Systems and Methods for Dynamic Vulnerability Scoring

Abstract

The present disclosure provides a system and method for substantially continuous and dynamic vulnerability scoring. According to the present disclosure, the method includes detecting one or more vulnerabilities. The method includes determining a context-prioritized score (CPS) for each of the one or more vulnerabilities based on historical data, where the historical data includes a series of context features corresponding to each of the one or more vulnerabilities. The method may include determining a partial CPS score by an agent in response to the detection of an event. The method may include generating an updated CPS based on the CPS and the new partial CPS when a new partial CPS score is determined, and transmitting the updated CPS to each of one or more computing devices.

Description

Technical Field

[0001] The present disclosure generally relates to security vulnerability scoring, and more specifically, to dynamic vulnerability scoring of security system vulnerabilities and the use of dynamic vulnerability scoring for prioritizing vulnerabilities, based on substantially continuous input of context data via one or more agents.

Background Art

[0002] Typically, computer network or system vulnerabilities are compiled or classified based on existing Common Vulnerability Scoring System (CVSS). Using CVSS, vulnerabilities are scored and ranked either by using a "base score" (e.g., as provided by a Common Vulnerability Identifier (CVE) site, e.g., a published score) or by using CVSS modifiers or scoring vectors to supplement the "base score". Supplementing the "base score" may attempt to capture local context through the environmental and temporal aspects of the vulnerability. This approach is a manual operation, mostly performed manually by security experts who are responsible for understanding the local context that drives these vectors. Some degree of automation is utilized in the form of existing severity databases, but may still require manual input and scrutiny by security experts. Additionally, some systems and methods may attempt to rank vulnerabilities using a level of exploitability, however, such systems use a database similar to the severity database and still require manual input and / or past records.

[0003] Thus, it can be appreciated that there is a need for systems and methods directed to enabling enhanced dynamic scoring of vulnerabilities. The present disclosure addresses the foregoing and other related and unrelated problems / issues in the art.

Summary of the Invention

Means for Solving the Problems

[0004] Briefly described, according to various aspects, the present disclosure is directed to systems and methods for dynamically scoring vulnerabilities in a computer system or network having a plurality of information handling devices connected thereto. Such systems and methods may utilize a Contextual Vulnerability Prioritization Engine (CVP Engine). The CVP Engine may detect new and / or updated vulnerabilities present on a monitored computer network or security system. The CVP Engine may scan various internal and / or external databases regarding vulnerabilities (e.g., a Common Vulnerability Identifier (CVE) site or an internal vulnerability database, etc.), wait for a user or computing device to transmit a vulnerability to the CVP Engine, and / or scan other data sources to determine whether new or updated vulnerabilities are discovered. The CVP Engine may scan continuously, substantially continuously, or at predetermined time intervals regarding such vulnerabilities. Alternatively, or in addition to scanning regarding new vulnerabilities or changes / updates to existing vulnerabilities, the CVP Engine can be configured to wait until new or updated vulnerabilities are received from various sources (e.g., computing devices, user computing devices, security specialists or experts, and / or agents, etc.).

[0005] In response to discovering or detecting a new vulnerability, the CVP engine may utilize the CVSS score, in addition to historical data (e.g., historical context data and / or any other objective historical data), multiple context features related to the vulnerability, and / or multiple non-context features related to the vulnerability, to generate a Context Priority Score (CPS). In such an embodiment, the historical data may include the CVSS score, other data related to the CVSS score, and / or context and / or non-context data from one or more sources (e.g., computing devices such as switches, routers, servers, user devices, etc.). The CVP engine may include one or more different agents, and each agent may correspond to a type or set of data related to or identified with the vulnerability. For example, each agent may include or consist of one or more of a machine learning model or classifier, a statistical model, a probability model, and / or various other models or classifiers. The data received by the CVP engine may be aggregated by each corresponding agent associated therewith to generate partial CPSs or risk scores that are dynamically updated to generate a CPS for any new or updated vulnerability, which may be utilized to generate a CPS for the new or updated vulnerability.

[0006] Furthermore, the CVP engine may scan for, or detect, the occurrence of an event from one or more computing devices. Such scanning or detection may occur continuously, substantially continuously, or at periodic time intervals. In response to detecting an event or the occurrence of an event related to or corresponding to a vulnerability, the CVP engine may directly or analyze that subset or portion of the received data types related to the event through one or more of the agents corresponding to each data type of the received data related to the event. Each agent may produce a partial risk score or CPS. The partial CPS may be utilized to adjust and / or update a previous CPS. The updated CPS may be transmitted to each of one or more computing devices and utilized to prioritize known vulnerabilities.

[0007] On one side, the present disclosure provides a system for dynamically assessing and ranking the security vulnerabilities of a network having a plurality of computing devices linked thereto. The system may include a context vulnerability prioritization engine configured to detect one or more vulnerabilities present on the network. The context vulnerability prioritization engine may be configured to determine a context prioritization score (CPS) for each detected vulnerability based on the aggregation of a plurality of partial CPSs generated for each of a plurality of context features associated with each detected vulnerability and a plurality of non-context features associated with each vulnerability. Each partial CPS of the plurality of context features may be dynamically calculated by corresponding or associated agents of the plurality of agents based on a plurality of context features associated with the vulnerability and a plurality of non-context features associated with the vulnerability. The context vulnerability prioritization engine may scan for the occurrence of events associated with each identified / detected vulnerability present on the network or any computing device connected thereto, and in response to detecting the occurrence of an event associated with an identified / detected vulnerability present on one or more of the plurality of computing devices, direct data corresponding to the detected event associated with the vulnerability to the corresponding agents of the plurality of agents. The context vulnerability prioritization engine may also be configured to determine a new partial CPS for each context feature applicable to the data generated from the occurrence of each detected event via each corresponding agent that receives the data corresponding to the detected event. The context vulnerability prioritization engine will be configured to determine an updated CPS representing the current state of the identified / detected vulnerability based on each new partial CPS. The context vulnerability prioritization engine may be configured to transmit the updated CPS to each of the plurality of computing devices.

[0008] In an embodiment, the agent can comprise one or more than one of a trained classifier, a statistical model, or a probability model. The trained classifier may be generated via one or more than one of another plurality of context features related to the vulnerability, another plurality of non-context features related to the vulnerability, and a supervised machine learning algorithm or an unsupervised machine learning algorithm. The plurality of computing devices may include one or more than one of a switch, an access point, a server, a storage device, or a user device.

[0009] In another embodiment, the plurality of non-context features may include historical data of features such as a CVSS score related to the vulnerability. The plurality of context features may include one or more than one of payload analysis, exploitability, detection reliability, threat intelligence, or vulnerability tendency. Further, the plurality of context features may include one or more than one of exposure data, software and services affected by the vulnerability, behavior analysis related to the vulnerability, website content, scanning frequency, network attack surface, extremely important potential, asset detection, or improvement time prediction.

[0010] In some embodiments, the context vulnerability prioritization engine will further be configured to dynamically prioritize a plurality of vulnerabilities based on one or more than one dynamically updated CPS for one or more than one of the plurality of vulnerabilities. The partial CPS may be determined for each context feature and weighted based on the data type of the data corresponding to the occurrence of the event.

[0011] In another aspect, the present disclosure provides a method for dynamically scoring known identified or detected vulnerabilities that exist on a network having a plurality of computing devices coupled thereto. The method may include detecting one or more vulnerabilities of one or more computing devices of the network via a context vulnerability prioritization engine. The method includes determining a context prioritization score (CPS) for each of one or more known identified or detected vulnerabilities based on historical data via one or more agents of the context vulnerability prioritization engine, the historical data may include a series of context features corresponding to each of one or more known identified or detected vulnerabilities. The method may include determining a partial CPS for each of one or more received context features related to an event in response to detecting an event related to one of one or more known identified or detected vulnerabilities on one or more computing devices of the network, each partial CPS being dynamically determined by an agent of one or more agents of the context vulnerability prioritization engine based on data related to the known identified or detected vulnerability and associated context entities related to the vulnerability. The method may also include generating an updated CPS for the vulnerability based on the CPS and the new partial CPS when a new partial CPS is determined for at least one received context feature (e.g., a change in the partial CPS score for such a context feature change), and transmitting the updated CPS to each of one or more computing devices.

