138 results about "Vulnerability management" patented technology

The invention relates to the technical field of vulnerability management, and discloses a vulnerability management method and system based on an adaptive security platform. The method comprises the following steps: constructing an asset information database based on all IT assets in an organization network environment, and calculating a time sensitivity parameter set; based on the asset information database and the time sensitivity parameter set, executing aperiodic time stratification vulnerability data collection and dynamic self-shaping processing to obtain a standardized structure vulnerability data set; performing vulnerability utilization chain topology analysis through the bidirectional adversarial neural network model to generate a vulnerability risk score and a vulnerability association relationship graph; and generating vulnerability risk decision information according to the vulnerability risk score and the vulnerability association relationship graph, and performing constraint perception adaptive repair arrangement based on the vulnerability risk decision information to generate an optimal vulnerability repair scheme. The vulnerability discovery process is more efficient and accurate, the repair success rate is improved, the service interruption time is shortened, and continuous optimization of the repair process is achieved.

Generating unified cybersecurity signals from multiple sources includes receiving a plurality of cybersecurity signals each determined based on monitoring a computing environment by a plurality of cybersecurity monitoring systems, including at least two disparate cybersecurity monitoring systems; managing a graph based on the plurality of cybersecurity signals where the graph includes nodes of entities in the computing environment and vertices representing relationships between the nodes, wherein the managing includes utilizing a unified node in the graph for two cybersecurity signals from the at least two disparate cybersecurity monitoring systems; analyzing the graph to determine a representation of the computing environment; and managing the computing environment based on the analyzing the graph including determining one or more cybersecurity threats in the computing environment and associated severity.

The disclosed embodiments provide systems and methods for continuous exposure and attack surface management using a data fabric. Data from multiple heterogeneous cybersecurity sources, including vulnerability scanners, threat intelligence, cloud security tools, and endpoint monitoring systems, is ingested and integrated into a semantically harmonized representation, such as a security knowledge graph. This unified data model normalizes, correlates, and contextualizes diverse cybersecurity information, enabling comprehensive and real-time assessment of an organization's cybersecurity risk posture. Automated workflows trigger proactive remediation actions based on dynamically calculated exposure metrics. Additional embodiments leverage the same data fabric architecture to support specialized cybersecurity use cases, including unified vulnerability management (UVM), cyber asset attack surface management (CAASM), continuous threat exposure management (CTEM), and asset exposure management (AEM).

The invention discloses a CAPEC vulnerability management system based on a large language model, and belongs to the technical field of network security. The system comprises three modules: a vulnerability-CAPEC dynamic mapping module jointly encodes vulnerability description and code context through a bimodal large language model, accurately associates vulnerability logic with a CAPEC attack mode in combination with comparative learning and knowledge graph construction, and breaks through semantic limitation of traditional rule matching; the adversarial repair code generation module is used for generating high-robustness repair codes through adversarial training and syntax tree verification by fusing CAPEC relieving suggestions and code features on the basis of the association result, so that the secondary vulnerability risk is remarkably reduced; and the full-process automatic verification and DevOps integration module performs multi-dimensional security verification such as symbolic execution, fuzzy testing and the like on the generated repair code, and deeply integrates a development tool chain to realize real-time pushing and closed-loop management of a repair scheme.

An illustrative method includes accessing, by a data platform, an alert generation policy associated with an entity that deploys containers in a cloud environment, the alert generation policy modifiable by the entity and specifying criteria for providing alerts associated with one or more vulnerabilities associated with the containers; detecting, by the data platform based on a scan of a container included in the containers, a vulnerability associated with the container; determining, by the data platform, an attribute of the vulnerability; and generating, by the data platform when the attribute meets the criteria specified in the alert generation policy, an alert associated with the vulnerability.

