174 results about "Vulnerability (computing)" patented technology

Techniques described herein pertain to prioritizing threats based on their potential effect on the specific enterprise network sought to be protected. In one example, this disclosure describes a method that includes collecting, by a computing system and from a plurality of external data sources, threat information; storing, by the computing system and in a threat registry, the threat information that includes information about a plurality of threats; collecting, by the computing system, information about an attack surface for an enterprise network; mapping, by the computing system, the threat information to the attack surface; analyzing, by the computing system and based on the mapping of the threat information to the attack surface, a threat included in the plurality of threats to identify a risk score associated with the threat, wherein the risk score represents an assessment of the vulnerability of the enterprise network to the threat.

A server determines vulnerabilities associated with components of a computing device. The server determines attributes associated with individual vulnerabilities. The server determines a subset of the vulnerabilities that includes unexploited vulnerabilities. The server executes a machine learning model to predict a probability of an exploit being created for a particular unexploited vulnerability in the subset. The server sends to a device: information identifying the particular unexploited vulnerability, particular attributes associated with the particular unexploited vulnerability, and the probability of an exploit being created for the particular unexploited vulnerability.

An end-to-end approach for (i) identifying potential vulnerabilities in software applications, including security vulnerabilities, (ii) verifying / confirming the potential vulnerabilities as actual vulnerabilities and (iii) in response, identifying the necessary remedial actions necessary to eliminate or at least mitigate the vulnerabilities. An intelligent agent is implemented that is configured to detect a change to the application's code or computing environment and, as a result of detection of changes to the code or computing environment, identify potential vulnerabilities, verify / confirm the potential vulnerabilities as actual vulnerabilities through determination / creation of vulnerability test cases and automatically identify the necessary remedial actions necessary to eliminate or mitigate the vulnerabilities.

Improved vulnerability detection in a cloud computing environment may be achieved by monitoring, by an agent executing in a compute asset of the cloud computing environment, one or more events associated with code deployed in the cloud computing environment; based at least in part on the one or more events, determining whether the code is active in the cloud computing environment; in response to the code being active, scanning the code to identify one or more vulnerabilities; and performing a notification in response to identifying one or more vulnerabilities.

Systems, methods, and computer-readable storage media for protecting data. One system includes one or more processing circuits configured to identify a security posture comprising one or more configuration data, safeguard data, or remediation data of at least one entity, monitor environmental data corresponding with a computing environment of the entity, and determine at least one vulnerability, threat, or security gap of the entity based on the environmental data and security posture. In response to determining, the one or more processing circuits can update the security posture by performing at least one of (i) updating at least one security configuration of the at least one entity, (ii) implementing at least one safeguard in the computing environment of the at least one entity, (iii) performing at least one remediation action, or (iv) updating at least one security policy or document of the at least one entity.

A system for dynamic vulnerability detection and remediation is provided. The system includes a memory device and at least one processor coupled to the memory device. The at least one processor is programmed to: (a) store within a database an inventory of computer assets included within a computer ecosystem; (b) retrieve a vulnerability report including vulnerability definitions; (c) analyze the database to identify a potential vulnerability by comparing the computer assets stored within the database to the vulnerability definitions; (d) upon detecting the potential vulnerability, determine a service owner associated with the computer assets identified as being involved in the potential vulnerability; and (e) provide content to a user computing device associated with the service owner causing the user device to display a notification alert advising the service owner of the potential vulnerability and providing a remediation plan to address the potential vulnerability.

Systems and methods for providing user-induced variable identification of end-to-end computing system security impact information via a user interface are disclosed. The system receives at a graphical user interface (GUI), a user calibration of a graphical security vulnerability element. The system then determines a set of computing system components that interact with data associated with the network operation based on a transmission of the network operation associated with a computing system. The system then determines a set of security vulnerabilities associated with each computing system component of the set of computing system components using a third-party resource. The system then applies a decision engine on the set of security vulnerabilities to determine a set of impacted computing-aspects associated with the set of computing system components. The system then generates for display a graphical representation of the set of impacted computing-aspects satisfying the security condition of the user calibration.

