Systems and methods for predicting which software vulnerabilities will be exploited by malicious hackers to prioritize for patching
AssigneeArizona Board of Regents on behalf of Arizona State University
InventorsPaulo Shakarian, Mohammed Almukaynizi, Jana Shakarian, Eric Nunes, Krishna Dharaiya, Manoj Balasubramaniam Senguttuvan, Alexander Grimm
Life of this patent
Estimating the term…
Abstract
Various embodiments for predicting which software vulnerabilities will be exploited by malicious hackers and hence prioritized by patching are disclosed.
Claims20
A method for assessing a likelihood of exploitation of software vulnerabilities, comprising:
- utilizing a processor in operable communication with at least one memory for storing instructions that are executed by the processor to perform operations, including:
- accessing a plurality of datasets associated with a predetermined set of data sources, the plurality of datasets including training data comprising hacker communications;
- accessing features from the plurality of datasets that include measures computed from social connections of users posting hacking-related content
- applying learning algorithms to the training data to generate classification models that are configured to predict class labels defining a likelihood of exploitation of respective software vulnerabilities;
- accessing one or more features associated with a software vulnerability;
- and
- computing, by applying the one or more features to the classification model, a class label defining one or more values defining a likelihood of exploitation associated with the software vulnerability, wherein the likelihood of exploitation predicts an actual exploitation of the respective software vulnerabilities before disclosure based on the hacker communications from the training data.
A computing device, configured via machine learning to apply a learned function to data associated with a software vulnerability to estimate a likelihood of exploitation of the software vulnerability, the learned function associated with a prediction model derived from at least one machine learning algorithm and a plurality of datasets associated with software vulnerabilities, the plurality of datasets including information associated with discussion of vulnerabilities by users posting hacking-related content, wherein the likelihood of exploitation predicts an actual exploitation of the software vulnerability before disclosure based on hacker communications from the plurality of datasets.
A method of prioritizing vulnerabilities using cyber threat intelligence, comprising:
- utilizing a processor in operable communication with at least one memory for storing instructions that are executed by the processor to perform operations including:
- accessing a plurality of datasets associated with a predetermined set of data sources, at least a portion of the plurality of datasets defining training data including hacker communications;
- applying learning algorithms to the training data to generate a predictive model configured to predict a likelihood of exploitation of respective software vulnerabilities;
- accessing one or more features associated with a software vulnerability;
- and
- computing, by applying the one or more features to the predictive model, one or more values defining a likelihood of exploitation associated with the software vulnerability, wherein the likelihood of exploitation predicts an actual exploitation of the respective software vulnerabilities before disclosure based on the hacker communications from the training data.
Dependencies are inferred from the claim text.