infrastructure, including networks, servers, operating systems, storage, or even individual application functions, with the exception of limited user-specific application configuration settings.

[0073] Platform as a Service (PaaS): The capability offered to the consumer is to deploy consumer-created or off-the-shelf applications, written using programming languages ​​and tools supported by the provider, onto a cloud infrastructure. The consumer does not manage or control the underlying cloud infrastructure, including networks, servers, operating systems, or storage, but does have control over the deployed applications and, in some cases, the application hosting environment configuration.

[0074] Infrastructure as a Service (IaaS): The capability offered to the consumer is to provision processing, storage, network, and other basic computing resources on which the consumer can deploy and run any software, which may include operating systems and applications. The consumer does not manage or control the underlying cloud infrastructure, but has control over the operating systems, storage, deployed applications, and possibly limited control of select networking components (e.g., host firewalls).

[0075] The deployment model is as follows:

[0076] Private Cloud: The cloud infrastructure is operated exclusively for one organization. It can be managed by that organization or a third party and can exist on-premise or off-premise.

[0077] Community Cloud: Cloud infrastructure is shared by several organizations to support a particular community with a shared set of concerns (e.g., mission, security requirements, policies, and compliance considerations), which may be managed by the organizations or a third party and can exist on-premise or off-premise.

[0078] Public Cloud: The cloud infrastructure is made available to the general public or large industry organizations and is owned by an organization that sells cloud services.

[0079] Hybrid Cloud: Cloud infrastructure is a combination of two or more clouds (private, community, or public) that remain a unique entity, but are joined by standardized or proprietary technologies that allow data and application portability (e.g., cloud bursting to load balance between clouds).

[0080] Cloud computing environments are service-oriented with a focus on statelessness, low coupling, modularity, and semantic interoperability. At the heart of cloud computing is an infrastructure that includes a network of interconnected nodes.

[0081] Referring now to FIG. 5, an exemplary cloud computing environment 500 is depicted. As shown, the cloud computing environment 500 includes one or more cloud computing nodes 510 that can communicate with local computing devices used by cloud consumers, such as, for example, a personal digital assistant (PDA) or mobile phone 520-1, a desktop computer 520-2, a laptop computer 520-3, or an automobile computer system 520-4, or a combination thereof. The nodes 510 can communicate with each other. They can be physically or virtually grouped in one or more networks (not shown), such as a private, community, public, or hybrid cloud, or a combination thereof, as described herein above. This allows the cloud computing environment 500 to provide infrastructure, platform, and / or software as a service, for which the cloud consumer does not need to maintain resources on a local computing device. It will be understood that the types of computing devices 520-1 through 520-4 shown in FIG. 5 are intended to be merely exemplary, and that computing node 510 and cloud computing environment 500 may communicate with any type of computerized device over any type of network and / or network-addressable connections (e.g., using a web browser).

[0082] Referring now to Figure 6, a set of functional abstraction layers 600 provided by cloud computing environment 500 (Figure 5) is shown. It should be understood in advance that the components, layers, and functions shown in Figure 6 are intended to be merely exemplary, and embodiments of the present disclosure are not limited thereto. As depicted, the following layers and corresponding functions are provided:

[0083] Hardware and software layer 610 includes hardware and software components. Examples of hardware components include mainframes 611, RISC (reduced instruction set computing) architecture based servers 612, servers 613, blade servers 614, storage devices 615, and networks and networking components 616. In some embodiments, software components include network application server software 617, and database software 618.

[0084] The virtualization layer 620 provides an abstraction layer over which the following examples of virtual entities may be provided: virtual servers 621 , virtual storage 622 , virtual networks including virtual private networks 623 , virtual applications and operating systems 624 , and virtual clients 625 .

[0085] In one example, the management layer 630 can provide the functions described below. Resource provisioning 631 provides dynamic procurement of computing resources and other resources utilized to perform tasks within the cloud computing environment. Metering and billing 632 provides cost tracking as resources are utilized within the cloud computing environment and billing or invoicing for the consumption of these resources. In one example, these resources can include application software licenses. Security provides identity verification for cloud consumers and tasks, and protection for data and other resources. User portal 633 provides consumers and system administrators with access to the cloud computing environment. Service level management 634 provides cloud computing resource allocation and management so that required service levels are met. Service level agreement (SLA) planning and fulfillment 635 provides advance agreement and procurement of cloud computing resources in anticipation of future demand according to SLAs.