An embodiment includes detecting by a system a request, responsive to the detecting of the request, computing by a Compute component of the system a plurality of internet protocol addresses in a subnet. The embodiment includes computing by an Analysis component of the system a threat metric for each of the plurality of internet protocol addresses. The embodiment includes determining by the Reputation component of the system a threat score for the subnet where the threat score is based on the threat metric. The embodiment also includes sending by the system the threat score representative of a vulnerability of the subnet as a source of a malicious attack.

The invention discloses a large model domain security enhancement method based on a hybrid strategy, and discloses a system with the large model domain security enhancement method based on the hybrid strategy. According to the large model domain security enhancement method based on the hybrid strategy, a security defense strategy which does not need large model training and can be optimized for a domain specific security scene is provided. A user does not need to have a large language model fine tuning training technology basis and a data set construction basis, and does not need to have large-scale computing power. Security vulnerabilities found after online application can be blocked in time, and meanwhile, the security defense strategy provided by the invention can be quickly migrated to multiple field applications.

A computing platform provides code vulnerability detection and evaluation. The computing platform may use a quantum graph categorizer along with quantum polymorphism execution channels to reduce false positives and provide optimized real-time vulnerability evaluation of code and code segments. The computing platform may use a hybrid approach comprising a mix of static and dynamic vulnerability validation and real-time parallel technique execution.

The invention belongs to the technical field of network security defense, and particularly discloses a multi-stage network security threat defense method and system based on adaptive feedback. A defense strategy is dynamically generated and optimized by performing multi-dimensional analysis on feature differences of historical security events and events to be processed and combining an adaptive feedback mechanism and an attack detection model for iterative training; when deviation or novel threats are detected, rollback and incremental training can be automatically triggered, and multi-round iterative closed-loop defense is formed. The method effectively deals with advanced persistent threats, zero-day vulnerabilities and multi-stage attacks, significantly improves threat detection accuracy and strategy response efficiency, reduces redundant feature interference, enhances expandability and adaptivity of the system, can be widely applied to environments such as the Internet of Things, cloud computing and enterprise intranets, and has wide application prospects. And the intelligence and flexibility of network protection are obviously improved.

The invention relates to the technical field of household equipment intrusion detection, in particular to a mimicry intrusion detection method and system for household equipment, and the method comprises the steps: S0, starting credible verification and initialization; the method comprises the following steps: S1, carrying out multi-modal feature fusion processing; s2, disturbance type joint detection; s3, graded elastic response is carried out; s4, updating the self-adaptive model; s5, identifying a semantic exception instruction; and S6, neural morphology calculation is accelerated. According to the method, damage attack path dependence is detected through dynamic disturbance, multi-modal features are fused through a modal alignment mechanism, low-power-consumption acceleration is achieved through neuromorphic hardware, semantic anomaly instruction recognition and brain-like feedback offline optimization are combined, and the core problem that high-precision detection and high robustness cannot be considered at the same time in the prior art is solved; and particularly, real-time attacks and semantic spoofing attacks of unknown vulnerabilities are effectively resisted.

The invention discloses a power grid endogenous safety control method, system and device based on a double-host framework and a medium. The method comprises the steps that in response to a starting instruction of a computing host, trusted to-be-verified parameters of the computing host are acquired; wherein the computing host and the protection host are heterogeneous devices; according to the credible to-be-verified parameter, determining an actual credibility measurement value of the computing host; and dynamically controlling the operation condition of the computing host according to the actual credibility measurement value and a pre-loaded initial white list strategy. The protection host actively obtains the credible to-be-verified parameters of the computing host, and actively completes the credibility verification process of the computing host on the protection host, so that an active defense scheme that the credibility realization process does not depend on an operating system of the computing host is realized, the autonomous system immunity is enhanced, and the reliability of the computing host is improved. And the attack influence and security risk of unknown vulnerabilities are reduced.

