ML-Drafted Vulnerability Exceptions for Cloud Security Review

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Cloud-based applications and images experience security vulnerabilities due to outdated software and lack of periodic refreshes, leading to increased cyberattack susceptibility and inefficient manual exception processes that consume resources and may allow undeserving vulnerabilities to persist.

Innovation Solution

A system utilizing a machine learning model to generate draft exception requests and risk assessments, reducing the processing load on user and administrator devices by providing suggested justifications and risk scores, and identifying repeat offenders to improve security exception management.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If manual exception processes are used for security vulnerabilities, then human judgment can evaluate risk, but processing time and resource consumption increase

Engineering Contradiction:

Improvesecurity exception evaluation accuracyVSAvoidexception processing time

Core Design Contradiction:

ReliabilityVSLoss of time

Solution Approach 1:

An automated exception evaluation system acts as an intermediary between security vulnerability detection and human administrator approval. The system uses machine learning models to analyze vulnerability data, generate exception justifications, calculate risk scores, and identify repeat offenders, thereby handling the time-consuming analysis work while preserving human judgment for final approval decisions.

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The system performs preliminary analysis of security vulnerabilities before human administrators review them. It automatically generates exception justifications, calculates risk scores, and prepares evaluation materials in advance, so that when administrators do review the exceptions, they can make informed decisions more quickly without having to perform the initial analysis work.

Inventive Principle:

Principle #10Preliminary action

2Productivity

If automated exception processes are implemented, then processing speed increases, but accuracy of risk assessment may decrease

Engineering Contradiction:

Improveexception processing throughputVSAvoidrisk assessment accuracy

Core Design Contradiction:

ProductivityVSReliability

Solution Approach 1:

The automated exception evaluation system incorporates feedback mechanisms where administrators can review and correct the system's automated assessments. The system learns from these corrections and feedback loops, continuously improving its risk assessment accuracy while maintaining high processing throughput. Administrators provide feedback on automated evaluations, which refines the machine learning models over time.

Inventive Principle:

Principle #23Feedback

3Reliability

If comprehensive vulnerability analysis is performed, then security quality improves, but computational resource consumption increases

Engineering Contradiction:

Improvesecurity vulnerability detection qualityVSAvoidprocessing device energy consumption

Core Design Contradiction:

ReliabilityVSUse of energy by moving object

Solution Approach 1:

The system applies local quality by focusing computational resources on analyzing specific vulnerability attributes that are most relevant to exception decisions. Rather than uniformly analyzing all vulnerabilities with the same depth, it adapts the analysis intensity based on vulnerability characteristics, prioritizing resources for high-risk or complex cases while using more efficient evaluation for straightforward vulnerabilities.

Inventive Principle:

Principle #3Local quality

4Reliability

If manual review of each exception request is required, then control over vulnerability exceptions is maintained, but administrative workload increases

Engineering Contradiction:

Improveexception approval controlVSAvoidadministrator operational burden

Core Design Contradiction:

ReliabilityVSEase of operation

Solution Approach 1:

The system enables self-service by automatically generating exception requests with pre-filled justifications, risk scores, and vulnerability information. Administrators receive these prepared exception packets that require minimal manual input to review and approve or reject. The system also automatically tracks exception status and notifies relevant parties, reducing the administrative burden while maintaining control through the approval workflow.

Inventive Principle:

Principle #25Self-service

Data Source

PatentUS12483587B2Automated vulnerability exception process

Publication Date: 2025.11.25 CAPITAL ONE SERVICES LLC

AI summary

In some implementations, an exception system may receive an indication of a security vulnerability associated with a cloud environment. The exception system may provide a data structure that represents the security vulnerability to a machine learning model in order to receive a suggested exception justification. The exception system may output, to a user device associated with a user assigned to the security vulnerability, a draft exception request that includes the suggested exception justification. The exception system may receive, from the user device, a request to submit an exception request based on the draft exception request. The exception system may transmit a command to tag the security vulnerability as excepted.