System and method for extracting information from binary files for vulnerability database queries

A system for automatically identifying and extracting vulnerability information from binary files, the system comprising:

• a data store configured for receiving an input binary file having a filename;
• a processor configured for:
• extracting the filename and character string information from the input binary file into one or more separate data locations;
• defining search parameters to include the filename and an associated software version as a name-version pair;
• applying the defined search parameters to the extracted character string information in the one or more separate data locations to detect an instance of the name-version pair;
• if a match of the filename is found in the extracted information, then querying a vulnerability database of standards-based vulnerability management data based on the extracted name-version pair to identify a vulnerability in the input binary file;
• and
• if a match of the name-version pair is not detected, then:
• adding the name-version pair to a candidate set comprising multiple different software names and potential versions found in the input binary file;
• for a plurality of the name-version pairs in the candidate set, querying the vulnerability database for the software name;
• if any software names are found in the vulnerability database, then searching for a match on the associated software version;
• wherein if each software version query results in no match, then constructing a relaxed query by modifying the extracted character string information and performing a revised query;
• and
• returning a result set comprising vulnerability information for the input binary file.

A non-transitory computer readable media comprising executable instructions for automatically identifying and extracting vulnerability information from binary files, the instructions for:

• processing an input binary file having a filename;
• extracting the filename and character string information from the input binary file into one or more separate data locations;
• defining search parameters to include the filename and an associated software version as a name-version pair;
• applying the defined search parameters to the extracted character string information in the one or more separate data locations to detect an instance of the name-version pair;
• if a match of the filename is found in the extracted information, then querying a vulnerability database of standards-based vulnerability management data based on the extracted name-version pair to identify a vulnerability in the input binary file;
• and
• if a match of the name-version pair is not detected, then:
• adding the name-version pair to a candidate set comprising multiple different software names and potential versions found in the input binary file;
• for a plurality of the name-version pairs in the candidate set, querying the vulnerability database for the software name;
• if any software names are found in the vulnerability database, then searching for a match on the associated software version;
• wherein if each software version query results in no match, then constructing a relaxed query by modifying the extracted character string information and performing a revised query;
• and
• returning a result set comprising vulnerability information for the input binary file.