Vulnerability Assessment via Metadata Inference

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Conventional vulnerability scanning methods are resource-intensive, time-consuming, and leave devices vulnerable to attacks, as they require significant computational and network resources and rely on pre-defined signature patterns that can't detect zero-day vulnerabilities until they are publicly known.

Innovation Solution

A vulnerability assessment system using machine inference that processes metadata from client devices to determine vulnerabilities without scanning, employing query generation and pattern matching logic refined by machine learning to correlate metadata with vulnerability data, enabling detection of zero-day vulnerabilities and reducing computational footprint.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If vulnerability scanning is performed using conventional methods, then known vulnerabilities can be detected through signature matching, but the process consumes significant computational and network resources and takes a long time to complete

Engineering Contradiction:

Improvevulnerability detection accuracyVSAvoidscanning speed

Core Design Contradiction:

ReliabilityVSProductivity

Solution Approach 1:

Instead of scanning devices to detect vulnerabilities, the patent inverts the approach by having devices report their metadata (software inventory, configurations, patch levels) to a server that then determines vulnerabilities by comparing against known vulnerability databases. This reverses the traditional scanning paradigm, enabling rapid assessment without resource-intensive scanning operations.

Inventive Principle:

Principle #13The other way round (Inversion)

Solution Approach 2:

The patent replaces the mechanical scanning process (active probing and response analysis) with an information-based system where devices passively provide metadata that is then processed through machine learning models and vulnerability databases. This substitution eliminates the need for active scanning operations while maintaining detection capability.

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

2Reliability

If vulnerability scanning is performed using conventional methods, then signature-based detection can identify known vulnerabilities, but the process leaves computing devices vulnerable to recently discovered attacks during the scanning period

Engineering Contradiction:

Improvedetection of known vulnerabilitiesVSAvoidexposure time to attacks

Core Design Contradiction:

ReliabilityVSLoss of time

Solution Approach 1:

The system performs preliminary vulnerability assessment by continuously collecting and analyzing metadata without requiring active scanning. This allows vulnerability detection to occur before attacks can exploit weaknesses, and the continuous nature of metadata collection ensures up-to-date vulnerability information is always available, eliminating the vulnerability window during scanning.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The patent implements continuous vulnerability assessment through ongoing metadata collection and analysis, rather than periodic scanning. This continuous operation ensures that vulnerability detection is always current, eliminating gaps where devices would be vulnerable to newly discovered attacks between scanning cycles.

Inventive Principle:

Principle #20Continuity of useful action

3Reliability

If vulnerability scanning is performed on multiple computing devices in an enterprise, then comprehensive vulnerability coverage can be achieved, but the process becomes prohibitively time-consuming and resource-intensive

Engineering Contradiction:

Improveenterprise-wide vulnerability coverageVSAvoidtotal scanning duration

Core Design Contradiction:

ReliabilityVSLoss of time

Solution Approach 1:

The patent segments the vulnerability assessment process into two independent components: (1) devices independently reporting their metadata, and (2) a centralized server performing vulnerability determination. This segmentation allows parallel processing across multiple devices without sequential scanning delays, enabling enterprise-wide coverage to be achieved simultaneously rather than sequentially.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The vulnerability determination server performs multiple functions simultaneously: receiving metadata from numerous devices, processing through machine learning models, querying vulnerability databases, and generating assessments. This multi-functional approach consolidates what would otherwise require separate scanning operations for each device into a single unified process that scales efficiently to enterprise levels.

Inventive Principle:

Principle #6Universality (Multi-functionality)

Data Source

PatentUS11250137B2Vulnerability assessment based on machine inference

Publication Date: 2022.02.15 CISCO TECHNOLOGY INC

AI summary

Techniques related to vulnerability assessment based on machine inference are disclosed. A vulnerability assessment server may receive, from a client device, a set of metadata corresponding to a program stored on the client device. Further, the vulnerability assessment server may extract a program name from the set of metadata. Still further, the vulnerability assessment server may determine one or more vulnerabilities of the program based on searching for the program name in one or more storage systems that maintain sets of vulnerability data.