[0086] The workload layer 640 provides examples of functions for which a cloud computing environment may be utilized. Examples of workloads and functions that may be provided from this layer include: mapping and navigation 641, software development and lifecycle management 642 (e.g., improved computing tools 100), virtual classroom instruction delivery 643, data analytics processing 644, transaction processing 645, and threat similarity analysis systems 646.

[0087] The present disclosure may be a system, method, or computer program product, or combination thereof, at any possible level of technical detail of integration. The computer program product may include a computer-readable storage medium having computer-readable program instructions for causing a processor to perform aspects of the present disclosure.

[0088] A computer readable storage medium may be a tangible device capable of holding and storing instructions for use by an instruction execution device. A computer readable storage medium may be, for example, but not limited to, an electronic storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination of the foregoing. A non-exhaustive list of more specific examples of computer readable storage media includes: portable computer diskettes, hard disks, random access memory (RAM), read only memory (ROM), erasable programmable read only memory (EPROM or flash memory), static random access memory (SRAM), portable compact disk read only memory (CD-ROM), digital versatile disk (DVD), memory stick, floppy disk, mechanically encoded devices such as punch cards or grooved ridge structures with instructions recorded thereon, and any suitable combination of the foregoing. As used herein, a computer-readable storage medium should not be construed as a transitory signal itself, such as radio waves or other freely propagating electromagnetic waves, electromagnetic waves propagating through a waveguide or other transmission medium (e.g., light pulses passing through a fiber optic cable), or electrical signals transmitted over electrical wires.

[0089] The computer readable program instructions described herein may be downloaded from a computer readable storage medium to an individual computing / processing device or to an external computer or storage device over a network, such as the Internet, a local area network, a wide area network, or a wireless network, or a combination thereof. The network may comprise copper transmission cables, optical transmission fiber, wireless transmission, routers, firewalls, switches, gateway computers, or edge servers, or a combination thereof. A network adapter card or network interface of each computing / processing device receives the computer readable program instructions from the network and forwards the computer readable program instructions for storage in a computer readable storage medium within the individual computing / processing device.

[0090] The computer readable program instructions for performing the operations of the present disclosure may be either source code or object code written in any combination of one or more programming languages, including assembler instructions, instruction set architecture (ISA) instructions, machine instructions, machine-dependent instructions, microcode, firmware instructions, state setting data, configuration data for an integrated circuit, or object-oriented programming languages ​​such as Smalltalk®, C++, and procedural programming languages ​​such as the "C" programming language or similar programming languages. The computer readable program instructions may be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the latter scenario, the remote computer may be connected to the user's computer via any type of network, including a local area network (LAN) or wide area network (WAN), or the connection may be made to an external computer (e.g., via the Internet using an Internet Service Provider). In some embodiments, electronic circuitry including, for example, a programmable logic circuit, a field programmable gate array (FPGA), or a programmable logic array (PLA) can execute computer readable program instructions to individualize the electronic circuitry by utilizing state information of the computer readable program instructions to perform aspects of the present disclosure.

[0091] Aspects of the present disclosure are described herein with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the present disclosure. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer readable program instructions.

[0092] These computer readable program instructions may be provided to a processor of a computer or other programmable data processing apparatus to produce a machine such that the instructions, which execute on the processor of the computer or other programmable data processing apparatus, create means for implementing the functions / acts specified in one or more blocks of the flowcharts and / or block diagrams. These computer readable program instructions may also be stored on a computer readable storage medium, such that the computer readable storage medium storing the instructions comprises an article of manufacture including instructions that implement aspects of the functions / acts specified in one or more blocks of the flowcharts and / or block diagrams, and can direct a computer, programmable data processing apparatus, or other device, or combination thereof, to function in a particular manner.

[0093] The computer readable program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other device to cause the computer, other programmable apparatus, or other device to perform a series of operational steps to produce a computer-implemented process, such that the instructions, which execute on the computer, other programmable apparatus, or other device, implement the functions / operations specified in one or more blocks of the flowcharts and / or block diagrams.