[0012] In one embodiment, the detection of each event may include vulnerability detection based on one or more of network mapping, vulnerability scanning, web application scanning, external sources, or threat intelligence. The detection of one or more occurrences of one or more events associated with one or more known identified or detected vulnerabilities on one or more computing devices may occur continuously, substantially continuously, or at periodic time intervals. A plurality of partial scores may be determined in parallel based on the detection of one or more occurrences of one or more events associated with one or more known identified or detected vulnerabilities. Each of the plurality of partial scores may be weighted based on a data type or event type corresponding to one or more additional occurrences of one or more events associated with one or more known identified or detected vulnerabilities. The updated CPS may replace the current CPS.

[0013] According to another aspect, the present disclosure provides a non-transitory machine-readable storage medium storing processor-executable instructions. When executed by at least one processor, the instructions may cause the at least one processor to detect one or more vulnerabilities of one or more of a plurality of computing devices. When executed by at least one processor, the instructions may cause the at least one processor to determine a context-prioritization score (CPS) for each of one or more vulnerabilities based on historical data corresponding to each of the one or more vulnerabilities via one or more algorithms. The historical data may include one or more context features, a CVSS score, and / or other historical data. When executed by at least one processor, the instructions may cause the at least one processor to detect the occurrence of one or more events related to one of one or more vulnerabilities on one or more of a plurality of computing devices. When executed by at least one processor, the instructions may cause the at least one processor to receive one or more context features corresponding to the detection of the occurrence of one or more events related to one of one or more vulnerabilities on one or more of a plurality of computing devices. When executed by at least one processor, the instructions may cause the at least one processor to determine a corresponding partial CPS via at least one of one or more agents corresponding to the data type of one of the one or more context features corresponding to the detection of the occurrence of one or more events related to one of one or more vulnerabilities on one or more of a plurality of computing devices. When executed by at least one processor, the instructions may cause the at least one processor to generate an updated CPS based on the CPS and the corresponding partial CPS. When executed by at least one processor, the instructions may further cause the at least one processor to transmit the updated CPS to a plurality of computing devices.

[0014] In some embodiments, multiple partial CPSs may be determined in parallel or substantially in parallel. Each of one or more vulnerabilities may be prioritized based on one of the CPSs corresponding to each of one or more vulnerabilities, or one of the updated CPSs if determined.

[0015] When the various objects, features, and advantages of the present disclosure are considered in conjunction with the accompanying drawings, they will become apparent to those skilled in the art upon review of the following detailed description.

Brief Description of the Drawings

[0016] For simplicity and clarity of illustration, it should be understood that the elements illustrated in the figures are not necessarily drawn to scale. For example, the dimensions of some elements may be exaggerated relative to other elements. Embodiments incorporating the teachings of the present disclosure are shown and described with respect to the drawings herein.

[0017]

Figure 1

[0018]

Figure 2A

Figure 2B

[0019]

Figure 3

[0020]

Figure 4

[0021]

Figure 5

Figure 6

[0022]

Figure 7

[0023] The use of the same reference symbols in different drawings indicates similar or the same items.

Mode for Carrying Out the Invention

[0024] Detailed Description The following description, in combination with the figures, is provided to assist in understanding the teachings disclosed herein. The description focuses on specific implementations and embodiments of the present teachings and is provided to assist in explaining the present teachings. This focus should not be construed as a limitation on the scope or applicability of the present teachings.

[0025] As shown in FIGS. 1-7, the present disclosure includes a system and method for dynamically scoring security vulnerabilities that are grasped, identified, or detected as being present on a computer system or network having a plurality of computing devices or information management devices connected thereto. As an example, such vulnerabilities can be available in various databases and can include various known vulnerabilities related to various software or hardware configurations and / or applications, such as Common Vulnerability Identifiers (CVEs) having known CVSS examples. The system can include a Contextual Vulnerability Prioritization (CVP) engine that can detect or scan for new or updated vulnerabilities that can pose a threat to a particular computing device and / or various aspects of the computing device. The CVP engine can detect or scan one or more different computing devices, networks, cloud computing networks or systems, containers or an orchestrated set of containers, and / or virtual computing devices. Alternatively, or in addition to detecting or scanning for new events, the CVP engine can also be informed of new or updated vulnerabilities from, for example, an external source and / or can wait, for example, via a computing device or user (e.g., via a user interface), until a new event is received. Different vulnerabilities pose different levels of risk depending on the assets being exposed and / or the computing devices being affected. Accordingly, after detecting new or updated vulnerabilities, including various types of data (e.g., historical data, contextual features or data, etc.), the CVP engine may determine a Contextual Prioritization Score (CPS).

[0026] To determine the CPS, the CVP engine may utilize data received from external sources (e.g., external databases, the National Vulnerability Database (NVD), Bugtraq, etc., outside of this system) or internal sources (e.g., security specialists, internal databases, or repositories, etc., within this system). The CVP engine may utilize the context features or data contained within the received data to generate or determine the CPS. Further, each type of received data may be utilized via the corresponding agent to generate a part or partial CPS of the CPS. The agent may include, or be, a trained machine learning algorithm or classifier, a probability model, a statistical model, or some other algorithm and / or model configured to determine or generate a part or partial CPS of the CPS based on the type of received data. Further, each partial CPS may be weighted based on the type of data. In other words, different data types may be determined to be more or less relevant in relation to the overall CPS than other data types.

[0027] After the generation or determination of the CPS, the CVP engine may transmit the CPS and other related data indicating vulnerabilities to the connected computing device. The computing device may then execute various instructions at various times to generate an event. The CVP engine may scan each of the computing devices for new events related to known identified or detected vulnerabilities. If an event is detected, the CVP engine may obtain the data related to the event, utilize the data, and generate a new part or partial CPS of the CPS via the corresponding one or more agents (e.g., the data type of the data indicating one or more of the agents to be utilized).

[0028] Once a partial CPS is generated or determined, the CVP engine may incorporate the partial CPS into the previous CPS for the corresponding vulnerability. The occurrence of events and additional partial CPSs may occur multiple times over a selected or continuous period. For example, when a new event is detected, such an event may be utilized in the present system and method over the duration of time that the corresponding vulnerability affects the computing device. In other words, once a solution for resolving, fixing, invalidating, or otherwise preventing or minimizing the effects of a vulnerability present on the present system is determined, the events occurring in relation to such an event can be stopped. The number of times such partial CPSs can be determined, updated, and / or generated is not necessarily limited and can be done each time an event is detected. Thus, the CPS for each known vulnerability is dynamically updated or calculated substantially continuously or periodically over a predetermined period. Further, since context data is utilized to update the CPS, each vulnerability may be sorted based on the actual impact on the organization or other entity. In other words, each vulnerability may be prioritized based on each vulnerability impact.

[0029] A new CPS for each vulnerability present on one or more than one of a computer system or network or a computing device connected thereto may be updated or generated in real time. Further, the new CPS may be generated automatically rather than via human or user interaction. Still further, the generation of the new CPS is repeatable, mathematically sound, scalable (e.g., multiple new CPSs may be determined for multiple different vulnerabilities based on multiple received context data), fault tolerant, explainable, and granular. Finally, the new CPS takes into account the different risk possibilities and impacts brought about by each different context data.

