# US 10,503,908 B1 · Vulnerability assessment based on machine inference > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,503,908 B1 - Document ID: US10503908B1 - Status: Granted - Kind: B1 - Application number: 15/478,925 - Filed: 2017-04-04 - Granted: 2019-12-10 - Earliest claimed: 2017-04-04 - Assignees: Kenna Security, Inc. - Applicants: Kenna Security, Inc. - Inventors: Edward T. Bellis; Michael Roytman; David Bortz; Jared Davis - Web page: https://patentgrep.com/patent/US10503908B1 ## CPC - G06F 21/577: {Assessing vulnerabilities and evaluating computer system security} - G06F 16/9032: Query formulation - G06F 16/90335: {Query processing} - G06F 21/552: {involving long-term monitoring or reporting} - G06N 20/00: Machine learning - G06F 2221/033: Test or assess software - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS ## Abstract Techniques related to vulnerability assessment based on machine inference are disclosed. A vulnerability assessment server may receive, from a client device, a set of metadata corresponding to a program stored on the client device. Further, the vulnerability assessment server may extract a program name from the set of metadata. Still further, the vulnerability assessment server may determine one or more vulnerabilities of the program based on searching for the program name in one or more storage systems that maintain sets of vulnerability data. ## Claims ### Claim 1 A vulnerability assessment method comprising: receiving, from a client device, at a vulnerability assessment server, a set of metadata corresponding to a program stored on the client device; extracting, at the vulnerability assessment server, at least a program name and a vendor name from the set of metadata corresponding to the program; performing a search, in one or more storage systems that maintain sets of unstructured vulnerability data, for a set of unstructured vulnerability data corresponding to the program, wherein performing the search comprises: determining a set of query tokens that includes the program name; modifying, based on machine learning, the set of query tokens; generating a query that includes the modified set of query tokens; executing the query to identify the set of unstructured vulnerability data corresponding to the program; searching the one or more storage systems for a standardized program identifier that includes the program name; correlating the standardized program identifier to the set of unstructured vulnerability data corresponding to the program; identifying, at the vulnerability assessment server, one or more vulnerabilities of the program based on the set of unstructured vulnerability data corresponding to the program, wherein the method is performed by one or more computing devices. ### Claim 2 (depends on 1) The vulnerability assessment method of claim 1, further comprising: providing the client device with an update that prevents exploitation of the one or more vulnerabilities. ### Claim 3 (depends on 1) The vulnerability assessment method of claim 1, wherein the set of metadata is received from a third-party agent that executes on the client device to collect sets of metadata corresponding to a plurality of programs stored on the client device. ### Claim 4 (depends on 1) The vulnerability assessment method of claim 1, wherein the one or more storage systems maintains a mapping between the program name and the standardized program identifier. ### Claim 5 (depends on 1) The vulnerability assessment method of claim 1, wherein the set of unstructured vulnerability data corresponding to the program includes a token corresponding to the program name. ### Claim 6 (depends on 5) The vulnerability assessment method of claim 5, wherein the one or more storage systems maintains a mapping between the program name and the set of unstructured vulnerability data corresponding to the program. ### Claim 7 (depends on 1) The vulnerability assessment method of claim 1, wherein executing the query comprises comparing the set of query tokens to tokens of the sets of unstructured vulnerability data by: storing the tokens of the sets of unstructured vulnerability data in a set of vectors; storing the set of query tokens in a query vector; comparing the query vector to a vector of the set of vectors to determine whether the vector corresponds to the program. ### Claim 8 (depends on 7) The vulnerability assessment method of claim 7, wherein the vector is determined to correspond to the program based on computing a distance between the vector and the query vector. ### Claim 9 A vulnerability assessment server system comprising: one or more processors; and one or more non-transitory storage media storing instructions which, when executed by the one or more processors, cause: receiving, at a vulnerability assessment server from a client device, a set of metadata corresponding to a program stored on the client device; extracting, at the vulnerability assessment server, at least a program name and a vendor name from the set of metadata corresponding to the program; determining, at the vulnerability assessment server, one or more vulnerabilities of the program based on searching, in one or more storage systems that maintain sets of unstructured vulnerability data, for a set of unstructured vulnerability data corresponding to the program, wherein searching comprises: determining a set of query tokens that includes the program name; modifying, based on machine learning, the set of query tokens; generating a query that includes the modified set of query tokens; executing the query to identify the set of unstructured vulnerability data corresponding to the program; searching the one or more storage systems for a standardized program identifier that includes the program name; correlating the standardized program identifier to the set of unstructured vulnerability data corresponding to the program. ### Claim 10 (depends on 9) The vulnerability assessment server system of claim 9, wherein the instructions, when executed by the one or more processors, further cause: providing the client device with an update that prevents exploitation of the one or more vulnerabilities. ### Claim 11 (depends on 9) The vulnerability assessment server system of claim 9, wherein the set of metadata is received from a third-party agent that executes on the client device to collect sets of metadata corresponding to a plurality of programs stored on the client device. ### Claim 12 (depends on 9) The vulnerability assessment server system of claim 9, wherein the one or more storage systems maintains a mapping between the program name and the standardized program identifier. ### Claim 13 (depends on 9) The vulnerability assessment server system of claim 9, wherein the set of unstructured vulnerability data corresponding to the program includes a token corresponding to the program name. ### Claim 14 (depends on 13) The vulnerability assessment server system of claim 13, wherein the one or more storage systems maintains a mapping between the program name and the set of unstructured vulnerability data corresponding to the program. ### Claim 15 (depends on 9) The vulnerability assessment server system of claim 9, wherein executing the query comprises comparing the set of query tokens to tokens of the sets of unstructured vulnerability data by: storing the tokens of the sets of unstructured vulnerability data in a set of vectors; storing the set of query tokens in a query vector; comparing the query vector to a vector of the set of vectors to determine whether the vector corresponds to the program. ### Claim 16 (depends on 15) The vulnerability assessment server system of claim 15, wherein the vector is determined to correspond to the program based on computing a distance between the vector and the query vector. ### Claim 17 (depends on 1) The vulnerability assessment method of claim 1, wherein the set of query tokens are a set of weighted tokens, and wherein machine learning is used to determine a weighting for a query token in the set of query tokens. ### Claim 18 (depends on 9) The vulnerability assessment server system of claim 9, wherein the set of query tokens are a set of weighted tokens, and wherein machine learning is used to determine a weighting for a query token in the set of query tokens. ### Claim 19 (depends on 1) The vulnerability assessment method of claim 1, wherein the sets of unstructured vulnerability data include one or more tokens that are not included in the set of query tokens. ### Claim 20 (depends on 9) The vulnerability assessment server system of claim 9, wherein the sets of unstructured vulnerability data include one or more tokens that are not included in the set of query tokens.