[0094] The flowcharts and block diagrams in the figures illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of the present disclosure. In this regard, each block of the flowcharts or block diagrams may represent a module, segment, or portion of instructions, including one or more executable instructions for implementing a specified logical function. In some alternative implementations, the functions shown in the blocks may occur out of the order shown in the figures. For example, two blocks shown in succession may actually be performed as one step, or may be executed simultaneously, substantially simultaneously, partially or fully in a time-overlapping manner, or the blocks may sometimes be executed in reverse order depending on the functionality involved. It should also be noted that each block of the block diagrams and / or flowchart illustrations, and combinations of blocks in the block diagrams and / or flowchart illustrations, may be implemented by a dedicated hardware-based system that performs the specified functions or acts or executes a combination of dedicated hardware and computer instructions.

[0095] The terms used herein are merely for the purpose of describing particular embodiments and are not intended to limit the various embodiments. As used herein, the singular forms "a", "an" and "the" are intended to include the plural unless the context clearly indicates otherwise. It will be further understood that as used herein, the terms "includes" and / or "including" specify the presence of stated features, integers, steps, operations, elements, or components or combinations thereof, but do not exclude the presence or addition of one or more other features, integers, steps, operations, elements, components, or groups or combinations thereof. In the preceding detailed description of exemplary embodiments of the various embodiments, reference has been made to the accompanying drawings, which form a part hereof, and in which like numerals represent like elements, showing by way of illustration specific exemplary embodiments in which the various embodiments may be practiced. These embodiments have been described in sufficient detail to enable one skilled in the art to practice the embodiments, but other embodiments may be utilized and logical, mechanical, electrical and other changes may be made without departing from the scope of the various embodiments. In the preceding description, numerous specific details have been set forth in order to provide a thorough understanding of the various embodiments. However, various embodiments may be practiced without such specific details. In other instances, well-known circuits, structures and techniques have not been shown in detail so as not to obscure the embodiments.

[0096] Where different reference numbers include different letters after a common number (e.g., 100a, 100b, 100c) or different numbers after a separator character (e.g., 100-1, 100-2, or 100.1, 100.2), the use of the reference letter alone (e.g., 100) without a letter or subsequent number may refer to the group of elements as a whole, any subset of the group, or an illustrative exemplar of the group.

[0097] It should be understood at the outset that throughout this specification, the term "mechanism" is used to refer to elements of the invention that perform various operations, functions, and the like. A "mechanism" as the term is used herein may be an implementation of a function or aspect of an example embodiment in the form of an apparatus, a procedure, or a computer program product. In the case of a procedure, the procedure is performed by one or more devices, apparatus, computers, data processing systems, and the like. In the case of a computer program product, the logic represented by the computer code or instructions embodied in or on the computer program product is executed by one or more hardware devices to implement a function or perform an operation associated with the particular "mechanism." Thus, the mechanisms described herein may be implemented as specialized hardware, software that executes on the hardware to configure the hardware to perform specialized functions of the invention that the hardware cannot otherwise perform, software instructions stored on a medium such that the instructions are readily executable by the hardware, thereby specifically configuring the hardware to perform the described functions and the specific computer operations described herein, a procedure or method for performing a function, or any combination of the above.

[0098] Further, the term "models" or "model" as used herein refers specifically to computer-implemented machine learning models. These models include algorithms, statistical models, etc. that computer systems use to perform certain tasks without explicit instructions, relying instead on patterns and inference. Machine learning algorithms build computer-implemented models based on sample data, known as "training data," to make predictions or decisions without being explicitly programmed to perform a task. Examples of machine learning models include, but are not limited to, supervised machine learning models such as convolutional neural networks (CNNs) and deep neural networks (DNNs), as well as unsupervised machine learning models such as isolation forest models, one-class support vector machine (SVM) models, local outlier factor models, ensemble learning mechanisms such as random forest models, etc.

[0099] Furthermore, the phrase "at least one of," when used in conjunction with a list of items, means that one or more different combinations of the listed items can be used, and only one of each item in the list is required. In other words, "at least one of" means that any combination of items and numbers from the list can be used, but not all items in the list are required. An item can be a particular object, thing, or category.

