# US 12,118,095 B1 · Machine learning model for calculating confidence scores associated with potential security vulnerabilities > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,118,095 B1 - Document ID: US12118095B1 - Status: Granted - Kind: B1 - Application number: 17/389,692 - Filed: 2021-07-30 - Granted: 2024-10-15 - Earliest claimed: 2021-07-30 - Assignees: Rapid7, Inc. - Applicants: Rapid7, Inc. - Inventors: Stuart Millar; Denis Podgurskii - Web page: https://patentgrep.com/patent/US12118095B1 ## CPC - G06F 21/577: {Assessing vulnerabilities and evaluating computer system security} - G06N 20/00: Machine learning - G06F 2221/034: Test or assess a computer or a system - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS ## Abstract Various embodiments include systems and methods of implementing a machine learning model for calculating confidence scores associated with potential security vulnerabilities. The machine learning model is trained using vulnerability data associated with a set of previously identified vulnerabilities, where the vulnerability data indicates whether a previously identified vulnerability is a true positive or a false positive. In some embodiments, scan traffic data may be obtained. The scan traffic data may be associated with potential security vulnerabilities detected via scan engine(s) that implement application security testing. The machine learning model may be used to determine respective confidence scores for each potential security vulnerability. According to some embodiments, responsive to a request for scan findings associated with a particular application, the respective confidence scores may be displayed via a vulnerability analysis graphical user interface. ## Claims ### Claim 1 A system, comprising: one or more hardware processors with associated memory that implement a machine learning (ML) model for calculating confidence scores associated with potential security vulnerabilities detected via application security testing, wherein the one or more hardware processors are configured to: obtain scan traffic data associated with one or more potential security vulnerabilities detected via one or more scan engines that implement application security testing, wherein the one or more scan engines send scan requests to different applications and detect potential security vulnerabilities using scan responses obtained in response to the scan requests; determine, using the ML model, respective confidence scores for each of the one or more potential security vulnerabilities, wherein the ML model is trained using vulnerability data associated with a set of previously identified vulnerabilities, and wherein the vulnerability data indicates, for each respective previously identified vulnerability of the set of previously identified vulnerabilities, whether the previously identified vulnerability is a true positive or a false positive; responsive to a request for scan findings associated with a particular application, display the respective confidence scores via a vulnerability analysis graphical user interface; and responsive to a selection of a particular potential security vulnerability via the vulnerability analysis graphical user interface, display a vulnerability details graphical user interface that indicates (a) a scan request that caused detection of the particular potential security vulnerability, (b) a scan response received in response to the scan request, (c) a module type of the particular potential security vulnerability detected, and (d) a confidence score determined by the ML model for the particular potential security vulnerability. ### Claim 2 (depends on 1) The system of claim 1, wherein each of the respective confidence scores corresponds to a percentage value within a range of zero percent to one-hundred percent. ### Claim 3 (depends on 2) The system of claim 2, wherein an individual confidence score having a percentage value of zero percent is indicative of the ML model having determined that a particular potential security vulnerability is most likely to be a false positive. ### Claim 4 (depends on 2) The system of claim 2, wherein an individual confidence score having a percentage value of one-hundred percent is indicative of the ML model having determined that a particular potential security vulnerability is most likely to be a true positive. ### Claim 5 (depends on 1) The system of claim 1, wherein the one or more hardware processors are configured to display respective vulnerability severities for each of the individual potential security vulnerabilities via the vulnerability analysis graphical user interface. ### Claim 6 (depends on 5) The system of claim 5, wherein each of the respective vulnerability severities corresponds to one of: a high vulnerability severity; a medium vulnerability severity; and a low vulnerability severity. ### Claim 7 (depends on 1) The system of claim 1, wherein the individual potential security vulnerabilities are sorted in a ranked order in the vulnerability analysis graphical user interface based on the respective confidence scores. ### Claim 8 (depends on 1) The system of claim 1, wherein the one or more hardware processors are configured to identify, via the vulnerability details graphical user interface, a portion of the scan response that the ML model deems to have contributed to the confidence score. ### Claim 9 (depends on 1) The system of claim 1, wherein the vulnerability details graphical user interface includes a selectable option to change a status of the particular potential security vulnerability from an unverified status to a verified status to identify the particular potential security vulnerability as a true positive security vulnerability. ### Claim 10 (depends on 1) The system of claim 1, wherein the one or more hardware processors are configured to generate an alert to notify an analyst that the confidence score generated by the ML model is indicative of the particular potential security vulnerability being a false positive security vulnerability. ### Claim 11 A method comprising: implementing, using one or more hardware processors, a machine learning (ML) model for calculating confidence scores associated with potential security vulnerabilities detected via application security testing, wherein the implementing comprises: obtaining scan traffic data associated with one or more potential security vulnerabilities detected via one or more scan engines that implement application security testing, wherein the one or more scan engines send scan requests to different applications and detect potential security vulnerabilities using scan responses obtained in response to the scan requests; determining, using the ML model, respective confidence scores for each of the one or more potential security vulnerabilities, wherein the ML model is trained using vulnerability data associated with a set of previously identified