A software bill of materials (SBOM) and vulnerability management system (“system”) disclosed herein extracts software component-related identifiers for Internet of Things (IoT) devices using deep packet inspection. The system filters the identifiers by removing identifiers that match a blacklist of identifiers known to not correspond to software components. The system then populates SBOM fields using a database storing the filtered identifiers with a schema that is uniform across SBOM file formats and queries a vulnerability database with software components indicated in the filtered identifiers to identify vulnerabilities for each IoT device for security risk assessment.

The invention discloses an EPSS-based vulnerability accessibility rating method, relates to the technical field of network security, and is used for solving the problem that vulnerability path analysis is not clear. According to the method, multi-modal data in threat intelligence is analyzed, a uniform vulnerability multi-dimensional feature vector is dynamically generated in combination with a feature quantization and time correction strategy, and the risk of the vulnerability in an actual scene is comprehensively analyzed in combination with network topology analysis and protection strategy evaluation and environment sensitivity score quantization; the vulnerability priority is dynamically adjusted through attack path simulation in combination with path weights and protection measures, the criticality of vulnerabilities in an attack chain is quantified, it is ensured that high-risk vulnerabilities in a critical path are processed preferentially, and a repair task optimization model under resource and time constraints is established based on the vulnerability priority and a repair dependency relationship. According to the method, the accuracy and the dynamism of vulnerability reachability rating are remarkably improved, and the efficiency of vulnerability management and the actual protection effect are improved.

An AI-driven centralized orchestration system (100) with MCP protocol for real-time compliance and risk data management, including: a. a centralized integration and orchestration platform configured to connect heterogeneous enterprise IT systems through standardized API connections and execute automated workflows; b. a variety of domain-specific artificial intelligence (AI) agents that interface with IT service management (ITSM), vulnerability management, and endpoint and asset management platforms for data collection, analysis, and assessment; c. a Multi-Agent Communication Protocol (MCP) layer that enables structured communication, negotiation and coordination between AI agents in real time; d. a data consolidation module configured to aggregate, standardise and align heterogeneous data into a unified repository using machine learning models; e. a compliance reporting module for dynamically generating and distributing audit-ready compliance reports based on AI-analyzed data and triggered workflows; f. an alerting module configured to deliver context-dependent predictive notifications of compliance violations or risk anomalies through various communication channels; g. a predictive dashboard module capable of displaying compliance status, risk metrics, and proactive insights in real time via AI-driven visualization tools; i.e., where the orchestration platform, AI agents, and MCP layer together enable automated, scalable, and proactive compliance and risk actions.

Disclosed are various embodiments for automated vulnerability management. In some embodiments, a list of available updates from a device management system is collected. Then, the device management system is queried to obtain device information to determining applicable updates for operating systems, applications, and firmware based on the list of available updates. Next, a common platform enumeration (CPE) is determined for the updates in the list of available updates and the current version of the operating systems, applications, firmware. Next, a reverse lookup is performed in a vulnerability database for vulnerabilities. The vulnerabilities of the current version of the operating systems, applications, firmware are compared with the vulnerabilities of the updates in the list of available updates. Finally, a vulnerability report is generated.

The invention provides an Internet of Vehicles vulnerability management method, system, device and medium based on a block chain, and relates to the technical field of vehicle networks, the method can comprehensively identify potential safety risks of vehicles through a dynamic and static combined vulnerability detection mechanism, and generates a structured vulnerability report; hash abstract chaining evidence storage is performed on key data of reports and subsequent repair links by using a block chain, so that the whole process of vulnerability discovery, analysis and repair is ensured not to be tampered and traceable, and the authenticity and credibility of data are improved; the integrity of the report is verified at the cloud end, and an AI analysis engine is combined to associate a CVE database and threat intelligence, so that intelligent generation and decision support of a repair scheme are realized; the hash abstract on the chain of the OTA patch is verified at the vehicle end, so that the credibility of the patch source and the integrity of the content are guaranteed; and finally, through feedback of an installation result and secondary uplink archiving, complete closed-loop management from vulnerability discovery to repair verification is formed.