[0030] FIG. 1 shows a block diagram of an exemplary data center 10 in which vulnerability scoring for new and updated vulnerabilities, particularly context priority scoring (CPS), is generated and updated based on event data received continuously, substantially continuously, or periodically, including at least one context feature or data associated with the corresponding vulnerability. As shown in FIG. 1, data center 10 can include a computer system or network 12 that can provide communication between a plurality of information handling systems 14 or computing devices, which can include workstations, personal computers, smart cellular phones, personal digital assistants, laptop computers, servers, computing devices, virtual computing devices, containers or containerized devices, cloud computing-based systems or devices, other suitable devices, and / or combinations thereof. Information handling system 14 can further be coupled to network 12 through a wired connection 16, a wireless connection 18, or any other suitable communication or connection line.

[0031] As further shown in FIG. 1, one or more of data center 10 and / or its information handling system 14 can be communicatively coupled to a network, such as a cloud-based or other network shown as 12 or 20 in FIG. 1, via, for example, a wired connection 16 or any other suitable connection such as a wireless connection 18 (e.g., WiFi, cellular, etc.). Network 12 can further be accessible by one or more users or client management information handling systems or devices 22, and can facilitate communication between client management information handling system 22 and data center 10 where system logs can be analyzed and / or analysis scripts and / or rules can be generated by the event management center. Network 12 can include the API interface of the event management center, but the network can include any suitable network such as the Internet or other wide area network, local area network, or a combination of networks, and can provide communication, such as data communication, between the event management center and client management information handling system 22.

[0032] Client management information handling system 22 is connected to network 20 (FIG. 1) via a wired connection, such as an Ethernet cable or other suitable wired or wireless connection 18, such as WiFi, Bluetooth, cellular connection (e.g., 3G, 4G, LTE, 5G, etc.), other suitable wireless connections, or combinations thereof, enabling a client or operator of information handling system 22 to communicate with the event management center and, for example, access one or more services provided thereby. For example, the event management center can be or include a web service.

[0033] For purposes of the present disclosure, the information handling system 14 / 22 may include any computing device means or collection of means operable to compute, calculate, determine, classify, process, transmit, receive, read, transmit, switch, store, display, communicate, disclose, detect, record, copy, handle, or utilize information, confidential information, or data of any form for business, scientific, control, or other purposes. In one embodiment, the information handling system may include one or more processing resources such as random access memory (RAM) or (ROM), a central processing unit (CPU) or hardware or software cybernetics, ROM, and / or storage devices such as other types of non-volatile memory. Additional components of the information handling system may include one or more disk drives, one or more network ports for communicating with external devices, and various input and output (I / O) devices such as a keyboard, mouse, touch screen, and / or video display. The information handling system may also include one or more buses operable to transmit communications between the various hardware components.

[0034] Figures 2A and 2B are schematic diagrams of a system for dynamically scoring vulnerabilities, according to one aspect of the present disclosure. Turning first to FIG. 2A, a system 200 for generating scores and dynamically updating scores for new and updated vulnerabilities is illustrated. Such a system 200 may include a vulnerability and detection response (CVP) system 202. The CVP system 202 may be connected to one or more computing devices (e.g., up to computing device 208A, computing device 208B, and computing device 208N) via a communication network 206. The CVP system 202 may additionally be connected to a storage device 204.

[0035] The CVP system 202 may include a CVP engine 210. The CVP engine 210 may consist of software, firmware, hardware (e.g., circuitry, integrated circuits, etc.), or some combination thereof. The CVP engine 210 may further consist of, or include, instructions or programming that, when executed, may cause the CVP engine 210 to perform different functions. For example, the instructions, when executed, may cause the CVP engine 210 or a processor to scan for vulnerabilities existing on a network and the occurrence of events related to such vulnerabilities. The scan may include transmitting, via the communication network 206, a message to each computing device 208A, 208B, 208N to determine whether a vulnerability has been discovered or added to each computing device 208A, 208B, 208N. For example, the scan may include scanning or reading a particular storage device or port of each computing device 208A, 208B, 208N and determining whether a vulnerability has been discovered and / or added at a location where the vulnerability is defined (e.g., a storage device or port associated with the computing device 208A, 208B, 208N). For example, the CVP engine 210 may scan a computing device or other device to determine whether the computing device or other device includes or has installed legacy software and / or applications and has misconfigured software and / or applications, and / or whether the computing device or other device may be in a vulnerable state based on certain data points or features / factors. In some embodiments, such a scan may include an internal scan by programming configured to explore individual connected devices. In another embodiment, the instructions, when executed, may cause the CVP engine 210 to detect vulnerabilities in a similar manner.

[0036] In other embodiments, the CVP system 202 may include a user interface or may be connected to a user interface. The user interface may be configured to allow a user to input data such that it is transmitted to the CVP system 202 or the storage device 204. Such user access and exploration may also be used in embodiments to assist in prioritizing vulnerabilities, for example, to generate triggers regarding which assets / events may be more important with respect to resource allocation. For example, a user such as a security agent or an expert may enter vulnerabilities and related data into the CVP system 202 via the user interface. Such related data input into the CVP system 202 (e.g., how assets are tagged or classified) may be utilized to determine the CPS and / or partial CPS. In embodiments, the CVP system 202 may detect or discover new or updated vulnerabilities (and related data such as CVSS scores, definition information, etc.) from an external source (e.g., a system 200 external to the CVP system 202 such as an external database, the National Vulnerability Database (NVD), Bugtraq, etc.) or an internal source (e.g., within the system 200 such as a security specialist, an internal database, or a repository).

[0037] When executed, the CVP engine 210 may further include instructions that cause the CVP engine 210 to score newly discovered or updated vulnerabilities that are discovered, detected, received, or input. In certain embodiments, when a vulnerability is discovered, detected, received, or input, the vulnerability may include data corresponding to the vulnerability. Such data may include context features or data corresponding to one or more of the computing devices 208A, 208B, 208N or more than one of them, and / or other data (e.g., CVSS and other related data from NVD and / or other security data repositories or context features or data from internal sources, etc.). The CVP engine 210 may include one or more agents. Each of the one or more agents may correspond to one or more data types of data corresponding to the vulnerability. Each of the one or more agents may utilize such corresponding data and generate a partial CPS.

[0038] The partial CPS may be weighted by one or more agents or other instructions or algorithms based on the data type corresponding to the partial CPS. The partial CPS may then be combined or incorporated in another way to generate an overall CPS for the corresponding or associated vulnerability. For example, the partial CPS may be generated as a risk, number, and / or other indicator. The risk, number, and / or other indicator may be applied to a previous CPS (e.g., by multiplication or through other formulas, determinations, or calculations) to result in a new CPS. The new CPS may then replace the previous CPS for a particular vulnerability.

[0039] For example, the CPS may be calculated or determined recursively. In such embodiments, the CVP engine 210 may first utilize the CVSS as a basis for generating or determining the CPS, and may continuously apply each generated or determined partial CPS to the current CPS.

[0040] In one embodiment, each partial CPS (e.g., a component or part of the final CPS) may be regarded as a factor in a mathematical formula for determining the CPS. Such a mathematical formula may be defined in a particular way. For example, the CVP engine 210 may multiply the current CPS (e.g., initially, a base score or CVSS) by each partial CPS to determine or generate a new CPS. In other embodiments, a weighted sum of the partial CPSs may also be utilized, and the weighting values may be determined by the respective "importance" or emphasis placed on each agent. These weightings may also be learned, for example, using machine learning techniques.

[0041] In another embodiment, the final CPS may be determined or calculated by continuously multiplying the factors with carry to maintain a fixed score interval regardless of the number of factors. The multiplication of factors may allow for configurability, but the carry is performed across all vulnerabilities at each assessment step (e.g., determination and incorporation of partial CPSs). Such non-linearity may allow for consistency (e.g., a fixed scale) at each step and may also allow all vulnerabilities to affect each other. In practice, such a process may lower the scores of lower risk or less "important" vulnerabilities and may raise the scores of higher risk or more "important" vulnerabilities.

