# US 12,748,852 B2 · Vulnerability risk prediction engine > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,748,852 B2 - Document ID: US12748852B2 - Status: Granted - Kind: B2 - Application number: 17/877,371 - Filed: 2022-07-29 - Published: 2024-02-01 - Granted: 2026-09-29 - Earliest claimed: 2022-07-29 - Assignees: CrowdStrike, Inc. - Applicants: CrowdStrike, Inc. - Inventors: Daniel Kahan; Adrian Bledea-Georgescu; Cynthia Lai; Jeff Kaplan; Joe Faulhaber; Anand Visvanathan - Web page: https://patentgrep.com/patent/US12748852B2 ## CPC - G06F 21/577: {Assessing vulnerabilities and evaluating computer system security} - H04L 63/1433: {Vulnerability analysis} - G06F 2221/034: Test or assess a computer or a system - H04L 63/1416: {Event detection, e.g. attack signature detection} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A system and method of predicting the probability of exploitation of vulnerabilities of a computing environment. The method includes acquiring one or more environment variables associated with a computing environment. The method includes identifying a vulnerability in the computing environment based on a vulnerability database (VDB) and the one or more environment variables associated with the computing environment. The method includes generating an input dataset based on behavioral-based endpoint detection and response (EDR) data associated with the vulnerability. The method includes providing the input dataset to one or more predictive models respectively trained to predict probabilities of exploitation of vulnerabilities of computing environments based on the input dataset. The method includes generating, by a processing device, a vulnerability risk score for the vulnerability of the computing environment based on the input dataset and the one or more predictive models. ## Claims ### Claim 1 A method, comprising: acquiring one or more environment variables associated with a computing environment; identifying a vulnerability in the computing environment based on a vulnerability database (VDB) and the one or more environment variables associated with the computing environment; generating an input dataset based on behavioral-based endpoint detection and response (EDR) data associated with the vulnerability; applying one or more predictive models, respectively trained to predict probabilities of exploitation of vulnerabilities of computing environments, to the input dataset; generating, by one or more processors, a vulnerability risk score for the vulnerability of the computing environment based on the input dataset and the one or more predictive models, wherein generating the vulnerability risk score further comprises determining a likelihood of the vulnerability being exploited in an attack based on application attributes of an application associated with the vulnerability and vulnerability attributes of the vulnerability in the computing environment, wherein generating the vulnerability risk score further comprises identifying a second vulnerability that co-exists on a client device with the vulnerability and determining a likelihood that a combination of the vulnerability and the second vulnerability being exploited together in the attack, wherein determining the likelihood that the combination of the vulnerability and the second vulnerability is exploited together in the attack comprises evaluating one or more CVE chain datasets derived from the EDR data, each CVE chain dataset indicating an empirically observed frequency with which the vulnerability and the second vulnerability have been exploited together across a plurality of computing environments, the empirically observed frequency being normalized using the application attributes that comprise prevalence data indicating whether the application is prevalent among a plurality of computing devices in the computing environment, wherein the vulnerability attributes are indicative of a vulnerability age indicating when the vulnerability initially appeared in other computing environments prior to being identified in the computing environment and a usefulness score associated with the vulnerability being exploited in the attack, wherein determining the likelihood of the vulnerability further comprises determining a probability for user privileges in the computing environment to be escalated if the vulnerability was exploited; and prioritizing a repair of the vulnerability based on the vulnerability risk score to minimize computing resource consumption by the vulnerability. ### Claim 2 (depends on 1) The method of claim 1, wherein determining the likelihood of the vulnerability being exploited in the attack is further based on at least one or more historical CVE attributes of the vulnerability in the computing environment. ### Claim 3 (depends on 2) The method of claim 2, wherein the application attributes comprise an attack history of the application. ### Claim 4 (depends on 2) The method of claim 2, wherein the vulnerability attributes of the vulnerability in the computing environment are further indicative of a weakness category associated with the vulnerability being exploited in the attack. ### Claim 5 (depends on 2) The method of claim 2, wherein the EDR data is associated with the plurality of computing environments, and wherein generating the vulnerability risk score further comprising: calculating, based on the EDR data, a frequency in which the vulnerability might be exploited. ### Claim 6 (depends on 2) The method of claim 2, wherein the vulnerability in the computing environment exists on the client device. ### Claim 7 (depends on 2) The method of claim 2, wherein generating the vulnerability risk score further comprising: determining a capability of the client device to defend against the vulnerability being exploited in the attack, the vulnerability in the computing environment exists on the client device; and adjusting the likelihood of the vulnerability being exploited in the attack based on the capability of the client device to defend against the vulnerability being exploited in the attack. ### Claim 8 (depends on 2) The method of claim 2, wherein the computing environment is associated with the client device, wherein generating the vulnerability risk score further comprising: determining the likelihood of the vulnerability being exploited in the attack based on an industry type associated with the client device or a geographic location associated with the client device. ### Claim 9 (depends on 2) The method of claim 2, wherein generating the vulnerability risk score further comprising: determining the likelihood of the vulnerability being exploited in the attack based on prior attacks observed in the computing environment, or receiving the EDR data from the client device, wherein the vulnerability in the computing environment exists on the client device; and calculating, based on the EDR data, a frequency in which the vulnerability might be exploited in the attack. ### Claim 10 (depends on 1) The method of claim 1, further comprising: prioritizing the vulnerability over other vulnerabilities that are associated with the computing environment based on the vulnerability risk score; and providing a notification indicating one or more remedial actions to resolve the vulnerability responsive to prioritizing the vulnerability. ### Claim 11 A system comprising: a memory; and one or more processors, operatively coupled to the memory, to: acquire one or more environment variables associated with a computing environment; identify a vulnerability in the computing environment based on a vulnerability database (VDB) and the one or more environment variables associated with the computing environment; generate an input dataset based on at least