# US 11,909,756 B2 · Automatic identification of change requests to address information technology vulnerabilities > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,909,756 B2 - Document ID: US11909756B2 - Status: Granted - Kind: B2 - Application number: 17/400,863 - Filed: 2021-08-12 - Published: 2023-02-16 - Granted: 2024-02-20 - Earliest claimed: 2021-08-12 - Assignees: ServiceNow, Inc. - Applicants: ServiceNow, Inc. - Inventors: Vamsi Krishna Madala; Alexander House; Brian James Waplington - Web page: https://patentgrep.com/patent/US11909756B2 ## CPC - H04L 63/1433: {Vulnerability analysis} - G06N 20/00: Machine learning - H04L 63/205: {involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved (negotiation of communication capabilities H04L69/24)} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS ## Abstract A machine learning model is trained based at least on previous change requests, wherein each of the previous change requests are associated with a controlled management of a lifecycle of a change to an information technology environment. A security vulnerability of the information technology environment is identified. Using the trained machine learning model, a corresponding match score for each of a plurality of pending change requests is determined for the security vulnerability. An indication of whether a resolution specification for the security vulnerability is to be linked with one of the plurality of pending change requests selected based on a factor associated with its corresponding match score is received. ## Claims ### Claim 1 A method, comprising: training a machine learning model based at least on previous change requests, wherein each of the previous change requests are associated with a controlled management of a lifecycle of a change to an information technology environment; identifying a security vulnerability of the information technology environment; using the trained machine learning model, determining for the security vulnerability a corresponding match score for each of a plurality of pending change requests; and receiving an indication of whether a resolution specification for the security vulnerability is to be linked with one of the plurality of pending change requests selected based on a factor associated with its corresponding match score. ### Claim 2 (depends on 1) The method of claim 1, wherein determining for the security vulnerability the corresponding match score for each of the plurality of pending change requests includes utilizing machine learning model input features associated with an implementation plan of the security vulnerability and one or more descriptions of the security vulnerability. ### Claim 3 (depends on 2) The method of claim 2, wherein at least one of the one or more descriptions of the security vulnerability includes a vulnerability identifier. ### Claim 4 (depends on 3) The method of claim 3, wherein the at least one of the one or more descriptions of the security vulnerability includes an explanation of the security vulnerability and a date associated with the security vulnerability. ### Claim 5 (depends on 2) The method of claim 2, wherein at least one of the one or more descriptions of the security vulnerability includes a vulnerability group identifier associated with vulnerable assets of the information technology environment. ### Claim 6 (depends on 2) The method of claim 2, wherein at least one of the one or more descriptions of the security vulnerability includes a description of the information technology environment associated with vulnerable assets of the information technology environment. ### Claim 7 (depends on 1) The method of claim 1, further comprising creating a proposed change request based on the security vulnerability, wherein determining for the security vulnerability the corresponding match score for each of the plurality of pending change requests includes applying the trained machine learning model to the proposed change request, and wherein the proposed change request is associated with an implementation plan field and one or more description fields. ### Claim 8 (depends on 1) The method of claim 1, further comprising identifying a remediation plan for the security vulnerability of the information technology environment, wherein the one of the plurality of pending change requests selected based on the factor associated with its corresponding match score implements the remediation plan. ### Claim 9 (depends on 1) The method of claim 1, wherein identifying the security vulnerability of the information technology environment includes identifying a group of vulnerable assets of the information technology environment impacted by the security vulnerability. ### Claim 10 (depends on 1) The method of claim 1, wherein training the machine learning model based at least on the previous change requests includes utilizing as machine learning features an implementation plan field and one or more description fields of the previous change requests. ### Claim 11 A system, comprising: one or more processors; and a memory coupled to the one or more processors, wherein the memory is configured to provide the one or more processors with instructions which when executed cause the one or more processors to: train a machine learning model based at least on previous change requests, wherein each of the previous change requests are associated with a controlled management of a lifecycle of a change to an information technology environment; identify a security vulnerability of the information technology environment; determine using the trained machine learning model for the security vulnerability a corresponding match score for each of a plurality of pending change requests; and receive an indication of whether a resolution specification for the security vulnerability is to be linked with one of the plurality of pending change requests selected based on a factor associated with its corresponding match score. ### Claim 12 (depends on 11) The system of claim 11, wherein causing the one or more processors to determine for the security vulnerability the corresponding match score for each of the plurality of pending change requests includes causing the one or more processors to utilize machine learning model input features associated with an implementation plan of the security vulnerability and one or more descriptions of the security vulnerability. ### Claim 13 (depends on 12) The system of claim 12, wherein at least one of the one or more descriptions of the security vulnerability includes a vulnerability identifier. ### Claim 14 (depends on 13) The system of claim 13, wherein the at least one of the one or more descriptions of the security vulnerability includes an explanation of the security vulnerability and a date associated with the security vulnerability. ### Claim 15 (depends on 12) The system of claim 12, wherein at least one of the one or more descriptions of the security vulnerability includes a vulnerability group identifier associated with vulnerable assets of the information technology environment and a description of the information technology environment associated with the vulnerable assets of the information technology environment. ### Claim 16 (depends on 11) The system of claim 11, wherein the memory is further configured to provide the one or more processors with instructions which when executed cause the one or more processors to: create a proposed change request based on the security vulnerability, wherein determining for the security vulnerability the corresponding match score for each of the plurality of pending change requests includes applying the trained machine learning model to the proposed change request, and wherein the proposed change request is associated with an implementation plan field and one or more description fields. ### Claim 17 (depends on 11) The system of claim 11, wherein the memory is further configured to provide the one or more processors with instructions which when executed cause the one or more processors to: identify a remediation plan for the security vulnerability of the information technology environment, wherein the one of the plurality of pending change requests selected based on the factor associated with its corresponding match score implements the remediation plan. ### Claim 18 (depends on 11) The system of claim 11, wherein identifying the security vulnerability of the information technology environment includes identifying a group of vulnerable assets of the information technology environment impacted by the security vulnerability. ### Claim 19 (depends on 11) The system of claim 11, wherein training the machine learning model based at least on the previous change requests includes utilizing as machine learning features an implementation plan field and one or more description fields of the previous change requests. ### Claim 20 A computer program product, the computer program product being embodied in a non-transitory computer readable storage medium and comprising computer instructions for: training a machine learning model based at least on previous change requests, wherein each of the previous change requests are associated with a controlled management of a lifecycle of a change to an information technology environment; identifying a security vulnerability of the information technology environment; using the trained machine learning models, determining for the security vulnerability a corresponding match score for each of a plurality of pending change requests; and receiving an indication of whether a resolution specification for the security vulnerability is to be linked with one of the plurality of pending change requests selected based on a factor associated with its corresponding match score.