[0042] The initial steps that form the base CVSS score can be regarded as an uninformed prior distribution and / or a context-free measure of risk. The uncertainty around the base score as a prioritized risk score can be high. In other words, the true risk can be higher or lower depending on the context related to various aspects of the vulnerability. Successive aggregations of each assessment can reduce the "ambiguity" or uncertainty around the true risk. Such a process can converge the final CPS towards, or cause the convergence of, a much narrower band of uncertainty.

[0043] The term "Common Vulnerability Scoring System" (CVSS) is used to refer to a freely available industry standard that uses a score from 0 to 10 and other individual metrics to identify vulnerabilities for assessing the severity of security vulnerabilities. CVSS identifies several metrics or characteristics for measuring the severity of vulnerabilities. Each newly disclosed vulnerability includes a CVSS score. The term "Bugtraq" is used to refer to a defined emailing list dedicated to computer security issues. A defined electronic list is described, but such examples are not limiting, and other mailing lists and other community forums and / or social media posts or forums are to be understood.

[0044] In some embodiments, the vulnerability may not include or be associated with a published CVSS score, or there may be a discrepancy between the published score and the predicted or estimated CVSS score from the CVP engine, in which case the CVP engine may be able to generate a base CVSS score. In such an example, the CVP system 202 and / or the CVP engine 210 may determine and / or generate a base CVSS score. In further examples, the CVP system 202 and / or the CVP engine 210 may determine such a CVSS score based on objective factors or characteristics of the vulnerability (e.g., type of vulnerability, etc.) and / or based on user input (e.g., a user entering a CVSS score). In other cases, the CVSS score may be generated / calculated manually.

[0045] Once a CPS is generated for any known vulnerability, the CVP engine 210 or the CVP system 202 will utilize this CPS to prioritize the use of network / computing resources to address the events that occur for each of the known or detected vulnerabilities present on the network. For example, vulnerabilities with lower CPS can be considered to have a lower risk than those with higher CPS / risk, and resources (e.g., analyst time) can be allocated accordingly. The CVP engine 210 or the CVP system 208 can transmit the CPS to each of one or more computing devices 208A, 208B, 208N or to the user interface for display, thereby prioritizing the determination of solutions for the vulnerabilities. The CPS may be displayed via the CVP system 202 on the connected user interface as described. Such a user interface may display each CPS for one or more vulnerabilities as a list or in another graphical format. Such a list or other graphical format may be presented in a way that emphasizes and / or prioritizes the vulnerabilities with higher CPS.

[0046] When executed, the CVP engine 210 may include instructions to detect or discover events and / or data generated by one or more computing devices 208A, 208B, 208N via events related to any one or more vulnerabilities. Such events may include, for example, network mapping, asset (e.g., computing devices 208A, 208B, 208N, storage locations, defined or preselected files or components) scanning, web application scanning, website scanning, external source scanning or detection, threat intelligence events (e.g., an asset is exposed, a known threat is linked, an exposed asset is isolated, etc.), and / or others. In response to an event occurring or being performed, data may be generated. The data may be detected, discovered, and / or transmitted to the CVP engine 210. The CVP engine 210 may then utilize one or more of one or more agents corresponding to the data type of the detected, discovered, and / or transmitted data. Each of the one or more agents utilized may generate a partial CPS. Each partial CPS may be weighted by the corresponding agent, the CVP engine 210, and / or other algorithms or instructions included within the CVP system 202 or the CVP engine 210. Each partial CPS may be integrated or incorporated into a previous CPS. The new and / or updated CPS may be transmitted to each computing device 208A, 208B, 208N and / or displayed via a user interface.

[0047] In some embodiments, an event may occur and / or be detected continuously, substantially continuously, or over a selected period of time on any one or more of the computing devices 208A, 208B, 208N. In some embodiments, different events may occur at different and / or various times on one or more of the computing devices 208A, 208B, 208N. The number of events occurring at any given time may be large, such as hundreds, thousands, millions, or more. Thus, each CPS that addresses multiple vulnerabilities may be updated frequently. An event may occur or be executed with respect to a particular vulnerability continuously, substantially continuously, or over a selected period of time over a selected time interval. The time interval may be defined by the time at which a particular vulnerability affects the computing devices 208A, 208B, 208N. In other words, once a solution for a particular vulnerability is determined and implemented, events corresponding to that particular vulnerability may cease to be detected and / or executed.

[0048] Context data may include data related to how a vulnerability affects computing devices 208A, 208B, 208N, assets, networks, and / or other devices or components. Each different context data may be weighted differently from other context data. For example, context data may include vulnerability nature (e.g., vulnerability detection reliability, exploitability reliability, cross-site scripting (XSS) protection and misconfiguration, etc.), asset context (e.g., scan frequency, availability requirements, asset importance, tagging scheme, public accessibility, user access, software recognition, service recognition, abnormal service, abnormal port / service combination, abnormal software, common database exposure service, common remote management service, website attack surface, website size, number of websites hosted by a server, operating system (OS) classification / importance, scan information date, etc.), network context (e.g., prominent assets, simulated attack path discovery, likely attack paths found via simulation, etc.), organizational context (e.g., organizational importance, vulnerability exposure within a time frame for effective improvement, detection reliability, false detection prediction, etc.), and / or external context (e.g., trusted exploits and types of available exploits, vulnerability trending, available remote exploits, available denial-of-service exploits, available web application exploits, exploits using local access, available unclassified exploits, citations in vulnerability and / or threat intelligence tools, etc.). In another embodiment, context data may include payload analysis, exploitability, detection reliability, threat intelligence, content being linked to known malware, and / or vulnerability trends.Furthermore, the context data may include one or more of exposure data, software and services affected by vulnerabilities, behavioral analysis related to vulnerabilities, website content, scanning frequency, network attack surface, highly important potentialities, prominent asset detection, or improvement time.

[0049] As described, the CVP engine 210 may include one or more agents. Each agent may correspond to one or more types of context data. For example, when a server determines a partial CPS based on whether it stands out from network content, an agent including a machine learning algorithm may be utilized to identify outlier assets based on the meta - characteristics of the assets (such as services, OS, ports, etc.). The machine learning algorithm may generate a partial CPS based on the identified characteristics. In another example, several simulated attack paths may be generated, probabilistically ranked, and an agent may be used to determine the assets most likely to be targeted. In such an example, the agent may generate a partial CPS based on the probabilistic ranking. In yet another example, the CVP engine 210 may monitor mentions or trending of vulnerabilities related to social networks, dark web forums, users involved in security (such as security agents and / or specialists). The CVP engine 210 may analyze any text data found related to vulnerabilities (such as discussions in the security community, topics mapped to vulnerabilities, etc.) via, for example, a natural language processing model. The natural language processing model may produce or generate a number representing a partial CPS, which in this case may represent the context of discussions related to vulnerabilities.

[0050] Figure 2B is a schematic illustration of another configuration or non-limiting exemplary embodiment of a CVP system 202 configured to generate and dynamically update a CPS for a new or updated vulnerability using context features or data from one or more events occurring substantially continuously, continuously, or over a preselected period, in accordance with an aspect of the present disclosure. The CVP system 202 of FIG. 2B may be implemented in or by the information handling system 10 of FIG. 1. The CVP system 202 may include a CVP engine 210 that launches on one or more processors 212, an input / output module 214, and / or a memory 205. In such an embodiment, the CVP engine 210 may consist of instructions stored within the memory 205. As described, in other embodiments, the CVP engine 210 may consist of circuitry, sub-circuitry, modules, sub-modules, and / or other hardware of the CVP system 202. The CVP engine 210 may utilize data 216 stored within the memory 205, such as context features or data, CVSS scores, and / or other data corresponding to one or more vulnerabilities. The CVP engine 210 may connect to various internal or external databases 224, repositories, or data sources.

