Mitigation of external exposure of energy delivery systems

A method, comprising:

• classifying a device type for a device having unknown common vulnerabilities and exposures (CVEs) by comparing device banner information to device type patterns of a regular expression dictionary and selecting as the device type the comparison output having the highest confidence level;
• and
• estimating a cyberattack vulnerability of the device based on an attack progression series of exploitability and impact parameter estimates associated with the device type classification;
• wherein the regular expression dictionary includes signatures linking banner information patterns with device types based on a combination of a data value attribute, a version, or a common weakness enumeration (CWE).

An apparatus, comprising:

• a processor and memory configured with processor-executable instructions which, when executed by the processor, cause the processor to:
• receive banner information from one or more queries of a network connecting a set of devices, wherein the banner information of one or more of the devices includes common vulnerability and exposure identifiers (CVEs) and the banner information of one or more of the devices does not include a CVE;
• identify the devices based on the banner information including classifying devices without known CVEs by a device type;
• determine vulnerability scores for the devices with known CVEs based on retrieved CVE information;
• and
• determine vulnerability scores for the devices without CVEs based on a series of exploitability and impact parameter estimates associated with the device type classifications;
• wherein the classifying the devices by device type includes comparing the device banner information to a regular expression dictionary linking banner information to device types, and selecting as the device type a highest confidence level output from one or more comparison outputs;
• wherein the regular expression dictionary includes signatures linking banner information patterns with device types based on a combination of a data value attribute, a version, or a common weakness enumeration (CWE).