Provided herein are techniques to facilitate vulnerability management for one or more endpoint devices of a network based on network infrastructure security context. In one example, a computer-implemented method may include determining a base vulnerability score for a particular vulnerability that is detected for an endpoint device of an enterprise network; determining topology information for the endpoint device within the enterprise network; translating the particular vulnerability to triggering information; performing a comparison between the security policies for the one or more network security mechanisms of network security infrastructure and the triggering information to determine whether the endpoint device is protected from the particular vulnerability being triggered for the endpoint device; and generating an updated vulnerability score for the particular vulnerability by adjusting the base vulnerability score based on whether the endpoint device is protected from the particular vulnerability being triggered for the endpoint device.

The embodiments herein provide a method for managing knowledge for solving vulnerability issues using an organizational knowledgebase. The method includes linking a vulnerability management platform knowledgebase (KB) article to an organization's core documents. The method further includes applying a vulnerability management platform formula, to enhance the knowledge management and security practices within the organization's knowledgebase. The method for applying the vulnerability management platform formula comprises tagging (CVEs) or (CWEs), to the vulnerability platform knowledgebase (KB) articles; attaching rich articles as links to a ticket tracking system; linking the vulnerability management platform KB articles to a new ticket created; and automatically linking a code commit to the vulnerability management platform KB articles. The method further comprises defining and configuring a plurality of Service Level Agreements (SLAs) at an application or sub-application level to set acceptable timelines for acknowledging and mitigating security concerns.

The invention relates to the technical field of security vulnerability analysis, in particular to a big data-based security vulnerability management method, which comprises the following steps of: constructing a real-time data acquisition strategy, capturing an internal source network equipment log, a server running state and application system flow data through a distributed log collection component, and storing the internal source network equipment log, the server running state and the application system flow data; meanwhile, vulnerability information of the exogenous threat intelligence platform is synchronized through an API interface; constructing a dynamic risk assessment model, and updating the risk assessment of the security vulnerability in real time by taking the four-dimensional model [IP address, service type, port number and software version] as a reference; and triggering a response strategy according to risk value grading, wherein the response strategy comprises automatic isolation of high-risk equipment, dynamic configuration of firewall rules and generation of a repair work order. According to the invention, through the synergistic effect of real-time data acquisition, dynamic asset modeling, intelligent risk assessment, a hierarchical response mechanism and a closed-loop verification system, the accuracy, efficiency and defense capability of security vulnerability management are significantly improved.

The invention discloses a method based on ATTamp; the invention discloses a CAPEC vulnerability association identification system of a CK framework, and relates to the technical field of network security. Comprising a data integration module, an attack path analysis engine module, a vulnerability association analysis engine module, a dynamic update and intelligence integration module and a visual display module which are connected in sequence. In combination with a CAPEC framework, deeper threat intelligence and defense suggestions are provided from a behavior mode and an attack path of an attacker. Meanwhile, latest vulnerability information is obtained in real time through a dynamic updating and intelligence integration module, the vulnerability management efficiency and the threat detection accuracy are improved by automatically analyzing the incidence relation between the attack path and the vulnerability, the incidence relation between the attack path and the vulnerability is displayed through a graphical interface, a user is helped to visually understand the full view of the threat, and the threatening effect is improved. And a vulnerability influence range and restoration suggestion information are provided.

The invention discloses a vulnerability closed-loop disposal method and system based on intelligent collaboration, and belongs to the technical field of information security management. Vulnerability data and disposal information in a plurality of independent security systems are collected, and a multi-dimensional vulnerability semantic model is constructed; constructing a state perception graph based on a semantic model, extracting candidate state paths, and constructing a time sequence closed-loop prediction model in combination with a shortest closed-loop path and a historical track; according to a vulnerability influence range, a service dependency chain and a prediction path key node, adaptively dividing responsibility affiliation, generating a dynamic disposal responsibility graph and realizing automatic assignment; combining the node response capability and the task saturation, dynamically calculating the priority and scheduling the processing task; monitoring an actual disposal behavior, correcting an edge weight of the state diagram in real time and updating the model; according to the method, the whole-process intelligence, collaboration and dynamic evolution of vulnerability management are realized, and the processing efficiency and the prediction precision are improved.