The invention provides a security group implementation method based on a Paas cloud platform and a method for optimizing network topological structure management, and the method comprises the steps: collecting and processing network traffic data, and forming a data set containing normal traffic and malicious traffic; analyzing and predicting a network security threat in real time through an LSTM network based on the data set; normal traffic and malicious traffic are detected in combination with an SVM and a random forest algorithm; and network topology management is optimized by using a graph algorithm and a distributed computing method. According to the invention, the deep learning algorithm is adopted to carry out real-time threat analysis and prediction, so that the detection and defense capabilities for zero-day vulnerabilities and advanced threats are improved; the SVM and the random forest algorithm are adopted to classify and identify normal and malicious traffic, so that the accuracy and the response speed of the security group are improved; and network management and resource allocation are optimized by adopting a graph algorithm and a distributed computing method, so that the controllability and security of network security are improved.

Methods, systems, and computer programs are presented for analyzing a program to be executed on a computer to detect vulnerability for malicious attacks using the program. One method includes an operation for performing dynamic vulnerability detection of a driver when the driver is loaded in a computing system. The dynamic vulnerability detection comprises detecting at least one offset made available by the driver for access to the driver, and detecting application programming interface (API) calls made by the driver. Further, the method includes performing static vulnerability detection of the driver by analyzing binary code of the driver. The static vulnerability detection comprises determining the at least one offset available for access to the driver, and identifying vulnerable code paths to functions accessing kernel functionality. Further, the method includes an operation for determining if the driver is vulnerable based on results from the dynamic vulnerability detection and the static vulnerability detection.

Mechanisms are provided for assessing control checks and components of a vulnerability management system (VMS) for a computing infrastructure. A security vulnerability risk gap assessment of the VMS is executed to generate result data for a plurality of control checks. For each control check, the mechanisms: classify the control check into a maturity level having a corresponding maturity level value; classify each of a plurality of vulnerability assessment security control rating (VASCR) elements into a predetermined classification having corresponding classification values for the control check; and combine the maturity level value and the VASCR element classification values to generate a prioritization score. A graphical user interface output is generated comprising a representation of a prioritized ranked listing of control checks based on the prioritization scores associated with each of the control checks in the plurality of control checks.

The invention discloses an edge computing and distributed zero-trust architecture system and a data processing method. The system comprises an edge computing device cluster, a distributed zero-trust control center, an edge security gateway and a block chain identity infrastructure. The edge computing node collects hardware state, vulnerability and behavior data through the terminal security agent module; the block chain identity infrastructure provides distributed identity identification and verifiable credential service; the edge security gateway executes data packet filtering and single packet authentication; and the distributed zero-trust control center calculates a real-time security coefficient and generates a differentiation strategy, and the log is synchronized to the alliance chain for evidence storage. According to the data processing method, security access is realized through access request initiation, single packet authentication, data acquisition, trust evaluation, strategy execution and log evidence storage. According to the method, the edge device state and distributed zero trust are deeply fused, the problems of incomplete identity authentication and static permission control in an edge scene are solved, and the security and traceability of an edge computing network are improved.

A server determines vulnerabilities associated with components of a computing device. The server determines attributes associated with individual vulnerabilities. The server determines a subset of the vulnerabilities that includes unexploited vulnerabilities. The server executes a machine learning model to predict a probability of an exploit being created for a particular unexploited vulnerability in the subset. The server sends to a device: information identifying the particular unexploited vulnerability, particular attributes associated with the particular unexploited vulnerability, and the probability of an exploit being created for the particular unexploited vulnerability.

