Machine Learning False Positive Prediction for Vulnerability Scanners

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing cybersecurity solutions face challenges in accurately identifying and remediating security vulnerabilities in large computer networks due to the presence of false positives in vulnerability scan reports from diverse vulnerability scanners, which requires significant manual analysis and expertise, leading to potential oversight of critical vulnerabilities.

Innovation Solution

A cybersecurity solution that collects, normalizes, and analyzes vulnerability scanning results from multiple scanners, using machine learning to predict and separate false positives, thereby automating the remediation process and reducing the burden on security teams.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Adaptability or versatility

If vulnerability scanning is performed using multiple diverse scanners, then coverage of different computer resource asset types is improved, but the number of false positives increases

Engineering Contradiction:

Improvecoverage of different computer resource asset typesVSAvoidaccuracy of vulnerability identification

Core Design Contradiction:

Adaptability or versatilityVSReliability

Solution Approach 1:

The system segments the vulnerability analysis process into multiple independent stages: data collection from diverse scanners, normalization of different formats, feature extraction, false positive prediction using machine learning, and remediation. This segmentation allows each stage to specialize in handling specific scanner types and formats while maintaining overall accuracy.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The patent introduces an intermediary machine learning-based false positive prediction system that sits between the diverse vulnerability scanners and the remediation process. This intermediary normalizes and analyzes results from multiple scanners, predicting false positives before remediation actions are taken, thereby resolving the contradiction between comprehensive scanning coverage and result accuracy.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Reliability

If manual analysis of vulnerability scan reports is performed, then accuracy of vulnerability identification is improved, but the time required for analysis increases

Engineering Contradiction:

Improveaccuracy of vulnerability identificationVSAvoidmanual analysis time

Core Design Contradiction:

ReliabilityVSLoss of time

Solution Approach 1:

The system implements self-service through automated machine learning models that independently analyze vulnerability scan results and predict false positives without requiring manual security analyst intervention for each finding. The system serves itself by automatically processing, analyzing, and prioritizing vulnerabilities based on learned patterns from historical data.

Inventive Principle:

Principle #25Self-service

Solution Approach 2:

The patent replaces the mechanical manual analysis process with an automated machine learning-based prediction system. Instead of security analysts manually reviewing each vulnerability finding, the system uses trained models to automatically identify and predict false positives, substituting human mechanical analysis with computational automation while maintaining or improving accuracy.

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

3Productivity

If comprehensive vulnerability scanning is performed across large networks, then the number of detected vulnerabilities increases, but the difficulty of detecting and measuring true vulnerabilities increases

Engineering Contradiction:

Improvenumber of detected vulnerabilitiesVSAvoiddifficulty of identifying true vulnerabilities

Core Design Contradiction:

ProductivityVSDifficulty of detecting and measuring

Solution Approach 1:

The system implements feedback mechanisms where machine learning models are continuously trained on historical vulnerability data and remediation outcomes. The false positive prediction model receives feedback from confirmed true positives and false positives, continuously improving its ability to distinguish true vulnerabilities from false alarms as the network is scanned comprehensively.

Inventive Principle:

Principle #23Feedback

Solution Approach 2:

The patent changes key parameters in the analysis process by using machine learning models that dynamically adjust prediction thresholds and confidence levels based on the specific context of each vulnerability finding. This allows the system to maintain high sensitivity for detecting true vulnerabilities while adapting the decision parameters to reduce false positive rates across different asset types and vulnerability categories.

Inventive Principle:

Principle #35Parameter changes

Data Source

PatentUS11381590B2Predicting false positives from vulnerability scanners using data analytics and machine learning

Publication Date: 2022.07.05 SAUDI ARABIAN OIL CO

AI summary

A method and system for remediating a vulnerability in a first computing resource asset in a computer network, including receiving vulnerability scanning results data from each respective one of a plurality of diverse vulnerability scanners, storing the vulnerability scanning results data as a collection of vulnerability scanning results data, normalizing and extracting common features from the normalized data, vectorizing the common features to determine feature vectors, applying a false positive predictor model to predict a false positive, separating vulnerability scanning results data that corresponds to one or more predicted false positives from a remainder of the collection of vulnerability scanning result data, and sending the remainder of the collection of vulnerability scanning results data to a second computer resource asset.