[0051] Figure 3 is a schematic diagram of a system for dynamically scoring vulnerabilities according to one aspect of the present disclosure. System 300 may include a CVP engine 322. The CVP engine 322 may be or may be included in a system (e.g., the CVP system 202 of FIGS. 2A and 2B), a computing device, and / or an information handling system 14. The CVP engine 322 may include one or more agents (e.g., agent 324A, agent 324B, etc., up to agent 324N). Each agent 324A, 324B, 324N may comprise an algorithm. The algorithm may be a trained machine learning algorithm or classifier (e.g., supervised or unsupervised machine learning algorithm), a probability model, a statistical model, or other model or classifier suitable for receiving a certain type of data as input and generating a partial CPS (e.g., partial CPS 326A, partial CPS 326B, and up to partial CPS 326N) based on the input. In certain embodiments, additional agents may be added to the CVP engine 322 based on the detection of new types of data. The CVP engine 322 may additionally include a module or network (e.g., CPS determination 328) for determining the CPS.

[0052] In certain embodiments, for each vulnerability on the network, the CVP engine 322 may determine the CPS by using the CVSS score. In another embodiment, the initial CPS may be generated using the CVSS and the partial CPS 326A, 326B, 326N from agents 324A, 324B, 324N. In certain embodiments, an updated CPS may be continuously determined based on a set of data related to one or more events 312, 314, 316, 318, 320 associated with / related to each vulnerability.

[0053] The CVP engine 322 may receive data corresponding to one or more events 312, 314, 316, 318, 320 from one or more different devices, routines, algorithms, computing devices, and / or other computing devices external to the CVP engine 322, or may generate data corresponding thereto. For example, the CVP engine 322 may perform a network mapping on a computing device or other device within a network or cloud environment. The network mapping 302 may generate an event 312 corresponding to one or more vulnerabilities. Such an event 312 may include data, which may include, but is not limited to, among other network-related data, whether a server stands out significantly from its network context (e.g., whether the server or its usage is an outlier in relation to typical and / or previous usage) and a simulated attack path on the network. In some embodiments, a computing device may utilize a vulnerability scan 304 to provide an event 314 including various vulnerability properties. In other embodiments, the vulnerability properties may include data, which may include, but is not limited to, among other data, the reliability of vulnerability detection, the exploitability confidence level, and protection and protection configurations.

[0054] In another example, the computing device may utilize web application scanning 306, for example, via an application and / or a local agent or diagnostic program, or the CVP engine 322 may provide an event 316 that includes a website vulnerability context and / or an asset context. The website vulnerability context and / or the asset context includes data, which may include, but is not limited to, among other data, scan frequency, availability requirements, asset or website importance, tagging schemes (e.g., tags that deviate from or stand out from most of the other tags regarding the asset, or the asset includes many user-defined tags), public accessibility, recognizable software used, recognizable services used, unusual services found, unusual software found, unusual port / service combinations found, website attack surface, website size, and whether the server hosts the website and the number thereof. In such an example, event 316 may describe attack surface potential information for new CPS calculation or determination (e.g., using a determined partial CPS).

[0055] In addition, the computing device or CVP engine 322 may utilize an external source 308 to obtain an event 318 that includes an external data context. The external data context may include, among other data, data such as whether an exploit action for a vulnerability is available, whether a vulnerability or a topic related to the vulnerability is receiving attention or being discussed in an online community or social media, and whether a security tool mentions the vulnerability. In another example, the computing device, security tool, or CVP engine 322 may utilize a threat intelligence tool 310 to obtain an event 320 that includes threat intelligence data. The threat intelligence data may include data, which may include, among other data, threat intelligence data related to one or more vulnerabilities.

[0056] If more than one vulnerability corresponds to one or more of events 312, 314, 316, 318, 320, the data generated by each event 312, 314, 316, 318, 320 that corresponds to more than one vulnerability is directed to respective agents 324A, 324B, 324N that are assigned to or associated with one or more data types related to the specific vulnerability. In such embodiments, each agent 324A, 324B, 324N may generate partial CPSs 326A, 326B, 326N in parallel and / or at various times. In an embodiment, the CVP engine 322 may scan various computing devices or other devices for the occurrence of events 312, 314, 316, 318, 320.

[0057] Once one or more partial CPSs 326A, 326B, 326N are determined, each partial CPS 326A, 326B, 326N may be used to determine the CPS via a module or network of circuits (e.g., CPS determination 328) for determining the CPS. CPS determination 328 may utilize aggregation or calculations based on the previous CPS and one or more partial CPSs 326A, 326B, 326N to determine the new CPS. Each partial CPS 326A, 326B, 326N may be used as a factor regarding the new CPS. In another embodiment, any new partial CPSs 326A, 326B, 326N may replace the previous partial CPSs that form the overall previous CPS. The new CPS may replace the previous CPS regarding a particular vulnerability. In some embodiments, the new CPS can be discarded or replace the existing CPS depending on a determination as to whether the new CPS differs from the existing CPS by a selected threshold amount.

[0058] Once the new CPS is determined, the new CPS may be transmitted to one or more user components or devices 330A, 330B, 330N, computing devices, user interfaces, and / or other devices or components for display. The new CPS may also be used to generate another new CPS in response to the occurrence of any new partial CPS. Additionally, in response to the generation of the new CPS, the new CPS may be stored in a memory, storage device, and / or database. Data indicating a particular vulnerability may be included with the new CPS. Data used to generate the new CPS may likewise be stored with the new CPS.

[0059] Figure 4 is an example of a method / process for dynamic vulnerability scoring according to one aspect of the present disclosure. Three actions are illustrated in relation to time 436 in such a method. The three actions include an event being input into the system 402, a score being updated 404, and a score being displayed 406. Although three actions are illustrated, the method is not limited to such actions and the method may include additional types of actions. The system described in relation to Figure 4 may include the information handling system of Figure 1, the CVP systems of Figures 2A and 2B, and / or the CVP engine of Figure 3.

[0060] In certain embodiments, an event may be input into the system at block 412. At block 412, a vulnerability may be detected or scanned. Data associated with and / or corresponding to the vulnerability may be input into the system during such a scan or detection. The data may include the CVSS. The vulnerability may include an exploit or method or process of exploiting the vulnerability, old or misconfigured software and / or changes to a computing device or other device, an IP address that has been illegally accessed indicating that a threat has been realized (e.g., via a weak password, etc.), an external file on an unprotected website, etc., any vulnerability affecting a computing device. At 414, a CPS may be determined. The CPS may be the CVSS, at least with respect to the first occurrence. In another embodiment, additional data such as context features or data and / or other historical data corresponding to the vulnerability may be included in such an occurrence or determination. Once the CPS is determined, the CPS (e.g., CPS A 416) may be displayed to the user, in addition to the data identifying the vulnerability, or stored in memory, a storage device, and / or a database.

[0061] In block 418, an event indicating that an asset is exposed may be input into the system. Depending on the type of the asset (e.g., public / private, accessible / inaccessible, important / not important, etc.), an agent may determine a partial CPS and incorporate the partial CPS into the previous CPS (e.g., from 414) in CPS update 420. A new CPS (e.g., CPS B422) may then be displayed and may replace the previous CPS in memory, a storage device, and / or a database.

[0062] In block 424, an event indicating that a known threat is linked may be input into the system. In other words, a known threat is linked to a specific asset (e.g., indicating that the asset is under attack or being targeted). Depending on the type of the threat, an agent may determine a partial CPS and incorporate the partial CPS into the previous CPS (e.g., from 420 and 422) in CPS update 426. A new CPS (e.g., CPS C428) may then be displayed and may replace the previous CPS in memory, a storage device, and / or a database.

[0063] In block 430, an event indicating whether an asset is isolated may be input into the system. Depending on the accessibility of the asset, an agent may determine a partial CPS and incorporate the partial CPS into the previous CPS (e.g., from 426 and 428) in CPS update 432. A new CPS (e.g., CPS D434) may then be displayed and may replace the previous CPS in memory, a storage device, and / or a database.

