US 11,507,672 B1Granted

Runtime filtering of computer system vulnerabilities

AssigneeSysdig, Inc.

InventorsMattia Pagnozzi, Luca Guerra, Guido Bonomi

Life of this patent

Estimating the term…

Loading patent…

Abstract

Techniques for selectively remediating vulnerabilities for assets of a computing system is disclosed. The vulnerability management system identifies “active” vulnerabilities associated with “active” computing assets that have been determined to be currently running, or to have been recently run, on the system using system call data. By limiting remediation to vulnerabilities associated with software packages of active computing assets, remediation/mediation efforts can be focused on vulnerabilities that may be currently exploited for the system. The list of active vulnerabilities identified for a system may be updated in real time based on continued monitoring of runtime operations of the system. Additional context metadata may be associated with the active vulnerabilities to allow for further prioritization of vulnerability management activities. Vulnerability management actions for particular active vulnerability may include updating a software package, adjusting a set of firewall rules, communicating with a client computing device, and displaying vulnerability information in a GUI.

Claims21

Dependent claims

A computer-implemented method of computer vulnerabilities management, comprising:

identifying one or more processes running on a particular computing system during a particular period of time including now;
wherein a plurality of computing assets, associated with a plurality of software packages, is installed on the particular computing system;
wherein the plurality of software packages is associated with a plurality of vulnerabilities;
identifying one or more active computing assets, of the plurality of computing assets, based on each of the one or more active computing assets being an owner of a process of the one or more processes;
identifying a set of active software packages, of the plurality of software packages, associated with the one or more active computing assets;
identifying, from the plurality of vulnerabilities, a set of active vulnerabilities that are associated with the set of active software packages;
prioritizing the set of active vulnerabilities over other vulnerabilities in the plurality of vulnerabilities;
obtaining and maintaining, for each vulnerability of the set of active vulnerabilities, context metadata that comprises metadata for one or more encapsulating entities of a plurality of encapsulating entities, including one or more containers that are associated with the one or more active computing assets that are associated with the set of active vulnerabilities;
ranking the set of active vulnerabilities based on the metadata for the corresponding one or more containers for each vulnerability of the set of active vulnerabilities;
transmitting information related to the prioritizing and ranking to a device.

7 more elements

Dependencies are inferred from the claim text.