Adaptive Vulnerability Management via NLP CVE Correlation

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing vulnerability management systems face high rates of false positives and negatives due to their inability to interpret system-specific vulnerability information accurately, leading to inefficient identification and mitigation of vulnerabilities across diverse computer systems.

Innovation Solution

A vulnerability management system (VMS) that utilizes natural language processing (NLP) and machine learning (ML) to adaptively identify potential vulnerabilities by correlating cybersecurity vulnerabilities and exposures (CVEs) with system-specific information, providing accurate mappings and risk valuation, and automating the process of patching and reporting.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Productivity

If scanners treat all computer systems the same way to look for vulnerability signatures, then the scanning process is simple and fast, but the reliability of vulnerability detection deteriorates due to high false positive/negative rates

Engineering Contradiction:

Improvescanning speedVSAvoidvulnerability detection accuracy

Core Design Contradiction:

ProductivityVSReliability

Solution Approach 1:

The system applies local quality by customizing vulnerability scanning parameters and signatures based on specific computer system characteristics. Instead of using uniform scanning approaches, the system adapts scanning methods to match the unique configuration, architecture, and software stack of each target system, thereby improving detection accuracy without sacrificing scanning efficiency

Inventive Principle:

Principle #3Local quality

Solution Approach 2:

The system implements dynamics by making vulnerability scanning adaptive and flexible. Scanning parameters, signatures, and methods are dynamically adjusted based on real-time system characteristics and vulnerability data. This allows the system to optimize scanning effectiveness for each target while maintaining efficient processing speeds

Inventive Principle:

Principle #15Dynamics

2Adaptability or versatility

If a VMS uses common vulnerability names from public sources like NVD, then information sharing across organizations is improved, but the ability to identify specific risks for particular organizations deteriorates

Engineering Contradiction:

Improveinformation sharing capabilityVSAvoidspecific risk identification accuracy

Core Design Contradiction:

Adaptability or versatilityVSMeasurement precision

Solution Approach 1:

The system segments vulnerability information into two layers: common vulnerability data from public sources (CVEs, CVSS scores) that enables information sharing, and organization-specific risk data that captures particular system configurations and threats. This segmentation allows the system to maintain both broad compatibility and precise, customized risk assessment

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The system introduces an intermediary layer that maps common vulnerability names from public sources to organization-specific risk profiles. This intermediary process enriches generic CVE data with system-specific context, enabling accurate identification of particular organizational risks while maintaining the benefits of standardized vulnerability information

Inventive Principle:

Principle #24Intermediary (Mediator)

3Device complexity

If existing VMS solutions cannot identify suitable security patches for specific computer assets, then the system complexity is reduced, but the effectiveness of vulnerability mitigation deteriorates

Engineering Contradiction:

Improvesystem complexityVSAvoidvulnerability mitigation effectiveness

Core Design Contradiction:

Device complexityVSReliability

Solution Approach 1:

The system implements feedback mechanisms that continuously monitor vulnerability data, system configurations, and patch information. This feedback loop enables the system to learn from past vulnerability patterns and improve patch identification accuracy over time, automatically matching suitable security patches to specific computer assets based on accumulated knowledge

Inventive Principle:

Principle #23Feedback

Data Source

PatentUS12192228B2Adaptive vulnerability management based on diverse vulnerability information

Publication Date: 2025.01.07 T MOBILE US INC

AI summary

Embodiments include a method for vulnerability management of a computer system. The method includes collecting vulnerability information over a network from a publishing source. The vulnerability information includes a known vulnerability of a first computer asset, where at least some of the vulnerability information is a set of cybersecurity vulnerabilities and exposures (CVEs) published online. Further, at least some of the CVEs is in a human-readable format. The method further includes collecting system information of the computer system subject to the vulnerability management, where the system information includes information about a second computer asset of the computer system. The method further includes processing the collected vulnerability information and the collected system information by interpreting the human-readable CVEs and correlating the interpreted CVEs with the collected system information. A potential vulnerability of the second computer asset is identified based on the correlation between the interpreted CVEs and the collected system information.