# US 11,308,219 B2 · System and method for multi-source vulnerability management > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,308,219 B2 - Document ID: US11308219B2 - Status: Granted - Kind: B2 - Application number: 16/516,450 - Filed: 2019-07-19 - Published: 2021-01-21 - Granted: 2022-04-19 - Earliest claimed: 2019-07-19 - Assignees: F5, Inc. - Applicants: F5, Inc. - Inventors: Lucas DuBois; Joseph Baker; Charles Hoang - Web page: https://patentgrep.com/patent/US11308219B2 ## CPC - G06F 21/577: {Assessing vulnerabilities and evaluating computer system security} - G06F 21/552: {involving long-term monitoring or reporting} - G06F 21/554: {involving event detection and direct action} - G06F 21/562: {Static detection} - G06F 21/566: {Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities} - G06F 21/568: {eliminating virus, restoring damaged files} - G06F 2221/034: Test or assess a computer or a system - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A method for multi-source cloud-infrastructure vulnerability management includes receiving cloud-element information related to a cloud-based element in a cloud environment. The method also includes receiving first vulnerability information from a first vulnerability source and receiving second vulnerability information from a second vulnerability source. Cloud-element context information is also received about the cloud-based element from the cloud environment. A multiple-source vulnerability database is then generated from both the first vulnerability information and from the second vulnerability information. The cloud-element information and the cloud-element context information are then evaluated using the multiple-source vulnerability database to generate a vulnerability assessment. ## Claims ### Claim 1 A method for multi-source cloud-infrastructure vulnerability management, the method implemented by a network traffic management system comprising one or more network traffic apparatuses, client devices, or server devices, the method comprising: receiving cloud-element data related to a cloud-based element in a cloud environment; receiving first vulnerability data from a first vulnerability source; receiving second vulnerability data from a second vulnerability source that is a vendor of a particular operating system; receiving cloud-element context data comprising the particular operating system of about the cloud-based element from the cloud environment; replacing the first vulnerability source and the second vulnerability source with a multiple-source vulnerability database generated from both the first vulnerability data and from the second vulnerability data such that a reported vulnerability from the first vulnerability source and a separate reported vulnerability from the second vulnerability source are combined into a single common vulnerability in the multiple-source vulnerability database; evaluating the cloud-element data and the cloud-element context data using the multiple-source vulnerability database to generate a vulnerability assessment related to the single common vulnerability and the particular operating system; and generating a list of remediation steps in response to the vulnerability assessment. ### Claim 2 (depends on 1) The method of multi-source cloud-infrastructure vulnerability management of claim 1 wherein the vulnerability assessment comprises a prioritized list of vulnerabilities. ### Claim 3 (depends on 1) The method of multi-source cloud-infrastructure vulnerability management of claim 1 wherein the vulnerability assessment comprises a list of vulnerabilities with associated severities. ### Claim 4 (depends on 1) The method of multi-source cloud-infrastructure vulnerability management of claim 1 wherein the vulnerability assessment comprises aggregated vulnerability key performance indicators. ### Claim 5 (depends on 1) The method of multi-source cloud-infrastructure vulnerability management of claim 1 further comprising prioritizing the list of remediation steps. ### Claim 6 (depends on 5) The method of multi-source cloud-infrastructure vulnerability management of claim 5 wherein the prioritized list of remediation steps comprises a recommended software patch. ### Claim 7 (depends on 5) The method of multi-source cloud-infrastructure vulnerability management of claim 5 wherein the prioritized list of remediation steps comprises a software removal package. ### Claim 8 (depends on 1) The method of multi-source cloud-infrastructure vulnerability management of claim 1 wherein the generating the multiple-source vulnerability database from both the first vulnerability data and from the second vulnerability data comprises processing the first and second vulnerability data to generate a common vulnerability. ### Claim 9 (depends on 1) The method of multi-source cloud-infrastructure vulnerability management of claim 1 wherein the evaluating the cloud-element data and the cloud-element context data using the multiple-source vulnerability database to generate the vulnerability