# US 8,544,098 B2 · Security vulnerability information aggregation > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 8,544,098 B2 - Document ID: US8544098B2 - Status: Granted - Kind: B2 - Application number: 11/366,319 - Filed: 2006-03-02 - Published: 2007-03-22 - Granted: 2013-09-24 - Earliest claimed: 2005-09-22 - Assignees: Alcatel Lucent - Applicants: Christophe Gustave; Stanley TaiHai Chow; Douglas Wiemer - Inventors: Christophe Gustave; Stanley TaiHai Chow; Douglas Wiemer - Web page: https://patentgrep.com/patent/US8544098B2 ## CPC - H04L 63/1433: {Vulnerability analysis} - G06F 21/577: {Assessing vulnerabilities and evaluating computer system security} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Security vulnerability information aggregation techniques are disclosed. Vulnerability information associated with one or more security vulnerabilities is obtained from multiple sources and aggregated into respective unified vulnerability definitions for the one or more security vulnerabilities. Aggregation may involve format conversion, content aggregation, or both in some embodiments. Unified vulnerability definitions may be distributed to vulnerability information consumers in accordance with consumer-specific policies. Storage of vulnerability information received from the sources may allow the aggregation process to be performed on existing vulnerability information “retro-actively”. Related data structures and Graphical User Interfaces (GUIs) are also disclosed. ## Claims ### Claim 1 An apparatus comprising: an interface to receive from a plurality of sources vulnerability definition information that defines a plurality of security vulnerabilities; a policies store to store one or more aggregation policies, the one or more aggregation policies specifying respective sets of distribution parameters for one or more vulnerability definition information consumers; one or more output interfaces to enable transmission of vulnerability definitions to respective groups of the one or more vulnerability definition information consumers; an aggregator, operatively coupled to the interface, to the policies store, and to the one or more output interfaces, to receive the vulnerability definition information through the interface, to aggregate the vulnerability definition information that defines one or more security vulnerabilities into a respective unified vulnerability description for each of the one or more security vulnerabilities in accordance with the aggregation policy of a vulnerability definition information consumer in the policies store, and to distribute the respective unified vulnerability description for each of the one or more security vulnerabilities to the vulnerability definition information consumer through an output interface of the one or more output interfaces, wherein the vulnerability definition information received from each source comprises respective source content arranged according to a respective source format, and wherein the aggregator comprises: a plurality of format adapters operatively coupled to the interface, the plurality of format adapters comprising respective format adapters configured to convert a format of vulnerability definition information that defines the one or more respective security vulnerabilities and is received from a respective source into a format of the one or more respective unified vulnerability descriptions; and a content aggregator operatively coupled to the plurality of format adapters and configured to determine portions of the one or more respective unified vulnerability descriptions based on corresponding portions of source content in the converted vulnerability definition information received from the plurality of sources and converted by the plurality of format adapters. ### Claim 2 (depends on 1) The apparatus of claim 1, wherein the interface comprises a plurality of interfaces, each interface of the plurality of interfaces being configured to receive vulnerability definition information from a respective group of one or more sources. ### Claim 3 (depends on 1) The apparatus of claim 1, wherein the aggregator comprises a plurality of format adapters operatively coupled to the interface, the plurality of format adapters comprising respective format adapters configured to convert a format of the vulnerability definition information that defines the one or more respective security vulnerabilities and is received from a respective source into a format of the one or more respective unified vulnerability descriptions. ### Claim 4 (depends on 3) The apparatus of claim 3, wherein the aggregator further comprises a content aggregator operatively coupled to the plurality of format adapters and configured to determine portions of the one or more respective unified vulnerability descriptions based on corresponding portions of the vulnerability definition information received from the plurality of sources and converted by the plurality of format adapters. ### Claim 5 (depends on 4) The apparatus of claim 4, wherein the content aggregator is further configured to detect a conflict where vulnerability definition information that is received from one source of the plurality of sources conflicts with vulnerability definition information that is received from a different source of the plurality of sources, and wherein the aggregator further comprises at least one of: a conflict resolution module operatively coupled to the content aggregator and configured to resolve a conflict detected by the content aggregator; and a conflict alert module operatively coupled to the content aggregator and configured to allow a user to resolve a conflict detected by the content aggregator. ### Claim 6 (depends on 4) The apparatus of claim 4, wherein the content aggregator is further configured to detect a conflict where vulnerability definition information that is received from one source of the plurality of sources conflicts with vulnerability definition information that is