Software Vulnerability Mapping Using CPE Equivalence Classification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing vulnerability assessment systems face challenges in effectively mapping non-standardized software library names to known vulnerabilities due to differing naming conventions and definitions, leading to inefficient use of databases like the National Vulnerability Database (NVD).
Innovation Solution
Implementing machine learning-based text-classifiers to process and standardize software library names using techniques such as word boundary detection, canonicalization, stemming, and weight assignment, followed by equivalence mapping to Common Platform Enumeration (CPE) definitions for automated vulnerability identification.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If vulnerability assessment systems use NVD database with standardized CPE definitions, then vulnerability identification completeness is improved, but mapping accuracy deteriorates due to naming convention mismatches between library identifiers and CPE definitions
Solution Approach 1:
The patent introduces an intermediary mapping layer that translates between different naming conventions. A machine learning-based text classifier acts as a mediator to convert library identifiers (from various naming conventions) into standardized CPE definitions, enabling accurate mapping between non-standardized library names and standardized vulnerability database entries
Solution Approach 2:
The system changes the parameter of name standardization by applying text classification techniques (word boundary detection, canonicalization, stemming, weight assignment) to transform varying library identifier formats into a unified representation that matches CPE definitions, resolving the mismatch between different naming conventions
2Measurement precision
If manual mapping of library names to CPE definitions is performed, then mapping accuracy is improved, but assessment time increases significantly
Solution Approach 1:
The system enables automated self-service mapping by implementing a machine learning text classifier that automatically translates library identifiers to CPE definitions without human intervention. The classifier is trained on mapping examples and can independently perform the translation task, eliminating the need for manual mapping while maintaining accuracy
Solution Approach 2:
The patent replaces the mechanical manual mapping process with an automated machine learning-based text classification system. The mechanical process of manually comparing and mapping names is substituted with computational text processing techniques including word boundary detection, canonicalization, stemming, and weight assignment algorithms
3Measurement precision
If text classification techniques are applied to standardize library names, then mapping precision is improved, but system complexity increases
Solution Approach 1:
The patent segments the text classification process into distinct operational steps: word boundary detection, canonicalization, stemming, and weight assignment. This segmentation allows each component to handle a specific aspect of name standardization independently, making the overall complex system more manageable and easier to implement
Solution Approach 2:
The system performs preliminary text processing actions (word boundary detection, canonicalization, stemming) before the actual mapping decision. These preliminary actions prepare the library identifier data in advance by normalizing it according to CPE conventions, enabling more accurate mapping with simpler subsequent processing
Data Source
Figure 1A
Figure 1B
Figure 2
AI summary
Systems, methods, and computer-readable for identifying known vulnerabilities in a software product include determining a set of one or more processed words based on applying text classification to one or more names associated with a product, where the text classification is based on analyzing a database of names associated with a database of products. Similarity scores are determined between the set of one or more processed words and names associated with one or more known vulnerabilities maintained in a database of known vulnerabilities in products. Equivalence mapping is performed between the one or more names associated with the product and the one or more known vulnerabilities, based on the similarity scores. Known vulnerabilities in the product are identified based on the equivalence mapping.