one of behavioral-based endpoint detection and response (EDR) data associated with the vulnerability; apply one or more predictive models, respectively trained to predict probabilities of exploitation of vulnerabilities of computing environments, to the input dataset; generate a vulnerability risk score for the vulnerability of the computing environment based on the input dataset and the one or more predictive models, wherein generating the vulnerability risk score further comprises determining a likelihood of the vulnerability being exploited in an attack based on application attributes of an application associated with the vulnerability and vulnerability attributes of the vulnerability in the computing environment and a usefulness score associated with the vulnerability being exploited in the attack, wherein to generate the vulnerability risk score further comprises identifying a second vulnerability that co-exists on a client device with the vulnerability and determining a likelihood that a combination of the vulnerability and the second vulnerability is being exploited together in the attack, wherein determining the likelihood that the combination of the vulnerability and the second vulnerability is exploited together in the attack comprises evaluating one or more CVE chain datasets derived from the EDR data, each CVE chain dataset indicating an empirically observed frequency with which the vulnerability and the second vulnerability have been exploited together across a plurality of computing environments, the empirically observed frequency being normalized using the application attributes that comprise prevalence data indicating whether the application is prevalent among a plurality of computing devices in the computing environment, wherein determining the likelihood of the vulnerability further comprises determining, based on the usefulness score, a probability for user privileges in the computing environment to be escalated if the vulnerability was exploited, wherein the vulnerability attributes are indicative of a vulnerability age indicating when the vulnerability initially appeared in other computing environments prior to being identified in the computing environment; and prioritize a repair of the vulnerability based on the vulnerability risk score to minimize computing resource consumption by the vulnerability. ### Claim 12 (depends on 11) The system of claim 11, wherein to determine the likelihood of the vulnerability being exploited in the attack is further based on at least one or more historical CVE attributes of the vulnerability in the computing environment. ### Claim 13 (depends on 12) The system of claim 12, wherein the application attributes comprise an attack history of the application. ### Claim 14 (depends on 12) The system of claim 12, wherein the vulnerability attributes of the vulnerability in the computing environment are further indicative of a weakness category associated with the vulnerability being exploited in the attack. ### Claim 15 (depends on 12) The system of claim 12, wherein the EDR data is associated with the plurality of computing environments, and wherein to generate the vulnerability risk score, the one or more processors to: calculate, based on the EDR data, a frequency in which the vulnerability might be exploited in the attack. ### Claim 16 (depends on 12) The system of claim 12, wherein the vulnerability in the computing environment exists on the client device. ### Claim 17 (depends on 12) The system of claim 12, wherein the vulnerability in the computing environment exists on the client device, and wherein to generate the vulnerability risk score, the one or more processors to: determine a capability of the client device to defend against the vulnerability being exploited in the attack; and adjust the likelihood of the vulnerability being exploited in the attack based on the capability of the client device to defend against the vulnerability being exploited in the attack. ### Claim 18 (depends on 12) The system of claim 12, wherein the computing environment is associated with a client, wherein to generate the vulnerability risk score, the one or more processors to: determine the likelihood of the vulnerability being exploited in the attack based on an industry type associated with the client or a geographic location associated with the client. ### Claim 19 (depends on 12) The system of claim 12, wherein to generate the vulnerability risk score, the one or more processors to: determine the likelihood of the vulnerability being exploited in the attack based on prior attacks observed in the computing environment, or receive the EDR data from the client device, wherein the vulnerability in the computing environment exists on the client device; and calculate, based on the EDR data, a frequency in which the vulnerability might be exploited in the attack. ### Claim 20 A non-transitory computer-readable medium storing instructions that, when executed by one or more processors, cause the one or more processors to: acquire one or more environment variables associated with a computing environment; identify a vulnerability in the computing environment based on a vulnerability database (VDB) and the one or more environment variables associated with the computing environment; generate an input dataset based on at least one of behavioral-based endpoint detection and response (EDR) data associated with the vulnerability; apply one or more predictive models, respectively trained to predict probabilities of exploitation of vulnerabilities of computing environments, to the input dataset; generate, by the one or more processors, a vulnerability risk score for the vulnerability of the computing environment based on the input dataset and the one or more predictive models, wherein to generate the vulnerability risk score, the one or more processors are further to determine a likelihood of the vulnerability being exploited in an attack based on application attributes of an application associated with the vulnerability and vulnerability attributes of the vulnerability in the computing environment and a usefulness score associated with the vulnerability being exploited in the attack, wherein generating the vulnerability risk score further comprises identifying a second vulnerability that co-exists on a client device with the vulnerability and determining a likelihood that a combination of the vulnerability and the second vulnerability is being exploited together in the attack, wherein determining the likelihood that the combination of the vulnerability and the second vulnerability is exploited together in the attack comprises evaluating one or more CVE chain datasets derived from the EDR data, each CVE chain dataset indicating an empirically observed frequency with which the vulnerability and the second vulnerability have been exploited together across a plurality of computing environments, the empirically observed frequency being normalized using the application attributes that comprise prevalence data indicating whether the application is prevalent among a plurality of computing devices in the computing environment, wherein determining the likelihood of the vulnerability further comprises determining, based on the usefulness score, a probability for user privileges in the computing environment to be escalated if the vulnerability was exploited, wherein the vulnerability attributes are indicative of a vulnerability age indicating when the vulnerability initially appeared in other computing environments prior to being identified in the computing environment; and prioritize a repair of the vulnerability based on the vulnerability risk score to minimize computing resource consumption by the vulnerability.