# US 2020/0401704 A1 · Exploit prediction based on machine learning > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2020/0401704 A1 - Document ID: US20200401704A1 - Status: Published application - Kind: A1 - Application number: 17/008,515 - Filed: 2020-08-31 - Published: 2020-12-24 - Earliest claimed: 2017-11-30 - Assignees: Kenna Security, Inc. - Applicants: Kenna Security, Inc. - Inventors: Edward T. Bellis; Michael Roytman; Jeffrey Heuer - Web page: https://patentgrep.com/patent/US20200401704A1 ## CPC - G06F 21/577: {Assessing vulnerabilities and evaluating computer system security} - G06N 20/00: Machine learning - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS ## Abstract Generation of one or more models is caused based on selecting training data comprising a plurality of features including a prevalence feature for each vulnerability of a first plurality of vulnerabilities. The one or more models enable predicting whether an exploit will be developed for a vulnerability and/or whether the exploit will be used in an attack. The one or more models are applied to input data comprising the prevalence feature for each vulnerability of a second plurality of vulnerabilities. Based on the application of the one or more models to the input data, output data is received. The output data indicates a prediction of whether an exploit will be developed for each vulnerability of the second plurality. Additionally or alternatively, the output data indicates, for each vulnerability of the second plurality, a prediction of whether an exploit that has yet to be developed will be used in an attack. ## Claims ### Claim 1 A system comprising: storage media; one or more processors; and one or more programs stored in the storage media and configured for execution by the one or more processors, the one or more programs comprising instructions which, when executed by the one or more processors, cause performance of: training a first prediction model using first training data comprising one or more features for each software vulnerability of a first plurality of software vulnerabilities, wherein the first prediction model enables computing a probability that an exploit is to be developed for a particular software vulnerability; causing application of the first prediction model to first input data comprising the one or more features for each software vulnerability of a second plurality of software vulnerabilities; receiving, based on the application of the first prediction model to the first input data, first output data that indicates, for each software vulnerability of the second plurality of software vulnerabilities, a probability that an exploit will be developed for said each software vulnerability. ### Claim 2 (depends on 1) The system of claim 1, wherein the one or more programs further comprise instructions which, when executed by the one or more processors, cause performance of: based on the first output data, causing an adjustment to prioritization for one or more of the second plurality of software vulnerabilities. ### Claim 3 (depends on 1) The system of claim 1, wherein the one or more features indicate a number of copies of software affected by said each software vulnerability of the first plurality of software vulnerabilities. ### Claim 4 (depends on 1) The system of claim 1, wherein the one or more features indicate a number of copies of software affected by said each software vulnerability of the first plurality of software vulnerabilities, and wherein each software vulnerability of the first plurality of software vulnerabilities has a ranking determined based on a number of copies of software affected by said each software vulnerability, and wherein the one or more prevalence features includes an indication of whether the ranking of said each software vulnerability is less than a predetermined threshold. ### Claim 5 (depends on 1) The system of claim 1, wherein the one or more features indicate a number of references, in a database, to each software vulnerability of the first plurality of software vulnerabilities. ### Claim 6 (depends on 1) The system of claim 1, wherein the one or more features indicate a number of products that are affected by each software vulnerability of the first plurality of software vulnerabilities. ### Claim 7 (depends on 1) The system of claim 1, wherein the first training data further a textual description feature comprising data extracted from a textual description of each software vulnerability of the first plurality of software vulnerabilities. ### Claim 8 (depends on 1) The system of claim 1, wherein the first training data further comprises an exploit development time feature indicating, for each software vulnerability of the first plurality of software vulnerabilities, whether an exploit for said each software vulnerability was developed within a particular number of days of publication of said each software vulnerability. ### Claim 9 (depends on 8) The system of claim 8, wherein the first output data indicates, for each software vulnerability of the second plurality of software vulnerabilities, a prediction of whether an exploit will be developed for said each software vulnerability within the particular number of days. ### Claim 10 (depends on 1) The system of claim 1, wherein the first output data indicates, for each software vulnerability of the second plurality of software vulnerabilities, a prediction of a number of days that will elapse between publication of said each software vulnerability and development of an exploit for said each software vulnerability. ### Claim 11 A system comprising: storage media; one or more processors; and one or more programs stored in the storage media and configured for execution by the one or more processors, the one or more programs comprising instructions which, when executed by the one or more processors, cause performance of: training a first prediction model using first training data comprising one or more features for each software vulnerability of a first plurality of software vulnerabilities, wherein the first prediction model enables computing a probability that an exploit for a particular software vulnerability is to be developed and used in an attack; causing application of the prediction model to input data comprising one or more features for each software vulnerability of a second plurality of software vulnerabilities; receiving, based on the application of the prediction model to the input data, first output data that indicates, for each software vulnerability of the second plurality of software vulnerabilities, a probability that an exploit will be developed for said each software vulnerability and used in an attack. ### Claim 12 (depends on 11) The system of claim 11, wherein the one or more features indicate a number of copies of software affected by said each software vulnerability of the first plurality of software vulnerabilities. ### Claim 13 (depends on 11) The system of claim 11, wherein the one or more features indicate a number of references, in a database, to each software vulnerability of the first plurality of software vulnerabilities. ### Claim 14 (depends on 11) The system of claim 11, wherein each software vulnerability of the first plurality of software vulnerabilities has a ranking determined based on a number of copies of software affected by said each software vulnerability, and wherein the one or more prevalence features indicate whether the ranking of said each software vulnerability is less than a predetermined threshold. ### Claim 15 (depends on 10) The system of claim 10, wherein the input data comprises second output data that indicates, for each software vulnerability of the second plurality of software vulnerabilities, a probability that an exploit will be developed for said each software vulnerability. ### Claim 16 (depends on 11) The system of claim 11, wherein the training data further comprises an attack feature indicating whether each software vulnerability of the first plurality of software vulnerabilities has an exploit developed for said each software vulnerability that was used in an attack. ### Claim 17 (depends on 11) The system of claim 11, wherein the one or more programs further comprise instructions which, when executed by the one or more processors, cause performance of: based on the first output data, causing an adjustment to prioritization for one or more of the second plurality of software vulnerabilities. ### Claim 18 A method comprising: training a first prediction model using first training data comprising one or more features for each software vulnerability of a first plurality of software vulnerabilities, wherein the first prediction model enables computing a probability that an exploit is to be developed for a particular software vulnerability; causing application of the first prediction model to first input data comprising the one or more features for each software vulnerability of a second plurality of software vulnerabilities; receiving, based on the application of the first prediction model to the first input data, first output data that indicates, for each software vulnerability of the second plurality of software vulnerabilities, a probability that an exploit will be developed for said each software vulnerability. ### Claim 19 (depends on 18) The method of claim 18, further comprising: based on the first output data, causing an adjustment to prioritization for one or more of the second plurality of software vulnerabilities. ### Claim 20 (depends on 18) The method of claim 18 wherein the feature indicates one of: a number of copies of software affected by said each software vulnerability of the first plurality of software vulnerabilities; whether a ranking of said each software vulnerability is less than a predetermined threshold; a number of products that are affected by each software vulnerability of the first plurality of software vulnerabilities, or a number of references, in a database, to each software vulnerability of the first plurality of software vulnerabilities.