assessment comprises listing vulnerabilities that are specific to the cloud-based element. ### Claim 10 (depends on 1) The method of multi-source cloud-infrastructure vulnerability management of claim 1 wherein at least one of the cloud-based elements comprises a cloud-based computer. ### Claim 11 (depends on 1) The method of multi-source cloud-infrastructure vulnerability management of claim 1 wherein at least one of the cloud-based elements comprises a cloud-based virtual machine. ### Claim 12 (depends on 1) The method of multi-source cloud-infrastructure vulnerability management of claim 1 wherein the receiving the first and/or second vulnerability data from at least one of the first and second vulnerability sources comprises receiving vulnerability data from a public vulnerability database. ### Claim 13 (depends on 1) The method of multi-source cloud-infrastructure vulnerability management of claim 1 wherein the receiving the first and/or second vulnerability data from at least one of the first and second vulnerability source comprises receiving vulnerability data from a webpage. ### Claim 14 (depends on 1) The method of multi-source cloud-infrastructure vulnerability management of claim 1 wherein the receiving the first and/or second vulnerability data from at least one of the first and second vulnerability sources comprises receiving vulnerability data from a file. ### Claim 15 (depends on 1) The method of multi-source cloud-infrastructure vulnerability management of claim 1 wherein the receiving the first and/or second vulnerability data from at least one of the first and second vulnerability source comprises receiving vulnerability data from an operating-system-specific data source. ### Claim 16 (depends on 1) The method of multi-source cloud-infrastructure vulnerability management of claim 1 wherein the cloud-element data comprises package data. ### Claim 17 (depends on 16) The method of multi-source cloud-infrastructure vulnerability management of claim 16 wherein the package data comprises package type. ### Claim 18 (depends on 16) The method of multi-source cloud-infrastructure vulnerability management of claim 16 wherein the package data comprises package version. ### Claim 19 (depends on 1) The method of multi-source cloud-infrastructure vulnerability management of claim 1 wherein the cloud-element data comprises server data. ### Claim 20 (depends on 19) The method of multi-source cloud-infrastructure vulnerability management of claim 19 wherein the server data comprises server type. ### Claim 21 (depends on 19) The method of multi-source cloud-infrastructure vulnerability management of claim 19 wherein the server data comprises data regarding server web traffic. ### Claim 22 (depends on 1) The method of multi-source cloud-infrastructure vulnerability management of claim 1 further comprising providing the vulnerability assessment to a user. ### Claim 23 A network traffic manager apparatus, comprising memory comprising programmed instructions stored in the memory and one or more processors configured to execute the programmed instructions stored in the memory to: receive cloud-element data related to a cloud-based element in a cloud environment; receive first vulnerability data from a first vulnerability source; receive second vulnerability data from a second vulnerability source that is a vendor of a particular operating system; receive cloud-element context data comprising the particular operating system of the cloud-based element from the cloud environment; replace the first vulnerability source and the second vulnerability source with a multiple-source vulnerability database generated from both the first vulnerability data and from the second vulnerability data such that a reported vulnerability from the first vulnerability source and a separate reported vulnerability from the second vulnerability source are combined into a single common vulnerability in the multiple-source vulnerability database; evaluate the cloud-element data and the cloud-element context data using the multiple-source vulnerability database to generate a vulnerability assessment related to the single common vulnerability and the particular operating system; and generate a list of remediation steps in response to the vulnerability assessment. ### Claim 24 (depends on 23) The apparatus of claim 23 wherein the one or more processors are further configured to execute the programmed instructions stored in the memory to receive first vulnerability data from the first vulnerability source and that receives second vulnerability data from the second vulnerability source comprise the same processor. ### Claim 25 (depends on 23) The apparatus of claim 23 wherein the one or more processors are further configured to execute the programmed instructions stored in the memory to evaluate the cloud-element data and the cloud-element context data comprise the same processor. ### Claim 26 (depends on 23) The apparatus of claim 23 further comprising the first and second vulnerability source.