Predicting false positives from vulnerability scanners using data analytics and machine learning

A system for remediating a vulnerability in a first computing resource asset in a computer network, the system comprising:

• a receiver arranged to receive vulnerability scanning results data from each respective one of a plurality of diverse vulnerability scanners, each vulnerability scanner being arranged to scan a different type of computer resource asset in the computer network;
• a storage arranged store the received vulnerability scanning results data from each one of the plurality of diverse vulnerability scanners as a collection of vulnerability scanning results data;
• a normalizer arranged to normalize the collection of vulnerability scanning results data into normalized data;
• a feature extractor arranged to extract common features from the normalized data;
• a vectorizer arranged to vectorize the common features to determine feature vectors;
• a false positive determiner arranged to apply a false positive predictor model to predict a false positive vulnerability in the collection of vulnerability scanning results data;
• a vulnerability remediator arranged to separate vulnerability scanning results data that corresponds to one or more predicted false positives from a remainder of the collection of vulnerability scanning result data;
• and
• a transmitter arranged to send the remainder of the collection of vulnerability scanning results data to a second computer resource asset.

A non-transitory computer readable storage medium storing computer program instructions that, when executed by a security appliance, remediate a vulnerability in a first computing resource asset in a computer network, the computer program instructions comprising the steps of:

• receiving vulnerability scanning results data from each respective one of a plurality of diverse vulnerability scanners, each vulnerability scanner being arranged to scan a different type of computer resource asset in the computer network;
• storing the received vulnerability scanning results data from each one of the plurality of diverse vulnerability scanners as a collection of vulnerability scanning results data;
• parsing data from the collection of vulnerability scanning results data;
• normalizing the parsed data;
• extracting common features from the normalized data;
• vectorizing the common features to determine feature vectors;
• applying a false positive predictor model to predict a false positive vulnerability in the collection of vulnerability scanning results data;
• separating vulnerability scanning results data that corresponds to one or more predicted false positives from a remainder of the collection of vulnerability scanning result data;
• and
• sending the remainder of the collection of vulnerability scanning results data to a second computer resource asset.