Adaptive vulnerability management based on diverse vulnerability information

A vulnerability management system for a computer system, the system comprising:

• a network interface through which to obtain vulnerability information for computer assets over a network;
• one or more processors configured to identify vulnerabilities of the computer system based on the vulnerability information for the computer assets and inventory information of the computer assets for the computer system;
• and
• a non-transitory, computer-readable storage medium comprising instructions recorded thereon that, when executed by the one or more processors, cause the system to:
• cause the network interface to automatically collect the vulnerability information periodically over the network;
• perform a matching process of the vulnerability information to the inventory information of the computer assets for the computer system;
• identify a vulnerability of the computer system as a match between a known vulnerability included in the inventory information and a computer asset listed in the inventory information of the computer system;
• store, in a cloud-based results database, a subset of the vulnerability information,
• wherein the subset of the vulnerability information does not match the inventory information;
• and
• generate, based on text extracted from the subset of the vulnerability information, a search index that enables access to processed analytics of the vulnerability information.

At least one non-transitory computer-readable storage medium carrying instructions that, when executed by a vulnerability management system, cause the vulnerability management system to perform operations for identifying a vulnerability of a computer asset, the operations comprising:

• collecting cybersecurity vulnerabilities and exposures (CVEs) from a networked source;
• collecting feature information of the computer asset subject to vulnerability management;
• processing the CVEs and the feature information by:
• interpreting at least some of the CVEs using natural language processing (NLP) to understand a known vulnerability of a known computer asset;
• calculating a Levenshtein distance between the known computer asset and the computer asset;
• ranking the Levenshtein distance as a measure of relevance of the known computer asset to the computer asset;
• and
• identifying a potential vulnerability of the computer asset based on a rank of the Levenshtein distance;
• storing, in a database, a subset of the interpreted CVEs,
• wherein the subset of the interpreted CVEs does not match the feature information;
• and
• generating, based on text extracted from the subset of the feature information, a search index that enables access to processed analytics of the CVEs.