[0100] For example, without limitation, "at least one of item A, item B, or item C" may include item A, item A and item B, or item B. This example also includes item A, item B, and item C, or item B and item C. Of course, any combination of these items can be present. In some illustrative examples, "at least one of" can be, for example, without limitation, two of item A, one of item B, and ten of item C, four of item B and seven of item C, or other suitable combinations.

[0101] Different instances of the phrase "embodiment" as used herein do not necessarily refer to the same embodiment, but may. Any data and data structures shown or described herein are merely exemplary, and other embodiments may use different amounts of data, types of data, fields, numbers and types of fields, field names, numbers and types of rows, records, entries, or data organizations. Additionally, any data may be combined with logic, so a separate data structure may not be necessary. Thus, the foregoing detailed description is not to be taken in a limiting sense.

[0102] The description of various embodiments of the present disclosure has been presented for illustrative purposes, but is not intended to be exhaustive or limited to the disclosed embodiments. Many modifications and variations will be apparent to those skilled in the art without departing from the scope and spirit of the described embodiments. The terms used herein have been selected to best explain the principles of the embodiments, practical applications, or technical improvements to the technology found in the market, or to allow other skilled in the art to understand the embodiments disclosed herein.

[0103] While the present disclosure has been described in terms of specific embodiments, it is anticipated that variations and modifications thereof will become apparent to those skilled in the art, and it is therefore intended that the following claims be interpreted to cover all such variations and modifications as fall within the true spirit and scope of the present disclosure.

[0104] The description of various embodiments of the present disclosure has been presented for illustrative purposes, but is not intended to be exhaustive or limited to the disclosed embodiments. Many modifications and variations will be apparent to those skilled in the art without departing from the scope and spirit of the described embodiments. The terms used herein have been selected to best explain the principles of the embodiments, practical applications, or technical improvements to the technology found in the market, or to allow other skilled in the art to understand the embodiments disclosed herein.

Claims

1. 1. A method in a data processing system including at least one processor and at least one memory, said memory including instructions executed by said processor to cause said processor to perform said method, said method comprising: training a policy machine learning model using a first training dataset to generate a policy machine learning model for producing a mitigation technique classification; training a vulnerability machine learning model using the second training dataset to generate a vulnerability machine learning model for producing a vulnerability type classification; mapping the mitigation technique classifications to attack techniques to generate a policy mapping; mapping the weakness type classification to the attack techniques to generate a vulnerability mapping; generating a vulnerability risk assessment based on the policy mapping and the vulnerability mapping; and A method comprising:

2. Producing said risk assessment generating the risk assessment based on the vulnerability mapping; comparing the attack techniques mapped to the vulnerability mapping with the attack techniques mapped to the policy mapping; determining, based on the comparison, that the policy mapping includes at least one attack technique as the vulnerability mapping; adjusting the risk assessment based on the at least one attack technique; and The method of claim 1 , comprising:

3. Mapping the mitigation technology classifications, training a mitigation mapping machine learning model using a third training dataset to generate an attack technique classification, the third training dataset including mitigation techniques; inputting the mitigation technique classification into the mitigation mapping machine learning model to produce an attack technique classification; and generating the policy mapping based on the mitigation technique classifications and their corresponding attack technique classifications.

4. Mapping the weakness type classification, training a weakness mapping machine learning model using a third training dataset to generate an attack technique classification, the third training dataset including weakness types; inputting the vulnerability type classification into the vulnerability mapping machine learning model to generate an attack technique classification; generating said vulnerability mapping based on said mitigation technique classifications and their corresponding attack technique classifications; The method according to any one of claims 1 to 3, comprising:

5. The method of claim 4 , wherein the vulnerability types are derived from a Common Weakness Encyclopedia (CWE) list.

6. The method of claim 1 , wherein the first training data set comprises policy compliance entries converted into feature vectors with corresponding classifications of mitigation techniques.

7. The method of claim 1 , wherein the second training data set comprises vulnerability entries converted into feature vectors with corresponding classifications of weakness types.

8. The method of claim 7 , wherein the vulnerability entries are derived from a Common Vulnerabilities and Exposures (CVE) list.

