Network Risk Scoring Using Exploitability and Bad Actor Links
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network security systems lack the ability to contextualize vulnerability risks based on factors such as exploitability and links to bad actors, leading to ineffective risk assessment and remediation strategies.
Innovation Solution
A method and system that calculates vulnerability risk scores (VRS), host risk scores (HRS), and network risk scores (NRS) using a linear combination of CVSS scores, exploitability, and links to bad actors, along with host criticality, to provide a comprehensive risk assessment and facilitate targeted security actions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional network security systems use standard vulnerability scanning, then vulnerability detection is achieved, but risk assessment accuracy deteriorates due to lack of contextualization
Solution Approach 1:
The system segments the risk assessment process into multiple independent scoring components: CVSS base score, exploitability measurement, bad actor link measurement, and criticality score. Each component evaluates a specific aspect of vulnerability risk independently, then combines them to produce a comprehensive contextualized risk score, improving measurement precision without overwhelming system complexity
Solution Approach 2:
The patent introduces intermediary measurement components between basic vulnerability detection and final risk assessment. These intermediaries (exploitability measurement, bad actor link measurement) act as mediators that contextualize raw vulnerability data, transforming simple vulnerability counts into nuanced risk assessments with improved accuracy
2Reliability
If comprehensive risk factors are analyzed, then risk assessment quality improves, but processing time increases
Solution Approach 1:
The system performs preliminary actions by pre-calculating and storing individual risk components (CVSS scores, exploitability measurements, bad actor link measurements) as they become available. This allows the comprehensive contextualized risk score to be assembled quickly when needed, maintaining high assessment quality while reducing processing time through advance preparation
Solution Approach 2:
The patent implements partial action by allowing the system to function with incomplete risk data. If some measurement components are unavailable, the system can still produce a risk assessment using the available components, though with reduced precision. This enables faster processing when full analysis is unnecessary while maintaining quality when complete data is available
3Measurement precision
If multiple vulnerability metrics are calculated, then risk quantification precision improves, but computational resources increase
Solution Approach 1:
The computational workload is segmented into distinct calculation tasks for each risk component (CVSS scoring, exploitability analysis, bad actor link detection, criticality assessment). This segmentation allows the system to allocate computational resources efficiently, performing each calculation independently and only when relevant data is available, improving precision while managing resource consumption
Solution Approach 2:
The system dynamically adjusts the level of computational analysis based on parameter changes in the environment. When new vulnerability data, exploit information, or threat intelligence becomes available, the system recalculates relevant components. This parameter-driven approach ensures high precision when needed while conserving computational resources during stable periods
Data Source
AI summary
A method includes scanning a plurality of hosts in a computer network to obtain, during a predetermined time period, risk information of each instance of vulnerability associated with at least one host of the plurality of hosts, wherein the risk information comprises a common vulnerability scoring system (CVSS) score, an exploitability measurement and a measurement parameter of identified link to one or more bad actors associated with the at least one host, calculating, for the at least one host, a vulnerability risk score (VRS) for each instance of the vulnerability of the at least one host based on the associated risk information, obtaining a representative VRS based at least in part on the VRS for each instance of vulnerability of the at least one host, and facilitating at least one security action based on the representative VRS.