The invention relates to the technical field of data transmission, and discloses a secure data transmission system based on cloud computing, which comprises a cloud computing platform, the cloud computing platform is connected with a data encryption module, an access control module, a transmission channel module, a log module, a security audit and log analysis module, a security vulnerability management and repair module and a data transmission module. The method comprises the following steps: detecting, verifying and recording information of a user terminal, an IP (Internet Protocol) and the like, pre-auditing transmission data, performing data transmission work again after a security reply is obtained, adjusting the speed in a transmission process according to the grade of a user, and performing key authentication on the user terminal in the transmission process at regular time, so as to ensure the safety of the user. And after error information is obtained, data transmission is stopped in time, the obtained data is limited, and the data security is protected.

Various systems and methods for providing risk-based vulnerability management are described herein. A system is configured to access an attack graph, the attack graph including exploits represented as preconditions and postconditions; access vulnerability information of a plurality of nodes in the network, the vulnerability information including conditions of the plurality of nodes in the network; access a network connectivity graph that represents a logical network topology of the plurality of nodes in the network; identify a set of attack paths in the attack graph by comparing the conditions of the plurality of nodes in the network with preconditions and postconditions in the attack graph; calculate a risk score for each of the set of attack paths in the attack graph; and present the risk score for each of the set of attack paths.

The invention relates to the technical field of computers, and discloses a computer security protection management system which comprises a firewall module, an intrusion detection and defense module, an anti-virus and anti-malicious software module, a user identity and access management module, a security information and event management module, a vulnerability management module and a data encryption module. And the firewall module controls access of network traffic. An advanced machine learning and behavior analysis algorithm is adopted, false alarm and missing alarm are effectively reduced, high accuracy of threat detection is ensured, novel and unknown attacks can be rapidly recognized, the overall protection capability can be improved, in the aspect of system performance optimization, efficient flow analysis and threat response are achieved through a distributed architecture and a hardware acceleration technology, and the system performance is optimized. The system load is reduced, the scanning and monitoring strategy and the efficient encryption algorithm are optimized, the occupation of system resources is remarkably reduced, and the response speed and stability of the system are improved.

The invention provides a method for optimizing system security vulnerability management based on an extension program. The method can be applied to the field of information security or the field of artificial intelligence. The method comprises the following steps: in response to a business demand of developing an application system, collecting a code under editing in an integrated development environment in real time; scanning security vulnerabilities of the codes under editing through a customized extension program, analyzing and comparing the codes under editing according to rules in a rule base, and identifying potential security vulnerabilities, the customized extension program being integrated in an integrated development environment, and the rule base being built in the customized extension program; in response to the scanned security vulnerability, obtaining a repair suggestion for the security vulnerability by using a pre-trained vulnerability management model according to the compiled code associated with the security vulnerability; and on the basis of the repair suggestion, adjusting the code under editing so as to repair the security vulnerability. The invention further provides a device and equipment for optimizing system security vulnerability management based on the extension program, a storage medium and a program product.

