Automated CVE Exploit Detection via Honeypot Anomaly Scoring
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods fail to automatically identify which Common Vulnerabilities and Exposures (CVEs) from publicly available lists are exploited, requiring manual checks by software engineers and professionals.
Innovation Solution
An automatic computer-implemented system using honeypots to download and store CVEs, extract properties via Natural Language Processing, record and analyze honeypot data for anomalies, and score exploitability to alert on potentially exploited CVEs.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If manual checks are used to identify exploited CVEs, then accuracy in determining exploited vulnerabilities is improved, but productivity and time consumption deteriorate
Solution Approach 1:
The patent replaces manual mechanical analysis of CVE data with automated computer-implemented systems. The system automatically extracts properties from CVE descriptions using NLP, correlates honeypot events with CVE entries, and generates exploitation indicators without human intervention, thereby maintaining accuracy while dramatically improving productivity.
Solution Approach 2:
The system enables self-service automation where the computer system independently performs the entire CVE exploitation identification process. The system automatically downloads CVEs, extracts properties, analyzes honeypot data, correlates findings, and generates reports without requiring manual checks by security professionals.
2Loss of information
If all CVEs are manually analyzed to determine exploitation status, then completeness of vulnerability assessment is improved, but loss of time and resources worsens
Solution Approach 1:
The system performs preliminary automated analysis of all CVEs by extracting properties from their descriptions and pre-establishing correlation rules between CVE characteristics and honeypot event patterns. This preliminary preparation enables complete vulnerability assessment to be conducted automatically without time-consuming manual verification of each CVE.
3Productivity
If automated systems are used to identify exploited CVEs, then productivity is improved, but measurement precision and reliability deteriorate
Solution Approach 1:
The system incorporates feedback mechanisms where honeypot event data is continuously correlated with CVE properties, and the results feed back into refining the correlation rules and property extraction processes. This feedback loop ensures that automated detection maintains high precision by continuously learning from actual exploitation patterns observed in honeypot data.
Data Source
Figure 1
AI summary
An automatic computer-implemented method for identifying exploited CVEs using honeypots, comprising the steps of downloading and storing new published CVEs from the internet into a database server; extracting properties from the stored CVEs into a structured format, using Natural Language Processing algorithms; recording all incoming data traffic using one or more honeypot servers and sending the honeypot records to a central database server; locating the CVE's properties in the honeypot records using Product Name, Attack Pattern, Exploited File Name and Exploited Parameter Name, and storing the records for further analysis; detecting anomalies in the CVE's related records; scoring each CVE's exploitability by its anomalies status and alerting CVEs with a score higher than a predetermined value.