[0064] Other events may be injected into the system at any point in time (e.g., in parallel or sequentially). For example, additional events indicating that other assets are exposed may be received. The corresponding CPS may be updated based on the received context data. Once the partial CPS score is determined, the previous CPS may be updated and replaced. The events injected into the present system of FIG. 4 are illustrated as being injected into the present system in a sequential order, but such an example is not limiting, and it should be understood that events may be injected at many different points in time, simultaneously, or in some combination thereof.

[0065] FIG. 5 illustrates a method / process for dynamic vulnerability scoring according to one aspect of the present disclosure. Also, it should be understood that any of the figures described herein, in particular FIGS. 1-3, may implement method 500. The order in which the operations are described is not intended to be construed as limiting, and any number of the described blocks may be combined in any order and / or in parallel to implement the disclosed method.

[0066] In block 502, one or more vulnerabilities may be detected or scanned. A CVP system (e.g., information handling system 14 / 22, CVP system 202, and / or CVP engine 322) may scan for such vulnerabilities, or one or more different computing devices or users may receive such vulnerabilities (e.g., via a user interface). In another embodiment, the CVP system may scan an external data source for new or updated vulnerabilities. In yet another embodiment, the detection of vulnerabilities may be a continuous ongoing process.

[0067] In block 504, once a vulnerability is detected, received, or discovered by the CVP system, the CVP system may determine a CPS for each detected, received, or discovered vulnerability. In some embodiments, the initial CPS may be based on the CVSS of the vulnerability. In another embodiment, in addition to receiving the CVSS when the vulnerability is received, the CVP system may receive historical data. The historical data may include one or more contextual features or data related to the vulnerability. In such embodiments, the CPS may be based on one or more partial CPSs generated for each of the one or more contextual features. Each partial CPS may be generated by one or more corresponding agents of the CVP system.

[0068] In block 506, the CVP system may scan for new events from one or more computing devices or other devices. The CVP system may scan continuously, substantially continuously, or at preselected intervals. In another embodiment, rather than scanning for new events, the CVP system may wait until a new event is received. In such embodiments, the CVP system may communicate with one or more computing devices or other devices. When an event occurs in one or more computing devices or other devices, the event may be transmitted to the CVP system along with the corresponding data.

[0069] In block 508, the CVP system may determine a partial CPS based on the received data corresponding to the event. In some embodiments, based on the type of the received data and / or the context of the received data, the CVP system may generate a factor. The factor may, in such embodiments, be considered a partial CPS as needed. The partial CPS or the factor may be utilized by the CVP system to generate a new updated CPS. For example, if the factor is utilized for a partial CPS, the new factor may be applied to the current CPS to generate a new CPS. Additionally, in embodiments, the new partial CPS may be weighted or compared against the existing partial CPS for such a factor, and if it is found that this differs only by a preselected threshold, the new CPS may be applied.

[0070] In block 510, the CVP system may determine whether the new CPS is different from a previous or current CPS. In another embodiment, the CVP system may determine whether the partial CPS is different from a previous partial CPS. In either embodiment, if no differences are detected, the CVP system may continue scanning or may wait until a new event is detected or received.

[0071] In block 512, if a difference is detected in block 510, the CVP system may generate an updated CPS. As described above, if a partial CPS is a factor, the factor may be applied to the previous CPS. Other values or types of partial CPS may be incorporated into or applied to the previous CPS. In block 514, the CVP system may transmit the new CPS to each computing device or other device. In another embodiment, the new CPS may be stored in a memory, storage device, and / or database in addition to or instead of transmitting the new CPS to each computing device or other device. The CVP system may also display the new CPS on a user interface.

[0072] Figure 6 is a method / process for dynamic vulnerability scoring according to one aspect of the present disclosure. It should also be understood that any of the figures described herein, in particular FIGS. 1 - 3, may implement method 600. The order in which the operations are described is not intended to be construed as limiting, and any number of the described blocks may be combined in any order and / or in parallel to implement the disclosed method.

[0073] In block 602, the CVP system may scan for new vulnerabilities. One or more vulnerabilities may be detected. The CVP system may scan for such vulnerabilities, or may receive such vulnerabilities from one or more different computing devices or users. In other embodiments, the CVP system may wait to receive such vulnerabilities from one or more different computing devices or users (e.g., via a user interface). In yet another embodiment, the CVP system may scan an external data source for new or updated vulnerabilities.

[0074] In block 604, the CVP system may scan for new events from one or more computing devices or other devices. The CVP system may scan continuously, substantially continuously, or at preselected intervals. In another embodiment, rather than scanning for new events, the CVP system may wait until a new event is received. In such an embodiment, the CVP system may communicate with one or more computing devices or other devices. When an event occurs in one or more computing devices or other devices, the event may be transmitted to the CVP system along with corresponding data.

[0075] In block 606, if a new vulnerability is detected, discovered, or received, the CVP system may obtain the CVSS of the new vulnerability. The CVP system may obtain other data corresponding to the new vulnerability. The other data may include historical data, contextual features or data, or other data related to the CVSS from external sources. In block 608, the CVP system may obtain contextual data or historical contextual data. In block 610, the CVP system may determine the CPS based on the CVSS, other data, and contextual data or historical contextual data. In block 612, the CPS may be transmitted to each computing device of one or more different computing devices.

[0076] If a new event is detected at block 604, at block 614, the CVP system may receive data corresponding to the newly detected event and direct different portions or types of the data to corresponding or associated agents. At block 616, the CVP system may determine a partial CPS via an agent corresponding to the type of data of the data corresponding to the event, based on the data corresponding to the event. At block 618, the CVP may generate an updated CPS based on the previous CPS and the partial CPS. At block 620, the CVP system may replace the previous CPS with the updated CPS. At block 612, the updated CPS may be transmitted to each of the computing devices.

[0077] FIG. 7 shows an example of an information handling system 700 capable of performing each of the specific embodiments of the present disclosure and variations thereof, including hosting a CVP engine and / or being scanned by a CVP engine. The information handling system 700 can represent the systems of FIGS. 1-3. The information handling system 700 may include a computer system or processor 702, such as a central processing unit (CPU), a graphics processing unit (GPU), or both. Also, the information handling system 700 can include a main memory 704 and a static memory 706 that can communicate with each other via a bus 708. The information handling system 700 includes a near field communication (NFC) device and interface 718, such as an antenna and an NFC subsystem. The information handling system 700 can also include a disk drive unit 716 and a network interface device 720. As shown, the information handling system 700 may further include a video display unit 710, such as a liquid crystal display (LCD), an organic light emitting diode (OLED), a flat panel display, a solid state display, or a cathode ray tube (CRT), or other suitable display. The video display unit 710 may also act as an input for receiving touch screen input. Additionally, the information handling system 700 may include an input device 712, such as a keyboard and a cursor control device 714, such as a mouse or a touch pad, or a selectable interface on the display unit. The information handling system may also include a battery system or other backup power source and a disk drive unit 716. The information handling system 700 can represent a device capable of telecommunications, and whose resources, voice communications, and data communications can be shared among multiple devices. The information handling system 700 can also represent a server device whose resources can be shared by multiple client devices, or it can represent an individual client device, such as a laptop or tablet personal computer.

[0078] The information handling system 700 can include a set of instructions that can be executed to cause a processor to perform any one or more than one of the methods or computer-based functions disclosed herein. The processor 702 may operate as a stand-alone device or may be connected to other computer systems or peripheral devices using a network or the like.

[0079] In a networked deployment, the information handling system 700 may operate as a server, or as a client user computer in a server-client user network environment, or as a peer computer system in a peer-to-peer (or distributed) network environment. The information handling system 700 may also be implemented as, or incorporated into, various devices such as a personal computer (PC), tablet PC, set top box (STB), smart phone, PDA, mobile device, palm top computer, laptop computer, desktop computer, communication device, wireless phone, landline phone, control system, camera, scanning device, facsimile machine, printer, pager, personal trusted device, web appliance, network router, switch or bridge, or any other machine capable of (sequentially or otherwise) executing a set of instructions that specify actions to be taken by that machine. In a particular embodiment, the computer system 700 can be implemented using an electronic device that provides voice, video, or data communication. Further, although a single information handling system 700 is illustrated, the term "system" shall also be taken to include any collection of systems or subsystems that individually or jointly execute a set of instructions or multiple sets of instructions for performing one or more computer functions.

