Automated response to computer vulnerabilities
OwnerMichel Ferreira Barbosa, Paulo Cesar Raponiinventors
Life of this patent
Estimating the term…
Abstract
Each of the plurality of network assets on the private network is identified and categorized according to a CPE for storage in a device inventory database, and to generate an asset profile for each of the plurality of network assets. Attacks on the plurality of assets related to each of the identified CPEs are identified and monitored according to a CVE (common vulnerabilities exposures) format, and determine whether the CVE is relevant against the asset profile. Responsive to detecting a relevant CVE notification including CVE-id, impact on one or more network assets affected by the CVE based on the asset profiles is determined. The impact is either low impact, high impact and blocked, or high impact and unblocked.
Claims6
A gateway device, coupled to a plurality of network assets on a private network and coupled to a public data communication network, for automatically assessing impact of attacks on the network assets from the public data communication network, the gateway device comprising:
- a processor;
- a communication interface, communicatively coupled to the data communication network;
- and
- a memory, communicatively coupled to the processor and storing:
- a CPE (common platform enumerations) module to identify and categorize according to a CPE format each of the plurality of network assets on the private network for storage in a device inventory database, and to generate an asset profile for each of the plurality of network assets;
- a CVE (common vulnerabilities exposures) module to monitor and categorize attacks on the plurality of assets related to each of the identified CPEs according to a CVE format, and determine whether the CVE format is relevant against the asset profiles;
- an impact module to responsive to detecting an attack comprising a relevant CVE notification including a CVE-ID, determine impact on one or more network assets affected by the CVE based on the asset profiles, wherein the impact is either low impact, high impact and blocked, or high impact and unblocked;
- and
- a security action module to take security action based on the impact.
A non-transitory computer-readable media in a gateway device, coupled to a plurality of network assets on a private network and coupled to a public data communication network, when executed by a processor, performs a method of automatically assessing impact of attacks on the network assets from the public data communication network, the method comprising:
- identifying and categorizing according to a CPE (common platform enumerations) format each of the plurality of network assets on the private network for storage in a device inventory database, and to generate an asset profile for each of the plurality of network assets;
- monitoring and categorizing attacks on the plurality of assets related to each of the identified CPEs according to a CVE format, and determine whether the CVE (common vulnerabilities exposures) format is relevant against the asset profiles;
- responsive to detecting an attack comprising a relevant CVE notification including a CVE-ID, determine impact on one or more network assets affected by the CVE based on the asset profiles, wherein the impact is determined from a list of impacts consisting of either low impact, high impact and blocked, and high impact and unblocked;
- and
- taking a security action based on the impact.
A method in a gateway device, coupled to a plurality of network assets on a private network and coupled to a public data communication network, for automatically assessing impact of attacks on the network assets from the public data communication network, the method comprising:
- identifying and categorizing according to a CPE (common platform enumerations) format each of the plurality of network assets on the private network for storage in a device inventory database, and to generate an asset profile for each of the plurality of network assets;
- monitoring and categorizing attacks on the plurality of assets related to each of the identified CPEs according to a CVE format, and determine whether the CVE (common vulnerabilities exposures) format is relevant against the asset profiles;
- responsive to detecting an attack comprising a relevant CVE notification including a CVE-ID, determine impact on one or more network assets affected by the CVE based on the asset profiles, wherein the impact is determined from a list of impacts consisting of is low impact, high impact and blocked, and high impact and unblocked;
- and
- taking a security action based on the impact.
Dependencies are inferred from the claim text.