Unexploited Vulnerability Risk Prediction with One-Class Machine Learning
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current cybersecurity systems lack a mechanism to assess the likelihood that unexploited vulnerabilities in computing devices will be exploited, as existing machine learning techniques are not applicable to one-class data where no publicly known exploits exist.
Innovation Solution
A machine learning model, such as a one-class support vector machine, is trained using attributes of known exploited vulnerabilities to predict the probability of an unexploited vulnerability being exploited, enabling proactive deployment of fixes based on predicted risk.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional machine learning techniques are used for vulnerability assessment, then the system can classify vulnerabilities with known exploit data, but it cannot assess unexploited vulnerabilities where no public exploit information exists
Solution Approach 1:
Instead of training the machine learning model to identify characteristics of exploited vulnerabilities, the patent inverts the approach by training it to identify characteristics of non-exploited vulnerabilities. The model learns what makes vulnerabilities unlikely to be exploited, and then identifies deviations from this pattern, enabling assessment of unexploited vulnerabilities without requiring exploit data.
Solution Approach 2:
The patent introduces an intermediary feature engineering layer that transforms raw vulnerability attributes into features suitable for one-class classification. This intermediary representation allows the machine learning model to work effectively with single-class data by creating a feature space where unexploited vulnerabilities can be meaningfully assessed without direct exploit examples.
2Reliability
If all identified vulnerabilities are patched immediately, then security coverage is maximized, but resource consumption and system downtime increase significantly
Solution Approach 1:
The patent applies local quality by assigning different priority levels to different vulnerabilities based on their exploitation likelihood scores. Instead of uniform patching, the system identifies and prioritizes specific high-risk vulnerabilities for immediate patching while allowing lower-risk vulnerabilities to be addressed later, optimizing resource allocation to where it is most needed.
Solution Approach 2:
The system performs preliminary assessment and scoring of vulnerabilities before patching decisions are made. By pre-calculating exploitation likelihood scores and prioritizing vulnerabilities in advance, the system enables planned patching campaigns that reduce emergency responses, minimize downtime, and optimize resource usage during the actual patching process.
3Measurement precision
If comprehensive vulnerability scanning is performed across all devices, then all vulnerabilities are detected, but the time and computational resources required increase substantially
Solution Approach 1:
The patent applies partial action by performing comprehensive vulnerability scanning only on high-priority systems or at intervals, while using the machine learning model to assess and monitor lower-priority systems with reduced scanning frequency. The model compensates for incomplete scanning data by predicting exploitation likelihood based on available information, maintaining effective security coverage without requiring exhaustive scanning of all devices continuously.
Data Source
AI summary
A server determines vulnerabilities associated with components of a computing device. The server determines attributes associated with individual vulnerabilities. The server determines a subset of the vulnerabilities that includes unexploited vulnerabilities. The server executes a machine learning model to predict a probability of an exploit being created for a particular unexploited vulnerability in the subset. The server sends to a device: information identifying the particular unexploited vulnerability, particular attributes associated with the particular unexploited vulnerability, and the probability of an exploit being created for the particular unexploited vulnerability.