# US 11,113,405 B2 · Vulnerability assessment > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,113,405 B2 - Document ID: US11113405B2 - Status: Granted - Kind: B2 - Application number: 15/949,403 - Filed: 2018-04-10 - Published: 2019-10-10 - Granted: 2021-09-07 - Earliest claimed: 2018-04-10 - Assignees: Rapid7, Inc. - Applicants: Rapid7, Inc. - Inventors: Roy Hodgman; Jonathan Hart - Web page: https://patentgrep.com/patent/US11113405B2 ## CPC - G06F 21/577: {Assessing vulnerabilities and evaluating computer system security} - H04L 63/08: {for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32)} - H04L 63/1433: {Vulnerability analysis} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Methods and systems for assessing a vulnerability of a network device. The systems and methods described herein combine data regarding locally discovered vulnerabilities and exposed services with data regarding what executables are provided by software installed on the network device. ## Claims ### Claim 1 A method for assessing a vulnerability of a network device, the method comprising: receiving a list of one or more services externally exposed on the network device, including receiving at least one of a port and a protocol associated with each of the one or more externally exposed services; receiving an indication of at least one vulnerability in at least one software package installed on the network device, wherein contents of the vulnerability indication include a list of services provided by the software package and a list of ports or protocols to which each of the services provided by the software package are bound; determining that a process is provided by the software package with the at least one vulnerability; determining whether an externally exposed service of the one or more services externally exposed is associated with the process that is provided by the software package with the at least one vulnerability by matching at least some of the ports or protocols in the contents of the vulnerability indication to the port or protocol associated with the externally exposed service; and executing at least one remedial action upon determining that the externally exposed service is associated with the process that is provided by the software package with the at least one vulnerability. ### Claim 2 (depends on 1) The method of claim 1 further comprising using authentication credentials to connect to a service on the network device. ### Claim 3 (depends on 1) The method of claim 1 wherein executing the at least one remedial action includes elevating the software package for further examination. ### Claim 4 (depends on 1) The method of claim 1 wherein executing the at least one remedial action includes issuing an alert. ### Claim 5 A system for assessing a vulnerability of a network device, the system comprising: an interface configured to receive at least: a list of one or more services externally exposed on the network device, including data regarding at least one of a port and a protocol associated with each of the one or more externally exposed services, and an indication of at least one vulnerability in at least one software package installed on the network device, wherein contents of the vulnerability indication include a list of services provided by a software package and a list of ports or protocols to which each of the services provided by the software package are bound; a memory; and a vulnerability assessment module configured to execute instructions stored on the memory to: determine that a process is provided by the software package with the at least one vulnerability, determine whether an externally exposed service of the one or more services externally exposed is associated with the process that is provided by the software package with the at least one vulnerability by matching at least some of the ports or protocols in the contents of the vulnerability indication to the port or protocol associated with the externally exposed service, and execute at least one remedial action upon determining that the externally exposed service is associated with the process that is provided by the software package with the at least one vulnerability. ### Claim 6 (depends on 5) The system of claim 5 wherein the vulnerability assessment module is further configured to use authentication credentials to connect to a service on the network device. ### Claim 7 (depends on 5) The system of claim 5 wherein the at least one remedial action includes elevating the software package for further examination. ### Claim 8 (depends on 5) The system of claim 5 wherein the at least one remedial action includes issuing an alert via the interface. ### Claim 9 A non-transitory computer readable storage medium containing computer-executable instructions for a method for assessing a vulnerability of a network device, the medium comprising: computer-executable instructions for receiving a list of one or more services externally exposed on the network device, including computer-executable instructions for receiving at least one of a port and a protocol associated with one or more externally exposed services; computer-executable instructions for receiving an indication of at least one vulnerability in at least one software package installed on the network device, wherein contents of the vulnerability indication include a list of services provided by a software package and a list of ports to which each of the services provided by the software packages are bound; computer-executable instructions for determining that a process is provided by the software package with the at least one vulnerability; computer-executable instructions for determining whether an externally exposed service of the one or more services externally exposed is associated with the process that is provided by the software package with the at least one vulnerability by matching at least some of the ports or protocols in the contents of the vulnerability indication to the port or protocol associated with the externally exposed service; and computer-executable instructions for executing at least one remedial action upon determining that the externally exposed service is associated with the process that is provided by the software package with the at least one vulnerability.