received from a different source of the plurality of sources, and wherein the aggregator further comprises: a conflict rules store to store a set of conflict rules; and a conflict resolution module, operatively coupled to the content aggregator and to the conflict rules store, configured to resolve, based on the set of conflict rules stored in the conflict rules store, a conflict detected by the content aggregator. ### Claim 7 (depends on 1) The apparatus of claim 1, further comprising: a user interface, operatively coupled to the aggregator, for providing a representation of the respective unified vulnerability description. ### Claim 8 (depends on 1) The apparatus of claim 1, further comprising: a vulnerability definition information store, operatively coupled to the interface and to the aggregator, for storing the vulnerability definition information that defines the plurality of security vulnerabilities, wherein the aggregator is further configured to, responsive to a change in an aggregation policy in the policies store, retrieve from the vulnerability definition information store vulnerability definition information that defines one or more respective security vulnerabilities in accordance with the changed aggregation policy, aggregate the retrieved vulnerability definition information into one or more respective unified vulnerability descriptions, and distribute the one or more respective unified vulnerability descriptions through an output interface of the one or more output interfaces to a vulnerability definition information consumer for which the changed aggregation policy specifies distribution parameters. ### Claim 9 A method comprising: obtaining, by an aggregator, from a plurality of sources vulnerability definition information that defines a plurality of security vulnerabilities; aggregating, by the aggregator, the vulnerability definition information that defines one or more security vulnerabilities into a respective unified vulnerability description for each of the one or more security vulnerabilities in accordance with an aggregation policy that specifies a set of distribution parameters for a vulnerability definition information consumer; and distributing, by the aggregator, the respective unified vulnerability description for each of the one or more security vulnerabilities to the vulnerability definition information consumer, wherein the vulnerability definition information obtained from each source comprises respective source content arranged according to a respective source format, wherein the method further comprises: converting the vulnerability definition information associated with the one or more respective security vulnerabilities from each source format into a format of the one or more respective unified vulnerability descriptions, wherein aggregating comprises determining portions of the one or more respective unified vulnerability descriptions based on corresponding portions of source content in the converted vulnerability definition information obtained from the plurality of sources. ### Claim 10 (depends on 9) The method of claim 9, wherein aggregating comprises converting, in respective format adapters, formats of the vulnerability definition information that is received from different sources of the plurality of sources and defines the one or more respective security vulnerabilities into a format of the one or more respective unified vulnerability descriptions. ### Claim 11 (depends on 10) The method of claim 10, wherein aggregating comprises determining portions of the one or more respective unified vulnerability descriptions based on portions of the vulnerability definition information received from the plurality of sources and converted by the format adapters. ### Claim 12 (depends on 9) The method of claim 9, wherein aggregating comprises: detecting a conflict where vulnerability definition information that is received from one source of the plurality of sources conflicts with vulnerability definition information that is received from a different source of the plurality of sources; and resolving a detected conflict in accordance with at least one of: a set of one or more conflict rules, and a user input. ### Claim 13 (depends on 9) The method of claim 9, further comprising: providing a representation of the respective unified vulnerability description. ### Claim 14 (depends on 9) The method of claim 9, wherein obtaining comprises at least one of: requesting vulnerability definition information; and receiving vulnerability definition information. ### Claim 15 A non-transitory machine-readable medium storing instructions which when executed perform a method comprising: obtaining from a plurality of sources vulnerability definition information that defines a plurality of security vulnerabilities; aggregating the vulnerability definition information that defines one or more security vulnerabilities into a respective unified vulnerability description for each of the one or more security vulnerabilities in accordance with an aggregation policy that specifies a set of distribution parameters for a vulnerability definition information consumer; and distributing the respective unified vulnerability description for each of the one or more security vulnerabilities to the vulnerability definition information consumer, wherein the vulnerability definition information obtained from each source comprises respective source content arranged according to a respective source format, wherein the method further comprises: converting the vulnerability definition information associated with the one or more respective security vulnerabilities from each source format into a format of the one or more respective unified vulnerability descriptions, wherein aggregating comprises determining portions of the one or more respective unified vulnerability descriptions based on corresponding portions of source content in the converted vulnerability definition information obtained from the plurality of sources.