The invention relates to the technical field of Internet of Things security, in particular to an Internet of Things vulnerability data restoration system, which is used for solving the problems that in the prior art, multi-dimensional vulnerability features cannot be accurately extracted and propagated, potential vulnerabilities cannot be efficiently identified, high-risk vulnerabilities cannot be preferentially processed according to a dynamic resource adjustment strategy, and the vulnerability data restoration efficiency cannot be improved. And the accuracy, the automation level and the response efficiency of vulnerability management are reduced. According to the method, a heterogeneous relation graph between equipment and components is constructed through the vulnerability identification and positioning module, multi-dimensional vulnerability features are accurately extracted and propagated, efficient identification of potential vulnerabilities is realized, priority ranking is performed in combination with CVSS scores and equipment importance, high-risk vulnerabilities are preferentially processed through scientific scores and a dynamic resource adjustment strategy, and the efficiency of vulnerability identification is improved. And the to-be-fixed vulnerability list containing multi-aspect information is generated, so that the vulnerability management accuracy, the automation level and the response efficiency are remarkably improved.

The embodiments herein provide a method and a system for developer identification and ticket assignment. The method comprises applying owner identification logics through a plurality of application security testing methodologies such as SAST, DAST and SCA tool. The method further comprises making an API call through a vulnerability management platform to a code repository to identify the developer who has changed the portion of the code recently; assigning a ticket to the identified developer and saving the developer in the vulnerability management platform; viewing the status of the ticket through various options such as insight view, CTO view, Engineering Manager view and Developer view; and providing training requirements and assessing the effectiveness of training.

The invention discloses a vulnerability protection method using a blocking packet for blocking, which protects vulnerabilities through the blocking packet, and adopts a traffic monitoring technology to accurately shield identified vulnerability detection traffic or attack behaviors. By deploying a protection strategy on a network level, direct repair of vulnerabilities on a host is avoided, so that the complexity of system maintenance is reduced. The method ensures that the vulnerabilities cannot be scanned and utilized. Through the means, vulnerability supervision and hacker attacks are effectively handled, and closed loop of vulnerability management is realized. Meanwhile, when a malicious or abnormal connection request is detected, the system can generate a data packet with an RST mark and send the data packet to the other party of the connection, so that the connection is forcibly interrupted. The operation can effectively prevent illegal network traffic from being continuously transmitted.

The invention discloses a vulnerability scanning auditing method and a related device, and relates to the field of software testing. After a to-be-audited vulnerability scanning file in a preset format is obtained, whether first scanning result data in the to-be-audited vulnerability scanning file is compliant or not is judged according to a standard verification rule. And on the basis of judging that the first scanning result data is compliant, judging whether software associated with the to-be-audited vulnerability scanning file is a scanning-free type or not. If yes, whether second scanning result data in the to-be-audited vulnerability scanning file is compliant or not is judged according to pre-configured scanning-free management content. And when the software associated with the to-be-audited vulnerability scanning file is not a scanning-free type, judging whether third scanning result data in the to-be-audited vulnerability scanning file is compliant or not according to pre-configured vulnerability management content. According to the vulnerability scanning auditing method, the compliance of the vulnerability scanning file can be automatically judged according to the configured management content and the judgment process, and the checking efficiency and accuracy are effectively improved.

The invention discloses a collection, analysis and utilization linkage method for the full life cycle of vulnerability intelligence, which comprises the following steps: respectively acquiring original vulnerability intelligence of a plurality of heterogeneous data sources, and carrying out standardization processing on the original vulnerability intelligence to obtain vulnerability description information; constructing an asset knowledge graph, wherein the asset knowledge graph is used for representing IT asset objects in the enterprise and dependency and deployment relationships among the IT asset objects; performing graph traversal query on the vulnerability description information based on an asset knowledge graph, and identifying an affected asset list affected by vulnerabilities; and according to a preset response strategy, generating a safety response instruction from the affected asset list and sending the safety response instruction to the safety protection system. According to the method, the asset knowledge graph is constructed and the multi-source vulnerability information is subjected to standardization and mapping correlation analysis, so that the accurate and rapid identification of the affected assets of the power system and the automatic response strategy generation are realized, and the efficiency and the accuracy of the vulnerability management of the key information infrastructure of the power grid are effectively improved.