vulnerabilities, and wherein the vulnerability data indicates, for each respective previously identified vulnerability of the set of previously identified vulnerabilities, whether the previously identified vulnerability is a true positive or a false positive; responsive to a request for scan findings associated with a particular application, displaying the respective confidence scores via a vulnerability analysis graphical user interface; and responsive to a selection of a particular potential security vulnerability via the vulnerability analysis graphical user interface, displaying a vulnerability details graphical user interface that indicates (a) a scan request that caused detection of the particular potential security vulnerability, (b) a scan response received in response to the scan request, (c) a module type of the particular potential security vulnerability detected, and (d) a confidence score determined by the ML model for the particular potential security vulnerability. ### Claim 12 (depends on 11) The method of claim 11, wherein: each of the respective confidence scores corresponds to a percentage value within a range of zero percent to one-hundred percent; an individual confidence score having a percentage value of zero percent is indicative of the ML model having determined that a particular potential security vulnerability is most likely to be a false positive; and an individual confidence score having a percentage value of one-hundred percent is indicative of the ML model having determined that a particular potential security vulnerability is most likely to be a true positive. ### Claim 13 (depends on 11) The method of claim 11, further comprising: displaying respective vulnerability severities for each of the individual potential security vulnerabilities via the vulnerability analysis graphical user interface; and wherein each of the respective vulnerability severities corresponds to one of: a high vulnerability severity; a medium vulnerability severity; and a low vulnerability severity. ### Claim 14 (depends on 13) The method of claim 13, wherein the individual potential security vulnerabilities are sorted in a ranked order in the vulnerability analysis graphical user interface based on a combination of the respective confidence scores and the respective vulnerability severities. ### Claim 15 One or more non-transitory computer-accessible storage media storing program instructions that, when executed on or across one or more processors, implement at least a portion of a system that implements a machine learning (ML) model for calculating confidence scores associated with potential security vulnerabilities detected via application security testing and cause the system to: obtain scan traffic data associated with one or more potential security vulnerabilities detected via one or more scan engines that implement application security testing, wherein the one or more scan engines send scan requests to different applications and detect potential security vulnerabilities using scan responses obtained in response to the scan requests; determine, using the ML model, respective confidence scores for each of the one or more potential security vulnerabilities, wherein the ML model is trained using vulnerability data associated with a set of previously identified vulnerabilities, and wherein the vulnerability data indicates, for each respective previously identified vulnerability of the set of previously identified vulnerabilities, whether the previously identified vulnerability is a true positive or a false positive; responsive to a request for scan findings associated with a particular application, display the respective confidence scores via a vulnerability analysis graphical user interface; and responsive to a selection of a particular potential security vulnerability via the vulnerability analysis graphical user interface, display a vulnerability details graphical user interface that indicates (a) a scan request that caused detection of the particular potential security vulnerability, (b) a scan response received in response to the scan request, (c) a module type of the particular potential security vulnerability detected, and (d) a confidence score determined by the ML model for the particular potential security vulnerability. ### Claim 16 (depends on 15) The one or more non-transitory computer-accessible storage media of claim 15, wherein: each of the respective confidence scores corresponds to a percentage value within a range of zero percent to one-hundred percent; an individual confidence score having a percentage value of zero percent is indicative of the ML model having determined that a particular potential security vulnerability is most likely to be a false positive; and an individual confidence score having a percentage value of one-hundred percent is indicative of the ML model having determined that a particular potential security vulnerability is most likely to be a true positive. ### Claim 17 (depends on 15) The one or more non-transitory computer-accessible storage media of claim 15, wherein the program instructions when executed on or across the one or more processors cause the system to: display respective vulnerability severities for each of the individual potential security vulnerabilities via the vulnerability analysis graphical user interface; wherein each of the respective vulnerability severities corresponds to one of: a high vulnerability severity; a medium vulnerability severity; and a low vulnerability severity; and wherein the individual potential security vulnerabilities are sorted in a ranked order in the vulnerability analysis graphical user interface based on a combination of the respective confidence scores and the respective vulnerability severities. ### Claim 18 (depends on 15) The one or more non-transitory computer-accessible storage media of claim 15, wherein the program instructions when executed on or across the one or more processors cause the system to identify, via the vulnerability details graphical user interface, a portion of the scan response that the ML model deems to have contributed to the confidence score. ### Claim 19 The one or more non-transitory computer-accessible storage media of 15, wherein the vulnerability details graphical user interface includes a selectable option to change a status of the particular potential security vulnerability from an unverified status to a verified status to identify the particular potential security vulnerability as a true positive security vulnerability. ### Claim 20 The one or more non-transitory computer-accessible storage media of 15, wherein the program instructions when executed on or across the one or more processors cause the system to generate an alert to notify an analyst that the confidence score generated by the ML model is indicative of the particular potential security vulnerability being a false positive security vulnerability.