Vulnerability Report Deduplication via Search Engine Similarity Scoring
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Manual evaluation of vulnerability reports from multiple testers is inefficient and impractical, as it requires comparing reports for duplicates, which can be challenging due to varying language and content, especially in large-scale computer system security testing.
Innovation Solution
A vulnerability database management system that uses a search engine to generate similarity scores for candidate reports against existing records, allowing for automated filtering and acceptance or rejection of duplicate reports, with adjustable threshold criteria for operator review.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If manual evaluation of vulnerability reports is performed, then accuracy in identifying duplicates is maintained, but time consumption and labor requirements increase significantly
Solution Approach 1:
The patent replaces manual mechanical evaluation of vulnerability reports with an automated computer-based system. The search engine automatically queries the vulnerability database using transformed candidate reports, and the similarity scoring algorithm automatically compares reports to identify duplicates, eliminating the need for manual human evaluation while maintaining accuracy.
Solution Approach 2:
The patent introduces a search engine as an intermediary between the candidate vulnerability reports and the vulnerability database. This intermediary system automatically handles the comparison process by transforming reports into search queries, executing searches, and using similarity scoring algorithms to identify duplicates, thereby reducing manual labor and time requirements.
2Reliability
If manual comparison of vulnerability reports is performed, then reliability of duplicate detection is maintained, but operational complexity and difficulty increase
Solution Approach 1:
The patent implements a self-service system where the search engine automatically performs duplicate detection without requiring manual intervention. The system transforms candidate reports into search queries, executes searches against the vulnerability database, and uses similarity scoring algorithms to automatically identify and filter duplicates, making the process operationally simple and reliable.
Solution Approach 2:
The patent changes the parameters of the evaluation process by introducing automated similarity scoring algorithms that objectively measure the similarity between reports. This transforms the subjective manual comparison process into an objective automated parameter-based evaluation, improving both reliability and ease of operation.
3Productivity
If automated search engine is used to filter duplicates, then processing speed and efficiency improve, but complexity of the system increases
Solution Approach 1:
The patent segments the vulnerability report processing system into distinct functional modules: a search engine component that handles querying, a similarity scoring algorithm that handles comparison, and a filtering mechanism that handles duplicate identification. This segmentation allows each component to be optimized independently while working together to improve overall processing efficiency.
Solution Approach 2:
The patent performs preliminary actions by pre-processing vulnerability reports into a standardized format that can be queried by the search engine. The system transforms candidate reports into search queries in advance, enabling efficient automated comparison against the vulnerability database and improving processing speed without requiring complex real-time analysis.
4Measurement precision
If strict duplicate filtering is applied, then quality of vulnerability reports improves, but number of valid reports that may be rejected increases
Solution Approach 1:
The patent implements dynamic filtering by using adjustable similarity thresholds that can be configured based on the specific needs of the vulnerability assessment. The system can adapt the strictness of duplicate filtering dynamically, allowing operators to balance between report quality and the number of valid reports accepted, rather than applying a fixed rigid threshold.
Data Source
AI summary
A vulnerability report evaluation system comprises a preprocessor that takes as its input a data record representing a vulnerability report and outputs a search record. The vulnerability report evaluation system further comprises a search engine and a searchable corpus comprising records of vulnerabilities, wherein the search engine is configured to use the outputted search record to search the corpus. The vulnerability report evaluation system can flag search result hits resulting from the searched search record as an indication that the submitted vulnerability report is a duplicate of an earlier vulnerability report or as a flag to trigger manual review, while providing efficient processing of vulnerability report data records.