[0080] The disk drive unit 716 and / or the static memory 706 may include a computer-readable medium 722 into which one or more sets of instructions 724, such as software, may be embedded and which will generally contain sufficient space for data storage. Further, the instructions 724 may embody one or more of the methods or logics described herein. In certain embodiments, the instructions 724 may reside completely or at least partially in the main memory 704, within the static memory 706, and / or within the processor 702 during execution by the information handling system 700. The main memory 704 and the processor 702 may also include a computer-readable medium. The network interface device 720 can provide connectivity to a network 726, such as, for example, a wide area network (WAN), a local area network (LAN), a wireless network (IEEE 802), or other network. The network interface device 720 may also interface with a macrocellular network including a radio communication network characterized as a 2G, 3G, 4G, 5G, LTE, or similar radio communication network similar to those described above. The network interface device 720 may be a wireless adapter having an antenna system 732 for various wireless connectivity and a radio frequency subsystem 730 for signal reception, transmission, or related processing.

[0081] In an alternative embodiment, a dedicated hardware implementation such as an application specific integrated circuit, a programmable logic array, and other hardware devices can be constructed to implement one or more of the methods described herein. Applications that may include the apparatus and systems of various embodiments can, in a broad sense, include various electronic and computer systems. One or more embodiments described herein may implement functions using two or more specific interconnected hardware modules or devices with associated control and data signals that can be communicated therebetween, or as part of an application specific integrated circuit. Thus, the system encompasses software, firmware, and hardware implementations. According to various embodiments of the present disclosure, the methods described herein may be implemented by a software program executable by a computer system. Further, in an exemplary non-limiting embodiment, the implementation can include distributed processing, component / object distributed processing, and parallel processing. Alternatively, a virtual computer system processing can be constructed to implement one or more of the methods or functionality as described herein.

[0082] The present disclosure contemplates a computer-readable medium that includes instructions 724, or in response to a propagated signal, receives and executes instructions 724, such that a device connected to network 728 can communicate voice, video, or data via network 728. Further, instructions 724 may be transmitted or received via network 728 via network interface device 720. In a particular embodiment, the instructions can include BIOS / FW code that resides within memory 704 and includes machine-executable code that is executed by processor 702 to implement various functions of information handling system 700.

[0083] Instructions 724 operable by the information handling system 700 can include one or more application programs and basic input / output system and firmware (BIOS / FW) code. The BIOS / FW code functions to initialize the information handling system 700 upon power-on, call the operating system, and manage input and output interactions between the operating system and other elements of the information handling system 700.

[0084] In another embodiment (not shown), the application program and BIOS / FW code reside in another storage medium of the information handling system 700. For example, the application program and BIOS / FW code can reside within the disk drive unit 716, within a ROM (not shown) associated with the information handling system 700, within an optional ROM (not shown) associated with various devices of the information handling system 700, within a main or static memory storage device, within a storage system (not shown) associated with the network interface device 720 or network channel, within another storage medium of the information handling system 700, or combinations thereof. The application program and / or BIOS / FW code can each be implemented on the machine handling system as a single program or as separate programs that perform various features as described herein.

[0085] Although the computer-readable medium is shown as a single medium, the term "computer-readable medium" includes a single medium or multiple media, such as associated caches and servers that store a centralized or distributed database and / or one or more sets of instructions. The term "computer-readable medium" also includes any medium that can store, encode, or carry a set of instructions for execution by a processor or cause a computer system to perform any one or more of the methods or operations disclosed herein.

[0086] In certain non-limiting, illustrative embodiments, a computer-readable medium can include solid-state memory such as a memory card or other package that stores one or more non-volatile read-only memories. Additionally, a computer-readable medium can be random access memory or other volatile rewritable memory. Further, a computer-readable medium can include magneto-optical or optical media such as a disk or tape or other storage device for storing information received via a carrier signal such as a signal communicated via a transmission medium. Still further, a computer-readable medium can store information received from distributed network resources such as from a cloud-based environment. Attachment of digital files to an email or other built-in information archive or set of archives can be considered a distribution medium equivalent to a tangible storage medium. Thus, the present disclosure is considered to include any one or more of a computer-readable medium or distribution medium and other equivalents and successor media on which data or instructions can be stored. A computer-readable medium may include a "non-transitory machine-readable storage medium." In certain embodiments, a non-transitory machine-readable storage medium can be used to refer to any electronic, magnetic, optical, or other physical storage device for containing or storing information such as executable instructions, data, and equivalents. For example, any machine-readable storage medium described herein can be any one of, or a combination of, random access memory (RAM), volatile memory, non-volatile memory, flash memory, storage drives (e.g., hard drives), solid-state drives, any type of storage disk, and equivalents. As described herein, memory may store, or may include, instructions executable by a processor.

[0087] In the embodiments described in this specification, an information handling system includes any means or collection of means operable to compute, classify, process, transmit, receive, read, transmit, switch, store, display, disclose, detect, record, copy, handle, or use any form of information, confidential information, or data for business, scientific, control, entertainment, or other purposes. For example, the information handling system can be a personal computer, a consumer electronic device, a network server or storage device, a switch router, a wireless router, or other network communication device, a network-connected device (such as a cellular phone, a tablet device, etc.), or any other suitable device, and can vary in size, shape, performance, price, and functionality.

[0088] An information handling system can include a memory (volatile (such as random access memory), non-volatile (such as read-only memory, flash memory), or any combination thereof), a central processing unit (CPU), a graphics processing unit (GPU), one or more processing resources such as hardware or software control logic, or any combination thereof. Additional components of the information handling system can include one or more storage devices, one or more communication ports for communicating with external devices, and various input and output (I / O) devices such as a keyboard, a mouse, a video / graphic display, or any combination thereof. The information handling system can also include one or more buses operable to transmit communications between various hardware components. A portion of the information handling system can itself be regarded as an information handling system. The terms “processor,” “processing circuitry,” and “processing resource” can also refer to any one or more processors, either contained within a single device or distributed across multiple computing devices. The processor can be at least one of a central processing unit (CPU), a semiconductor-based microprocessor, a graphics processing unit (GPU), a field programmable gate array (FPGA) for reading and executing instructions, a real-time processor (RTP), other electronic circuitry suitable for reading and executing instructions stored on a machine-readable storage medium, or a combination thereof.

[0089] When referred to as a "device", "module", or the like, the embodiments described herein can be configured as hardware. For example, a part of an information handling system device can be hardware such as, for example, an integrated circuit (e.g., an application specific integrated circuit (ASIC), a field programmable gate array (FPGA), a structured ASIC, or a device embedded on a larger chip, etc.), a card (e.g., a peripheral component interface (PCI) card, a PCI-express card, a personal computer memory card international association (PCMCIA) card, or other such expansion card, etc.), or a system (e.g., a motherboard, a system on chip (SoC), or a stand-alone device, etc.).

[0090] The device or module can include software including firmware embedded in a device such as a Pentium (registered trademark) class or PowerPC brand processor or other such device, or software capable of operating in the related environment of an information handling system. The device or module can also include a combination of the foregoing examples of hardware or software. Note that the information handling system can include a board-level product having an integrated circuit or a portion thereof, which can be any combination of hardware and software.

[0091] Devices, modules, resources, or programs that communicate with each other need not communicate continuously with each other, unless otherwise explicitly specified. In addition, devices, modules, resources, or programs that communicate with each other can communicate directly or indirectly through one or more than one medium.