9. A computer program product including a computer readable storage medium having a computer readable program stored thereon, the computer readable program being operable, when executed on a computing device, to cause the computing device to: training a policy machine learning model using a first training dataset to generate a policy machine learning model for producing a mitigation technique classification; training a vulnerability machine learning model using the second training dataset to generate a vulnerability machine learning model for producing a vulnerability type classification; mapping the mitigation technique classifications to attack techniques to generate a policy mapping; mapping the weakness type classification to the attack techniques to generate a vulnerability mapping; generating a vulnerability risk assessment based on the policy mapping and the vulnerability mapping; and A computer program product that causes

10. Producing the risk assessment includes providing the computing device with: generating the risk assessment based on the vulnerability mapping; comparing the attack techniques mapped to the vulnerability mapping with the attack techniques mapped to the policy mapping; determining, based on the comparison, that the policy mapping includes at least one attack technique as the vulnerability mapping; adjusting the risk assessment based on the at least one attack technique; and 10. The computer program product of claim 9, further comprising:

11. Mapping the mitigation technique classification to the computing device includes: training a mitigation mapping machine learning model using a third training dataset to generate an attack technique classification, the third training dataset including mitigation techniques; inputting the mitigation technique classification into the mitigation mapping machine learning model to produce an attack technique classification; generating said policy mapping based on said mitigation technique classifications and their corresponding attack technique classifications; 11. A computer program product according to claim 9 or 10, adapted to cause:

12. Mapping the weakness classification includes causing the computing device to: training a weakness mapping machine learning model using a third training dataset to generate an attack technique classification, the third training dataset including weakness types; inputting the vulnerability type classification into the vulnerability mapping machine learning model to generate an attack technique classification; generating said vulnerability mapping based on said mitigation technique classifications and their corresponding attack technique classifications; 12. A computer program product according to any one of claims 9 to 11, adapted to:

13. 13. The computer program product of claim 12, wherein the vulnerability types are derived from a Common Weakness Encyclopedia (CWE) list.

14. 14. The computer program product of claim 9, wherein the first training data set comprises policy compliance entries converted into feature vectors having corresponding classifications of mitigation techniques.

15. 15. The computer program product of claim 9, wherein the second training data set comprises vulnerability entries converted into feature vectors with corresponding classifications of weakness types.

16. 16. The computer program product of claim 15, wherein the vulnerability entries are derived from a Common Vulnerabilities and Exposures (CVE) list.

17. 1. An apparatus comprising: A processor; a memory coupled to the processor, the memory, when executed by the processor, causing the processor to: training a policy machine learning model using a first training dataset to generate a policy machine learning model for producing a mitigation technique classification; training a vulnerability machine learning model using the second training dataset to generate a vulnerability machine learning model for producing a vulnerability type classification; mapping the mitigation technique classifications to attack techniques to generate a policy mapping; mapping the weakness type classification to the attack techniques to generate a vulnerability mapping; generating a vulnerability risk assessment based on the policy mapping and the vulnerability mapping; and A device that performs the above function.

18. Producing the risk assessment comprises: generating the risk assessment based on the vulnerability mapping; comparing the attack techniques mapped to the vulnerability mapping with the attack techniques mapped to the policy mapping; determining, based on the comparison, that the policy mapping includes at least one attack technique as the vulnerability mapping; adjusting the risk assessment based on the at least one attack technique; and The apparatus of claim 17 .

19. Mapping the mitigation technique classifications to the processor comprises: training a mitigation mapping machine learning model using a third training dataset to generate an attack technique classification, the third training dataset including mitigation techniques; inputting the mitigation technique classification into the mitigation mapping machine learning model to produce an attack technique classification; generating said policy mapping based on said mitigation technique classifications and their corresponding attack technique classifications; 19. The apparatus according to claim 17 or 18,

20. Mapping the weakness type classification comprises: training a weakness mapping machine learning model using a third training dataset to generate an attack technique classification, the third training dataset including weakness types; inputting the vulnerability type classification into the vulnerability mapping machine learning model to generate an attack technique classification; generating said vulnerability mapping based on said mitigation technique classifications and their corresponding attack technique classifications; 20. Apparatus according to any one of claims 17 to 19, adapted to perform the following:

Images