The invention discloses a DevOps-based dynamic component security management method and system, and belongs to the technical field of information security detection. Component information data and vulnerability information data are matched by using a matching engine, potential security vulnerabilities are identified, and the security vulnerabilities of the component information data and the vulnerability information data are matched; according to the severity of the vulnerability, the deployment environment of the project, the involved user data volume and the involved sensitive data volume, risk assessment is carried out on the security vulnerability, automatic rating and classification are carried out on risk levels, the priority of the security vulnerability and a corresponding repair strategy are confirmed, a risk report is generated, and the risk report is displayed or exported through a user interface. According to the dynamic component security management method and system based on DevOps disclosed by the invention, potential security vulnerabilities can be accurately identified, automatic risk rating is carried out, vulnerability repair priorities can be ranked according to project risk levels, and later project vulnerability management is facilitated.

Mechanisms are provided for assessing control checks and components of a vulnerability management system (VMS) for a computing infrastructure. A security vulnerability risk gap assessment of the VMS is executed to generate result data for a plurality of control checks. For each control check, the mechanisms: classify the control check into a maturity level having a corresponding maturity level value; classify each of a plurality of vulnerability assessment security control rating (VASCR) elements into a predetermined classification having corresponding classification values for the control check; and combine the maturity level value and the VASCR element classification values to generate a prioritization score. A graphical user interface output is generated comprising a representation of a prioritized ranked listing of control checks based on the prioritization scores associated with each of the control checks in the plurality of control checks.

The invention belongs to the technical field of network security, and particularly relates to a vulnerability severity score prediction method based on a large language model and retrieval enhancement. According to the method, an automatic scoring framework integrating data preprocessing, hierarchical CWE classification and an RAG technology is constructed; firstly, redundant noise of vulnerability description is eliminated through a version number cleaning algorithm driven by a regular rule, and then domain knowledge modeling is enhanced in combination with a hierarchical CWE classifier based on MITRE View-1003; and an RAG technology is adopted to fuse semantic features of historical similar vulnerabilities and a large language model generation capability, so that high-precision and interpretable CVSS score prediction is realized. Experiments show that the method can be widely applied to severity score prediction of various types of vulnerabilities, has good prediction robustness and effectiveness, significantly improves vulnerability management efficiency and decision transparency, and provides an effective tool for evaluation and management of software supply chain security.

Systems and methods are disclosed comprising instructions to collect vulnerability information over a network from a publishing source, collect network asset information of a communications network, generate a self-executing scanner agent configured to automatically scan the communications network for a known vulnerability based on an input including the collected vulnerability information and the collected network asset information, deploy the scanner agent at any network assets of the communications network that match a particular type of network asset indicated in the collected vulnerability information, generate a record including an indication of a particular network asset of the communications network in association with the known vulnerability in response to the scanner agent executing and detecting the known vulnerability in the particular network asset, and store the record in a data repository that aggregates records of detected known vulnerabilities in association with network assets of the communications network.

The invention relates to the technical field of information security, in particular to a cloud security vulnerability management platform based on AI. Comprising a centralized management module, a distributed event collector network, an automatic vulnerability assessment system, an intelligent repair suggestion module, an interactive user interface, a self-adaptive vulnerability protection mechanism, a continuous learning and updating mechanism, a multi-level identity verification system, an automatic security test tool set and an extensible plug-in architecture. The AI-based cloud security vulnerability management platform provided by the invention is more comprehensive, intelligent and flexible, so that the problems are solved, and the security of a cloud environment and the use experience of a user are improved.

A system and method are provided for integrating a property management system and a cyber vulnerability management system to provide remediation for assets in an environment. Information obtained about network connected mechanical assets within the environment is respectively obtained from a tag on the asset. For each asset the asset is identified through a property management database based on the information in the tag and a cyber position of the asset is obtained through a digital network identifier in the tag from the cyber vulnerability management system. In response to identification of the asset having a cyber vulnerability, remediation for the cyber vulnerability is determined, scheduled, and initiated.