US 2022/0019673 A1Published application

System and Method for Associating a Common Vulnerability and Exposures (CVE) with a Computing Device and Applying a Security Patch

AssigneeBank of America Corporation

InventorsDaniel Joseph Serna, Christopher Lee Danielson

Life of this patent

Estimating the term…

Loading patent…

Abstract

A system is configured for associating a CVE with a particular device profile is disclosed. The system receives a request from a user to associate a CVE with a particular device profile. For each device profile from a plurality of device profiles stored in a memory, the system determines feature importance values for features of each device profile. The features of each device profile include at least an operating system and a CPU architecture. The feature importance value of a corresponding feature of a device profile associated with a CVE indicates a probability of the CVE to affect the device profile with respect to that feature. The system identifies a device profile that has features with a total feature importance value above a feature importance threshold value. The system identifies a particular CVE associated with the identified device profile. The system associates the particular CVE with the particular device profile.

Claims20

Dependent claims

A system for associating a common vulnerability and exposure (CVE) with a particular device profile, comprising:

a memory operable to store a plurality of CVEs and a plurality of device profiles, each device profile associated with a corresponding CVE, wherein each device profile comprises features of a device, and the features comprise at least two of an operating system, a CPU architecture, a GPU architecture, a memory architecture, and an installed software of the device;
and
a processor operably coupled to the memory, configured to:
receive a request from a user to associate a CVE with a particular device profile;
for each device profile from among the plurality of device profiles stored in the memory, determine feature importance values for features of each device profile, wherein a feature importance value of a corresponding feature of a device profile associated with a CVE indicates a probability of the CVE to affect the device profile with respect to that feature;
identify a device profile from among the plurality of device profiles that has one or more features in common with the particular device profile, wherein the one or more features are associated with a total feature importance value above a feature importance threshold value, and the total feature importance value of the device profile is a sum of feature importance values of the one or more features of the device profile in common with the particular device profile;
identify a particular CVE associated with the identified device profile;
and
associate the particular CVE with the particular device profile.

6 more elements

A method for associating a common vulnerability and exposure (CVE) with a particular device profile, comprising:

receiving a request from a user to associate a CVE with a particular device profile;
for each device profile from among a plurality of device profiles stored in a memory, determining feature importance values for features of each device profile, wherein a feature importance value of a corresponding feature of a device profile associated with a CVE indicates a probability of the CVE to affect the device profile with respect to that feature;
identifying a device profile from among the plurality of device profiles that has one or more features in common with the particular device profile, wherein the one or more features are associated with a total feature importance value above a feature importance threshold value, and the total feature importance value of the device profile is a sum of feature importance values of the one or more features of the device profile in common with the particular device profile;
identifying a particular CVE associated with the identified device profile;
and
associating the particular CVE with the particular device profile.

3 more elements

A computer program comprising executable instructions stored in a non-transitory computer-readable medium that when executed by a processor causes the processor to:

receive a request from a user to associate a CVE with a particular device profile;
for each device profile from among a plurality of device profiles stored in a memory, determine feature importance values for features of each device profile, wherein a feature importance value of a corresponding feature of a device profile associated with a CVE indicates a probability of the CVE to affect the device profile with respect to that feature;
identify a device profile from among the plurality of device profiles that has one or more features in common with the particular device profile, wherein the one or more features are associated with a total feature importance value above a feature importance threshold value, and the total feature importance value of the device profile is a sum of feature importance values of the one or more features of the device profile in common with the particular device profile;
identify a particular CVE associated with the identified device profile;
and
associate the particular CVE with the particular device profile.

3 more elements

Dependencies are inferred from the claim text.