CVE Association with Device Profiles via Feature Importance
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current security and vulnerability management technologies rely on reactive approaches, failing to associate Common Vulnerabilities and Exposures (CVEs) with device profiles not yet in the inventory, leading to security gaps as they do not account for devices with similar features that may be vulnerable to the same CVEs, thus leaving them unpatched and exposed to emerging threats.
Innovation Solution
A system that determines feature importance values for device profiles, identifying and associating CVEs with device profiles that share common features with known profiles, and provides security patches to address these vulnerabilities, even if the device profiles are not yet in the inventory, using a classifier that predicts the likelihood of CVE impact based on feature importance thresholds.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If current security vulnerability management techniques use an inventory of known device profiles to identify security patching needs, then security patching can be managed for known devices, but security gaps occur for other device profiles with similar features that are not in the inventory
Solution Approach 1:
The system performs preliminary actions by proactively identifying devices with similar features to known vulnerable device profiles before they are actually affected by vulnerabilities. It calculates feature importance values and compares device features in advance to predict potential vulnerabilities, allowing security patches to be applied before exploitation occurs.
Solution Approach 2:
The system introduces an intermediary mechanism - a feature comparison and importance calculation system - that bridges the gap between known vulnerable device profiles and unknown but similar devices. This intermediary analyzes device features, calculates importance values, and predicts vulnerabilities without requiring direct vulnerability data for each device.
2Reliability
If a reactive approach is used to associate CVEs with device profiles after vulnerabilities are discovered, then CVEs can be associated with known affected devices, but devices with similar features remain unpatched and exposed to threats
Solution Approach 1:
The system performs vulnerability association in advance by calculating feature importance values and comparing device profiles before vulnerabilities are exploited. It proactively identifies which devices are likely to be affected by CVEs based on their feature similarity to known vulnerable profiles, enabling preemptive patching rather than reactive response.
Solution Approach 2:
The system replaces the manual, reactive mechanical process of vulnerability management with an automated computational system that uses machine learning algorithms to calculate feature importance values and predict vulnerabilities. This substitution enables rapid, scalable analysis of device profiles and automatic identification of at-risk devices.
3Productivity
If security management focuses only on devices in the inventory, then resource allocation for patching can be optimized for known devices, but devices with similar features outside the inventory remain vulnerable
Solution Approach 1:
The system applies a universal approach by using the same feature importance calculation and comparison methodology for both known devices in the inventory and unknown devices with similar features. This multi-functional system serves dual purposes: managing patching for known devices while simultaneously identifying and protecting similar devices that were previously outside the inventory scope.
Solution Approach 2:
The system performs preliminary identification of vulnerable devices by analyzing feature similarity before security threats materialize. It proactively expands the protection scope to include devices with similar features to known vulnerable profiles, allowing resource allocation to be optimized for both known and previously unknown at-risk devices.
Data Source
AI summary
A system is configured for associating a CVE with a particular device profile is disclosed. The system receives a request from a user to associate a CVE with a particular device profile. For each device profile from a plurality of device profiles stored in a memory, the system determines feature importance values for features of each device profile. The features of each device profile include at least an operating system and a CPU architecture. The feature importance value of a corresponding feature of a device profile associated with a CVE indicates a probability of the CVE to affect the device profile with respect to that feature. The system identifies a device profile that has features with a total feature importance value above a feature importance threshold value. The system identifies a particular CVE associated with the identified device profile. The system associates the particular CVE with the particular device profile.