Techniques for analyzing cybersecurity vulnerabilities in a computing environment, including: using at least one computer hardware processor to perform: (A) identifying a first cybersecurity vulnerability associated with a resource in the computing environment; (B) obtaining data related to one or more factors related to risk posed by the first cybersecurity vulnerability, the one or more factors including at least one factor indicative of a degree of current exploitation of the first cybersecurity vulnerability; (C) determining, using the obtained data, one or more factor weights for the one or more factors related to the risk posed by the first cybersecurity vulnerability; (D) determining a first score for the first cybersecurity vulnerability using the determined one or more factor weights; and (E) performing one or more security actions based on the determined first score for the first cybersecurity vulnerability.

The present disclosure of the various embodiments relates to using a large language model to assistant with the creation of secure code and / or the completion of threat modeling tasks in software development. In one example, a system comprises a computing device configure to identify a prompt that requests generating secure source code for source code with a security vulnerability. A security data source is queried for a security threat embedding. The security threat embedding is received from the security data source and an augmented prompt is generated. The augmented prompt is transmitted to the large language model. A secure source code is received from the large language model and imported into application source code in a software development environment.

A system is provided for identification of security vulnerabilities using artificial intelligence-based analysis of computing environment logs. The system may analyze data logs associated with each of the endpoint devices associated with a software packet or service. Using an artificial intelligence engine, the system may identify the failure points of the software packet or service, which may result from outdated or nonfunctional code, incorrect parameter configuration, lack of computing resources, and / or the like. The system may further detect security issues associated with the software packet or service, such as a failure to mask or obfuscate sensitive data. Based the identified failure points, the system may generate recommended remediation processes to remediate the failure points. In this way, the system provides a way to remediate failure points in software using intelligent analysis of data logs.

In the context of software security, reachability analysis provides a mechanism to assess the ease of exploitability of a particular vulnerability or whether a vulnerability is exploitable at all. The present techniques provide a mechanism to compute reachability for one or more binary executables within the context of an execution environment. These reachability analyses can be used to determine whether the executables or components therein present any potential vulnerabilities which, in turn, can cause a computing system executing such binary executable to exhibit undesired behavior. The analyses include determining reachability metrics for each of a plurality of program locations. These metrics are used to determine an environment-aware reachability metric reflecting the runtime properties of a computing environment specified by artefacts associated with the software. Remediation actions can then be undertaken to address any security issues in the software or take other actions before it is deployed or allowed to execute.

An end-to-end approach for (i) identifying potential vulnerabilities in software applications, including security vulnerabilities, (ii) verifying / confirming the potential vulnerabilities as actual vulnerabilities and (iii) in response, identifying the necessary remedial actions necessary to eliminate or at least mitigate the vulnerabilities. An intelligent agent is implemented that is configured to detect a change to the application's code or computing environment and, as a result of detection of changes to the code or computing environment, identify potential vulnerabilities, verify / confirm the potential vulnerabilities as actual vulnerabilities through determination / creation of vulnerability test cases and automatically identify the necessary remedial actions necessary to eliminate or mitigate the vulnerabilities.

Embodiments of the disclosure provide for detection and mitigation of anomalous cyber activity in a computing environment. Some embodiments monitor system data associated with an operation occurring in a computing environment. Some embodiments predict a predictive output using a machine learning (ML) model and based on the system data. In some embodiments, the predictive output is indicative of whether the system data is associated with one of a plurality of anomalous event definitions. In some embodiments, the ML model generates the predictive output based on whether the system data indicates an aspect of an anomalous event as defined by a plurality of intrusion detection models. In some embodiments, the ML model is trained on historical classifications of data processed using the plurality of intrusion models. Some embodiments in response to the predictive output, perform a response action that reduces vulnerability of the computing environment to anomalous activity in the operation.

