Network Vulnerability Correlation Using Traffic Interactions
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network vulnerability assessment systems fail to consider the prevalence of network security threats when assigning standardized CVSS scores, leading to inaccuracies in evaluating the severity of vulnerabilities based on specific network characteristics.
Innovation Solution
A method and system that incorporates first network information describing vulnerabilities and second network information on traffic interactions to determine network security issues, correlating these to generate a more accurate vulnerability assessment score and alert.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If standardized CVSS scoring methods are used for network vulnerability assessment, then the assessment process is simple and consistent, but the evaluation accuracy does not reflect specific network characteristics and threat prevalence
Solution Approach 1:
The patent combines standardized CVSS scoring with custom network-specific factors including network traffic analysis, threat prevalence data, and organizational context. This merging allows the system to maintain the consistency of standardized scoring while layering additional dimensions of accuracy through correlated network information and interaction patterns.
Solution Approach 2:
The patent introduces an intermediary correlation layer that sits between raw vulnerability data and final severity assessment. This intermediary process analyzes network traffic, identifies interactions, and correlates findings with vulnerability data to produce adjusted severity scores that reflect actual network context without replacing the underlying standardized scoring system.
2Measurement precision
If network traffic analysis and interaction correlation are added to vulnerability assessment, then the evaluation accuracy improves, but the assessment time and computational resources increase
Solution Approach 1:
The patent performs preliminary network scanning and traffic baseline establishment before vulnerability assessment occurs. By pre-collecting network topology information, traffic patterns, and interaction data, the system reduces the time required during actual vulnerability assessment since the correlation layer can work with pre-processed data rather than gathering everything in real-time.
Solution Approach 2:
The patent implements selective correlation where not all vulnerabilities require full network traffic analysis. The system identifies high-risk vulnerabilities that warrant detailed correlation while applying lighter assessment to lower-risk findings, thus achieving improved accuracy for critical issues without proportionally increasing assessment time across the entire vulnerability set.
Data Source
AI summary
A method may include obtaining first network information from a network scan of a computer network that describes network vulnerabilities of a computer network and second network information that describes network traffic of the computer network. The method may include identifying an interaction with the computer network based on the network traffic included in the second network information. The method may include correlating the first network information and the identified interaction to determine a network security issue for the computer network. Correlating the first network information and the identified interaction may include determining a correspondence between the interaction with the computer network and the network vulnerabilities described by the first network information. A network alert may be generated based on the potential network security issue.