Vulnerability Correlation Engine Using CWE and CVE Identifiers

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Current network security systems face challenges in reconciling vulnerability data from multiple independent assessment technologies, leading to incomplete or misleading risk assessments due to limited automated data reconciliation capabilities.

Innovation Solution

A method that correlates Static Application Security Testing (SAST) assessments with network vulnerability scans using Common Weakness Enumeration (CWE-ID) and Common Vulnerabilities and Exposures (CVE-ID) identifiers, and instruments software applications to log vulnerability locations, enabling precise matching of SAST and network vulnerabilities.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Adaptability or versatility

If multiple independent vulnerability assessment technologies are employed, then vulnerability assessment coverage is improved, but data reconciliation capability deteriorates

Engineering Contradiction:

Improvevulnerability assessment coverageVSAvoiddata reconciliation capability

Core Design Contradiction:

Adaptability or versatilityVSDevice complexity

Solution Approach 1:

The patent introduces a reconciliation engine as an intermediary component that receives vulnerability data from multiple independent assessment technologies (network vulnerability scanner, SAST tool, container vulnerability scanner) and correlates them using standardized identifiers (CVE-ID, CWE-ID). This mediator translates and harmonizes data from different sources into a unified vulnerability assessment, resolving the contradiction between comprehensive coverage and reconciliation capability.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Measurement precision

If multiple independent vulnerability assessment technologies are employed, then vulnerability detection accuracy is improved, but system complexity increases

Engineering Contradiction:

Improvevulnerability detection accuracyVSAvoidsystem complexity

Core Design Contradiction:

Measurement precisionVSDevice complexity

Solution Approach 1:

The reconciliation engine is designed as a universal system that can process and correlate vulnerability data from multiple different assessment technologies (network scanners, SAST tools, container scanners) through a common interface and standardized identifier system. This multi-functional approach enables accurate vulnerability detection across diverse sources while managing system complexity through a unified correlation framework.

Inventive Principle:

Principle #6Universality (Multi-functionality)

3Measurement precision

If automated data reconciliation intelligence is enhanced, then vulnerability matching accuracy is improved, but processing time increases

Engineering Contradiction:

Improvevulnerability matching accuracyVSAvoidprocessing time

Core Design Contradiction:

Measurement precisionVSLoss of time

Solution Approach 1:

The system performs preliminary actions by pre-processing vulnerability data from multiple sources and organizing it according to standardized identifiers (CVE-ID, CWE-ID) before the actual correlation process. The reconciliation engine prepares reference data and establishes mapping relationships in advance, which accelerates the matching process while maintaining high accuracy in vulnerability correlation.

Inventive Principle:

Principle #10Preliminary action

Data Source

PatentUS9667643B2Apparatus, system, and method for correlating security vulnerabilities from multiple independent vulnerability assessment methods

Publication Date: 2017.05.30 DIGITAL DEFENSE INC

AI summary

The present disclosure relates to methods for correlating security vulnerability assessment data from a network vulnerability assessment, a static application security test (SAST) assessment and/or a zero day vulnerability metadata source.