A method for enhancing data security for computing devices over a network is provided. The method performs an automated data security process for at least one external computing device, according to a schedule, including: performing a scan of the at least one external computing device using one or more third-party software applications; obtaining classification data for potential security vulnerabilities applicable to the at least one external computing device; identifying an actual security vulnerability, based on the scan and the classification data; accessing a first database storing organizational data associated with the potential security vulnerabilities; determining current ownership for the actual security vulnerability, based on the organizational data; and determining a priority level for the actual security vulnerability. The method also presents a dashboard including graphical elements and text associated with the actual security vulnerability, and transmits a notification or ticket to the current ownership, based on the priority level.

Methods, systems, and computer storage media for providing data security posture management using an application discovery engine in a security management system. Application discovery supports identifying and mapping various applications within a computing environment. In particular, application discovery can be provided as part of security management operations to assess security posture of applications, identify vulnerabilities, and ensure compliance with regulations. In operation, application discovery data associated with a plurality computing resources of a computing environment is accessed. An annotated application discovery graph comprising a plurality of entities that represent the plurality of computing resources is generated. The annotated application discovery graph is deployed to support generating security postures for computing environments. A request is received for a security posture of the computing environment. A security posture visualization that includes an application discovery graph annotation is generated. The security posture visualization is communicated to cause display of the security posture visualization.

In some aspects, the techniques described herein relate to systems (130) and methods (200; 300) for determining versions of a software application that are affected by a vulnerability including: receiving an indication of a detected vulnerability in a first version of a software application by a computing device (201); in response to the indication of the detected vulnerability, generating a tree representation of the first version of the software application by the computing device (203); retrieving a plurality of versions of the software application by the computing device (301), wherein each of the plurality of version is different than the first version; for each version of the software application of the plurality of versions of the software application, generating a tree representation of the version of the software application by the computing device (303); and based on the generated trees, identifying at least one version of the plurality of versions of the software application that may include the detected vulnerability by the computing device (307).

In some implementations, a computing device determines that project code in a development system references an older version of a component in a third-party library, determines that the older version of the component has a vulnerability, determines that a newer version of the component in the third-party library addresses the vulnerability, determines code changes associated with the fix commit, determines a subset of the code changes associated with the fix commit that addresses the vulnerability, creates a patch based on the subset of the code changes associated with the fix commit, applies the patch to the older version of the component to create a patched component, validates the patch, and based on successfully validating the patch, builds the patched component and uploads the patched component and information associated with the patch to a registry to enable a software developer to download the patched component.

Techniques for analyzing cybersecurity vulnerabilities in a computing environment, including: using at least one computer hardware processor to perform: (A) identifying a first cybersecurity vulnerability associated with a resource in the computing environment; (B) obtaining data related to one or more factors related to risk posed by the first cybersecurity vulnerability, the one or more factors including at least one factor indicative of a degree of current exploitation of the first cybersecurity vulnerability; (C) determining, using the obtained data, one or more factor weights for the one or more factors related to the risk posed by the first cybersecurity vulnerability; (D) determining a first score for the first cybersecurity vulnerability using the determined one or more factor weights; and (E) performing one or more security actions based on the determined first score for the first cybersecurity vulnerability.

The invention relates to a firmware vulnerability detection method and device, terminal equipment and a computer program product, and the method comprises the steps: carrying out the dynamic stain analysis of an executable program of to-be-detected firmware, and obtaining a plurality of stain propagation paths; performing risk assessment and complexity calculation on each taint propagation path to obtain a risk assessment value and a complexity value of each taint propagation path; the risk assessment value and the complexity value of the taint propagation path are input into a preset path scoring model, a path score is obtained, and the path score is in direct proportion to the risk assessment value and in inverse proportion to the complexity value; and performing symbolic execution on a plurality of target propagation paths in the plurality of taint propagation paths, and determining potential vulnerabilities in the to-be-detected firmware based on the symbolic execution result of each target propagation path, the path score of the target propagation path being greater than or equal to a first preset threshold. Through the method and the device, the problems of relatively high computing resource consumption and relatively low detection efficiency of performing vulnerability detection on the firmware in the power equipment are solved.