CONTEXT AWARE VULNERABILITY PRIORITIZATION SYSTEM USING SOFTWARE BILL OF MATERIALS (SBOMs)

A non-transitory computer-readable medium for storing instructions for executing a process, the instructions comprising:

• in response determining that Software Bill of Materials (SBOM) data is valid, performing steps comprising:
• obtaining from a plurality of sources contextual data that comprises environmental data and device data;
• and
• verifying an integrity of the contextual data,
• standardizing the contextual data into a standardized format;
• using common vulnerability exposure (CVE) data from a CVE database and the SBOM data to determine a vulnerability matching;
• applying metrics to obtain severity information;
• combing the severity information with at least some of the contextual data to obtain combined data;
• determining an overall risk associated with the combined data;
• based on the overall risk, assigning risk scores to vulnerabilities, each risk score indicating a severity of vulnerability;
• assigning priorities to risks associated with each risk score to obtain prioritized data;
• in response to determining that the prioritized data is at least one of purely contextual data, purely device data, or a data combination thereof, outputting a level from a plurality of levels;
• and
• based on the level, providing in real-time a context-aware vulnerability alert to initiate a threat response.

An apparatus, comprising:

• a processor, configured to perform steps comprising:
• in response determining that Software Bill of Materials (SBOM) data is valid, obtaining from a plurality of sources contextual data that comprises environmental data and device data;
• and
• verifying an integrity of the contextual data,
• standardizing the contextual data into a standardized format;
• using common vulnerability exposure (CVE) data from a CVE database and the SBOM data to determine a vulnerability matching;
• applying metrics to obtain severity information;
• combing the severity information with at least some of the contextual data to obtain combined data;
• determining an overall risk associated with the combined data;
• based on the overall risk, assigning risk scores to vulnerabilities, each risk score indicating a severity of vulnerability;
• assigning priorities to risks associated with each risk score to obtain prioritized data;
• in response to determining that the prioritized data is at least one of purely contextual data, purely device data, or a data combination thereof, outputting a level from a plurality of levels;
• and
• based on the level, providing in real-time a context-aware vulnerability alert to initiate a threat response.