# US 12,602,489 B2 · Vulnerability applicability assessment and determination > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,602,489 B2 - Document ID: US12602489B2 - Status: Granted - Kind: B2 - Application number: 18/582,094 - Filed: 2024-02-20 - Published: 2025-08-21 - Granted: 2026-04-14 - Earliest claimed: 2024-02-20 - Assignees: International Business Machines Corporation - Applicants: International Business Machines Corporation - Inventors: Mrudula Madiraju; Shyamala Gowri; Deepashree Gandhi; Rakhi S. Arora - Web page: https://patentgrep.com/patent/US12602489B2 ## CPC - G06F 21/577: {Assessing vulnerabilities and evaluating computer system security} - G06F 2221/033: Test or assess software - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A computer implemented method processes vulnerabilities. A processor set identifies a vulnerability and a description of the vulnerability in a vulnerability report. The processor set extracts a set of key exploit conditions for the vulnerability from the description of the vulnerability. The processor set generates a set of different code snippets for the set of key exploit conditions. The processor set searches a set of repositories for a match between the set of components and the set of different code snippets to form a search result. The processor set identifies vulnerability assessment information relating to an applicability of the vulnerability in response to the match between the set of components and the set of different code snippets in the search result. ## Claims ### Claim 1 A computer implemented method for processing vulnerabilities, the computer implemented method comprising: identifying, by a processor set, a vulnerability and a description of the vulnerability in a vulnerability report; extracting, by the processor set, a set of key exploit conditions for the vulnerability from the description of the vulnerability; generating, by the processor set, a set of different code snippets for the set of key exploit conditions; searching, by the processor set, a set of repositories for a match between a set of components and the set of different code snippets to form a search result; and identifying, by the processor set, vulnerability assessment information relating to an applicability of the vulnerability in response to the match between the set of components and the set of different code snippets in the search result; searching, by the processor set, a set of sources for the vulnerability assessment information related to the applicability of the vulnerability in response to the search result indicating that the vulnerability has been detected for the set of components in the set of repositories; generating, by the processor set, a summary of the vulnerability assessment information from the set of sources for reasons for inaction on the vulnerability; analyzing the summary to identify why the vulnerability is inapplicable for a particular situation; and determining, based on the analyzing, whether any remediation actions are needed with respect to the vulnerability located for the set of components in the set of repositories. ### Claim 2 (depends on 1) The computer implemented method of claim 1 further comprising: determining, by the processor set, the applicability of the vulnerability based on the search result and the vulnerability assessment information. ### Claim 3 (depends on 1) The computer implemented method of claim 1 further comprising: identifying, by the processor set, a recommended upgrade for the set of components in response to the match between the set of components and the set of different code snippets in the search result; and determining, by the processor set, whether the recommended upgrade for the set of components will cause a regression issue. ### Claim 4 (depends on 1) The computer implemented method of claim 1, wherein generating, by the processor set, the set of different code snippets comprises: inputting the set of key exploit conditions, a set of code constructs, and a set of programming languages to a machine learning model system; and receiving the set of different code snippets for the set of key exploit conditions using the set of code constructs in the set of programming languages from the machine learning model system from the machine learning model system. ### Claim 5 (depends on 1) The computer implemented method of claim 1, wherein the set of different code snippets have different code constructs that are different methodologies to invoke components and wherein each code snippet in the set of different code snippets for a particular language is invoked using a language specific construct. ### Claim 6 (depends on 1) The computer implemented method of claim 1, wherein the reasons for inaction on the vulnerability comprise: an absence of the set of key exploit conditions in the implementation of the set of components; or a determination that the vulnerability is not applicable based on how the set of components are implemented. ### Claim 7 (depends on 1) The computer implemented method of claim 1, further comprising: generating, by the processor set, a reassessed applicability report for the vulnerability, wherein the reassessed applicability report includes: an indication as to whether a key exploit condition from the set of key exploit conditions was found in the set of components; and when the key exploit condition is not found, the reasons for inaction on the vulnerability. ### Claim 8 A computer system comprising: a processor set; a set of one or more computer-readable storage media; and program instructions, collectively stored in the set of one or more computer-readable storage media, for causing the processor set to perform computer operations as follows: identify a vulnerability and a description of the vulnerability in a vulnerability report; extract a set of key exploit conditions for the vulnerability from the description of the vulnerability; generate a set of different code snippets for the set of key exploit conditions; search a set of repositories for a match between a set of components and the set of different code snippets to form a search result; and identify vulnerability assessment information relating to an applicability of the vulnerability in response to the match between the set of components and the set of different code snippets in the search result; search a set of sources for the vulnerability assessment information related to the applicability of the vulnerability in response to the search result indicating that the vulnerability has been detected for the set of components in the set of repositories; generate, by the processor set, a summary of the