Network Vulnerability Scoring With Exponential Threat Tapering
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing vulnerability assessment systems fail to effectively evaluate the risk posed by a collection of vulnerabilities in a data communication network, particularly in container-based applications, where numerous vulnerabilities can be identified, and the Common Vulnerability Scoring System (CVSS) does not adequately address this collective risk.
Innovation Solution
A system and method that includes scanning a private network to identify devices, determining individual vulnerability scores using CVSS, applying exponential tapering functions to curb the influence of large numbers of low-priority threats, and taking security actions based on a calculated collection score, which prioritizes preventative measures for higher scores.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If individual vulnerability scores are calculated for each vulnerability in a collection, then the severity characterization of each vulnerability is improved, but the overall risk evaluation of the collection becomes overly influenced by large numbers of low-priority threats
Solution Approach 1:
The patent extracts the influence of individual vulnerability scores from the direct summation process and applies an exponential tapering function to selectively reduce the weight of low-priority threats. This separates the precise measurement of individual vulnerabilities from their aggregate impact on collection risk, resolving the contradiction between measurement precision and evaluation complexity.
Solution Approach 2:
The patent transforms the linear aggregation of vulnerability scores into a non-linear aggregation using exponential tapering. By changing the aggregation parameter from simple summation to exponential weighting, the system maintains precise individual score calculation while controlling the overall collection risk evaluation from being overwhelmed by numerous low-priority vulnerabilities.
2Reliability
If all vulnerabilities in a collection are treated equally in risk evaluation, then comprehensive coverage is achieved, but the influence of low-priority threats overwhelms high-priority threats
Solution Approach 1:
The patent applies different weighting qualities to different vulnerabilities within the collection based on their individual CVSS scores. High-priority threats retain full influence while low-priority threats have their influence exponentially reduced. This local differentiation in treatment quality ensures comprehensive coverage while preventing distortion of risk priority.
Solution Approach 2:
The patent applies partial action by selectively emphasizing high-priority vulnerabilities rather than treating all vulnerabilities equally. The exponential tapering function provides excessive reduction to low-priority threats, ensuring they do not overwhelm the evaluation, while maintaining appropriate weight for high-priority threats.
3Measurement precision
If the number of vulnerabilities in a container image increases, then the comprehensiveness of security assessment is improved, but the computational burden and false alarm rate increase
Solution Approach 1:
The patent extracts the computational burden of evaluating large numbers of low-priority vulnerabilities by applying exponential tapering that effectively reduces their weight to near-zero. This separation allows comprehensive assessment to be maintained for high-priority vulnerabilities while the computational burden of low-priority ones is dramatically reduced.
Solution Approach 2:
The patent changes the aggregation parameter from linear summation to exponential tapering, which fundamentally alters how the number of vulnerabilities impacts the assessment. This parameter change ensures that as the number of vulnerabilities increases, the computational burden and false alarm rate do not increase proportionally, maintaining assessment efficiency.
Data Source
AI summary
A private network is scanned to identify devices, and profiling identified devices for vulnerabilities. A score is determined from a Common Vulnerability Scoring System (CVSS) database for each vulnerability individually that characterizes severity. A score is determined for a collection of vulnerabilities. Exponential tapering functions curb an influence of large numbers of low priority threats on the collection score. The collection threat score increases with severity of the collection of vulnerabilities.