[0092] In another embodiment, the term "computing device" or "system device" may be used to refer to any one or all of a programmable logic controller (PLC), a programmable automation controller (PAC), an industrial computer, a desktop computer, a personal digital assistant (PDA), a laptop computer, a tablet computer, a smartbook, a palmtop computer, a personal computer, a smartphone, a wearable device (such as a headset, a smartwatch, or the like), and similar electronic devices that are necessarily equipped with at least a processor and any other physical components to perform the various operations described herein. Devices such as smartphones, laptop computers, tablet computers, and wearable devices are generally collectively referred to as mobile devices.

[0093] In another embodiment, the term "server" or "server device" may be used to refer to any computing device capable of functioning as a server, such as a master switching server, a web server, a mail server, a document server, or any other type of server. The server may be a dedicated computing device or a server module (e.g., an application) hosted by a computing device that operates the computing device as a server. The server module (e.g., a server application) may be a full-function server module or a light or secondary server module (e.g., a light or secondary server application) configured to provide synchronization services between dynamic databases on a computing device. A light server or a secondary server may be a slimmed-down version of server-type functionality that can be implemented on a computing device such as a smartphone, thereby enabling it to function as an Internet server (e.g., a corporate email server) as long as necessary to provide the functionality described herein.

[0094] The foregoing description generally illustrates and describes various embodiments of the present disclosure. However, various changes and modifications can be made to the structures discussed above in the present disclosure without departing from the spirit and scope of the present disclosure as disclosed herein, and all matters contained in the foregoing description or shown in the accompanying drawings are to be construed as illustrative and not in a limiting sense, as will be understood by those skilled in the art. Further, the scope of the present disclosure is to be construed as encompassing various modifications, combinations, additions, alterations, etc. to the embodiments described above and above, which are considered to be within the scope of the present disclosure. Therefore, the various features and characteristics of the present disclosure as discussed herein can be selectively substituted and applied to other illustrated and unillustrated embodiments of the present disclosure, and numerous variations, modifications, and additions can be further made thereto without departing from the spirit and scope of the invention as set forth in the appended claims.

Claims

1. A system for dynamically assessing and ranking security vulnerabilities in a network of linked computing devices, the system comprising: a Context Vulnerability Prioritization Engine wherein the Context Vulnerability Prioritization Engine is configured to: detect vulnerabilities; determine a Context Prioritization Score (CPS) for a vulnerability based on an aggregation of a plurality of partial CPSs generated for each of a plurality of context features related to the vulnerability and one or more non-context features related to the vulnerability; scan for the occurrence of events related to the vulnerability; in response to detecting the occurrence of an event related to the vulnerability by the plurality of computing devices, direct data corresponding to the detected event related to the vulnerability to corresponding agents of a plurality of agents, wherein each of the plurality of partial CPSs for each of the plurality of context features is dynamically calculated by a corresponding agent of the plurality of agents based on data associated with the corresponding agent collected from the plurality of context features related to the vulnerability and the detected event; determine a new partial CPS for each context feature applicable to the data corresponding to the detected event via each corresponding agent that receives the data corresponding to the detected event; determine an updated CPS representing the current state of the vulnerability based on the new partial CPSs; and transmit the updated CPS to each of the plurality of computing devices. A system configured to perform the above.

2. The system of claim 1, wherein the agent comprises one or more of a trained classifier, a statistical model, or a probability model.

3. The system of claim 2, wherein the trained classifier is generated via one or more of another plurality of additional context features related to the vulnerability, a plurality of additional non-context features related to the vulnerability, and a supervised or unsupervised machine learning algorithm.

4. The system according to claim 1, wherein the plurality of computing devices includes one or more of a switch, an access point, a server, a storage device, or a user device.

5. The system according to claim 1, wherein the one or more non-context features include a CVSS score related to the vulnerability.

6. The system according to claim 1, wherein the plurality of context features includes one or more of payload analysis, exploitability, detection reliability, threat intelligence, or vulnerability trend.

7. The system according to claim 6, wherein the plurality of context features includes one or more of exposed data, software and services affected by the vulnerability, behavior analysis related to the vulnerability, website content, scanning frequency, network attack surface, extremely important potential, prominent asset detection, or improvement time.

8. The system according to claim 1, wherein the data corresponding to the detected event comprises one or more of exposed data, software and services affected by the vulnerability, behavior analysis related to the vulnerability, website content, scanning frequency, network attack surface, extremely important potential, prominent asset detection, or improvement time.

9. The system according to claim 1, wherein the context vulnerability prioritization engine is further configured to dynamically prioritize the plurality of vulnerabilities based on one or more dynamically updated CPSs for one or more of the plurality of vulnerabilities.

10. The system according to claim 1, wherein the partial CPS determined for each context feature is weighted based on the data type of the data corresponding to the occurrence of the event.

11. A method for dynamic scoring of network vulnerabilities, the method comprising: detecting, via a context vulnerability prioritization engine, one or more vulnerabilities of one or more computing devices of the network; Determining a Context Priority Score (CPS) for each of the one or more vulnerabilities based on historical data via one or more agents of the context vulnerability prioritization engine, wherein the historical data includes a series of context features corresponding to each one of the one or more vulnerabilities, In response to detecting an event related to one of the one or more vulnerabilities of one or more computing devices of the network, Determining a partial CPS for each of the one or more received context features related to the event, wherein each partial CPS is dynamically determined by an agent of one or more agents of the context vulnerability prioritization engine based on data related to the vulnerability and associated context entities related to the vulnerability, and each agent of the one or more agents is associated with a data type of one of the one or more received context features, When a new partial CPS is determined for at least one received context feature, Generating an updated CPS for the vulnerability based on the CPS and the new partial CPS, Transmitting the updated CPS to each of the one or more computing devices via the context vulnerability prioritization engine A method comprising.

12. The method of claim 11, wherein the event includes vulnerability detection based on one or more of network mapping, vulnerability scanning, web application scanning, external sources, or threat intelligence.

13. The method of claim 11, wherein one or more additional occurrences of one or more events related to one of the one or more vulnerabilities on the one or more computing devices occur continuously, substantially continuously, or at periodic time intervals.

14. The method according to claim 11, wherein a plurality of partial CPSs are determined in parallel based on detection of an additional occurrence of one or more events related to one of the one or more vulnerabilities.

15. The method according to claim 14, wherein each of the plurality of partial CPSs is weighted based on a data type or event type corresponding to an additional occurrence of the one or more events related to one of the one or more vulnerabilities.

16. The method according to claim 11, wherein the historical data includes a CVSS score.

17. A non-transitory machine-readable storage medium storing processor-executable instructions that, when executed by at least one processor, cause the at least one processor to detect one or more vulnerabilities of one or more computing devices; determine a context priority score (CPS) for each of the one or more vulnerabilities based on historical data corresponding to each of the one or more vulnerabilities via one or more agents, the historical data including one or more context features; detect an occurrence of one or more events related to one of the one or more vulnerabilities on the one or more computing devices; receive one or more context features corresponding to the occurrence of the one or more events related to one of the one or more vulnerabilities on the one or more computing devices; determine a corresponding partial CPS via at least one of the one or more agents corresponding to a data type of one of the one or more context features corresponding to the occurrence of the one or more events related to one of the one or more vulnerabilities on the one or more computing devices; generate an updated CPS based on the CPS and the corresponding partial CPS; and transmit the updated CPS to the one or more computing devices. A non-transitory machine-readable storage medium that causes the above to be performed. **Claim 18** The non-transitory machine-readable storage medium according to claim 17, wherein a plurality of partial CPSs are determined in parallel or substantially in parallel. **Claim 19** Each of the one or more vulnerabilities is prioritized based on one of the CPSs corresponding to each of the one or more vulnerabilities, or, if determined, one of the updated CPSs. The non-transitory machine-readable storage medium according to claim 17. **Claim 20** In response to the determination of the CPS for each of the one or more vulnerabilities based on the history data corresponding to each of the one or more vulnerabilities, when the instruction is executed by the at least one processor, the at least one processor is caused to transmit the CPS corresponding to each of the one or more vulnerabilities to the plurality of computing devices. The non-transitory machine-readable storage medium according to claim 17.

Images