vulnerability assessment information from the set of sources for reasons for inaction on the vulnerability; analyze the summary to identify why the vulnerability is inapplicable for a particular situation; and determine, based on the analyzing, whether any remediation actions are needed with respect to the vulnerability located for the set of components in the set of repositories. ### Claim 9 (depends on 8) The computer system of claim 8, wherein the program instructions, collectively stored in the set of one or more computer-readable storage media further cause the processor set to: determine the applicability of the vulnerability based on the search result and the vulnerability assessment information. ### Claim 10 (depends on 8) The computer system of claim 8, wherein the program instructions, collectively stored in the set of one or more computer-readable storage media further cause the processor set to: identify a recommended upgrade for the set of components in response to the match between the set of components and the set of different code snippets in the search result; and determine whether the recommended upgrade for the set of components will cause a regression issue. ### Claim 11 (depends on 8) The computer system of claim 8, wherein as part of generating the set of different code snippets, the program instructions, collectively stored in the set of one or more computer-readable storage media further cause the processor set to: input the set of key exploit conditions, a set of code constructs, and a set of programming languages to a machine learning model system; and receive the set of different code snippets for the set of key exploit conditions using the set of code constructs in the set of programming languages from the machine learning model system. ### Claim 12 (depends on 8) The computer system of claim 8, wherein the set of different code snippets have different code constructs that are different methodologies to invoke components and wherein each code snippet in the set of different code snippets for a particular language is invoked using a language specific construct. ### Claim 13 (depends on 8) The computer system of claim 8, wherein the reasons for inaction on the vulnerability comprise: an absence of the set of key exploit conditions in the implementation of the set of components; or a determination that the vulnerability is not applicable based on how the set of components are implemented. ### Claim 14 (depends on 8) The computer system of claim 8, further comprising: generating, by the processor set, a vulnerability assessment report identifying a first set of vulnerabilities requiring remediation and a second set of vulnerabilities not requiring remediation, wherein the vulnerability assessment report includes the reasons for inaction for each vulnerability in the second set of vulnerabilities. ### Claim 15 A computer program product for processing vulnerabilities, the computer program product comprising: a set of one or more computer-readable storage media; program instructions, collectively stored in the set of one or more computer-readable storage media, for causing a processor set to perform computer operations as follows: identify a vulnerability and a description of the vulnerability in a vulnerability report; extract a set of key exploit conditions for the vulnerability from the description of the vulnerability; generate a set of different code snippets for the set of key exploit conditions; search a set of repositories for a match between a set of components and the set of different code snippets to form a search result; and identify vulnerability assessment information relating to an applicability of the vulnerability in response to the match between the set of components and the set of different code snippets in the search result; search a set of sources for the vulnerability assessment information related to the applicability of the vulnerability in response to the search result indicating that the vulnerability has been detected for the set of components in the set of repositories; generate a summary of the vulnerability assessment information from a set of sources for reasons for inaction on the vulnerability; analyze the summary to identify why the vulnerability is inapplicable for a particular situation; and determine, based on the analyzing, whether any remediation actions are needed with respect to the vulnerability located for the set of components in the set of repositories. ### Claim 16 (depends on 15) The computer program product of claim 15, wherein the program instructions, collectively stored in the set of one or more computer-readable storage media further cause the processor set to: determine the applicability of the vulnerability based on the search result and the vulnerability assessment information. ### Claim 17 (depends on 15) The computer program product of claim 15, wherein the program instructions, collectively stored in the set of one or more computer-readable storage media further cause the processor set to: identify a recommended upgrade for the set of components in response to the match between the set of components and the set of different code snippets in the search result; and determine whether the recommended upgrade for the set of components will cause a regression issue. ### Claim 18 (depends on 15) The computer program product of claim 15, wherein as part of generating the set of different code snippets, the program instructions, collectively stored in the set of one or more computer-readable storage media further cause the processor set to: input the set of key exploit conditions, a set of code constructs, and a set of programming languages to a machine learning model system; and receive the set of different code snippets for the set of key exploit conditions using the set of code constructs in the set of programming languages from the machine learning model system. ### Claim 19 (depends on 15) The computer program product of claim 15, wherein the reasons for inaction on the vulnerability comprise: an absence of the set of key exploit conditions in the implementation of the set of components; or a determination that the vulnerability is not applicable based on how the set of components are implemented. ### Claim 20 (depends on 15) The computer program product of claim 15, further comprising: generating, by the processor set, a vulnerability assessment report identifying a first set of vulnerabilities requiring remediation and a second set of vulnerabilities not requiring remediation, wherein the vulnerability assessment report includes the reasons for inaction for each vulnerability in the second set of vulnerabilities.