Method and system to manage risk of vulnerabilities and corresponding change actions to address malware threats

Patent metadata

Field	Value
Publication number	US-10778713-B2
Application number	US-201815904529-A
Country	US
Kind code	B2
Filing date	Feb 26, 2018
Priority date	Feb 26, 2018
Publication date	Sep 15, 2020
Grant date	Sep 15, 2020

Abstract

A system includes a memory that stores computer executable components and neural network data, and a processor executes computer executable components stored in the memory. An assessment component assesses a computer network, and classifies the computer network relative to M network classifications stored in a repository, wherein M is an integer greater than one. A risk component determines risk of vulnerability subject to change impact regarding protection against a computer virus or cyber-attack based on historical information regarding vulnerability exposure and vulnerability remediation changes relative to the classification of the computer network. A recommendation component that generates recommendations and best action to mitigate risk and impact, and remediate the vulnerabilities based on the risk assessment and business priorities.

First claim

What is claimed is:

1. A system, comprising:
a memory that stores computer executable components and neural network data;
a processor that executes computer executable components stored in the memory, wherein the computer executable components comprise:
an assessment component that assesses a computer network, and classifies the computer network relative to M network classifications stored in a repository, wherein M is an integer greater than one;
a risk component that determines risk of vulnerability subject to change impact regarding protecting against a computer virus or cyber-attack based on historical information regarding vulnerability exposure and vulnerability remediation changes relative to the classification of the computer network, wherein the risk component identifies one or more past changes that caused an incident in the historical information based at least on structured documentation; and
a recommendation component that generates recommendations and best action to mitigate risk and impact, and remediate the vulnerabilities based on the risk assessment and business priorities.

2. The system of claim 1 , wherein the risk component comprises a predictive model that predicts the risk of a change based on incident history.

3. The system of claim 2 , wherein the predictive model comprises at least one of: a logical regression model; a Bayesian network; a neural network; hidden Markov model (HMM); or a support vector machine (SVM).

4. The system of claim 2 , wherein the incident history comprises at least one of: category of change; owner group performing changes; similar changes; affected configuration items; or questionnaire answers indicating risk.

5. The system of claim 1 , wherein the risk component identifies the one or more past changes that caused the incident through at least one of: scanning incident resolutions, problem records, or root cause analysis data for evidence of a change causing the incident.

6. The system of claim 1 , wherein the risk component identifies the one or more past changes that caused the incident through probabilistic linkage of changes and the incident based on a predictive model.

7. The system of claim 4 , wherein the risk component identifies similar changes through classifying changes into pre-defined categories.

8. The system of claim 7 , wherein a natural language classifier (NLC) is employed in connection with the classification of changes into pre-define categories.

9. The system of claim 4 , wherein the risk component identifies similar changes through fine-grained similarity measures factoring cosine-similarity of change request descriptions, configuration items affected, or change owner.

10. The system of claim 1 , wherein the risk component identifies current vulnerability of the computer network.

11. A computer-implemented method, comprising employing a processor and memory to execute computer executable components to perform the following acts:
assessing a computer network, and classifying the computer network relative to M network classifications stored in a repository, wherein M is an integer greater than one;
determining risk of vulnerability subject to change impact regarding protection against a computer virus or cyber-attack based on historical information regarding vulnerability exposure and vulnerability remediation changes relative to the classification of the computer network, wherein the determining the risk of vulnerability subject to change impact regarding protection against a computer virus or cyber-attack comprises identifying one or more past changes that caused an incident in the historical information based on at least one of: scanning incident resolutions, problem records, or root cause analysis data for evidence of a change causing the incident; and
generating recommendations and best action to mitigate risk and impact, and remediate the vulnerabilities based on the risk assessment and business priorities.

12. The method of claim 11 , wherein determining risk comprises using a predictive model that predicts the risk of a change based on incident history.

13. The method of claim 12 , wherein the incident history comprises at least one of: category of change; owner group performing changes; similar changes; affected configuration items; or questionnaire answers indicating risk.

14. The method of claim 11 , wherein the identifying the one or more changes in the past that caused the incident is further based on structured documentation.

15. The method of claim 11 , wherein the identifying the one or more changes in the past that caused the incident is further based on probabilistic linkage of changes and the incident based on a predictive model.

16. The method of claim 11 , further comprising identifying current vulnerability of the computer network.

17. A computer program product comprising a computer readable storage medium having program instructions embodied therewith, the program instructions executable by processor to cause the processor to:
assess a computer network, and classify the computer network relative to M network classifications stored in a repository, wherein M is an integer greater than one;
determine risk of vulnerability subject to change impact regarding protection against a computer virus or cyber-attack based on historical information regarding vulnerability exposure and vulnerability remediation changes relative to the classification of the computer network, wherein the determination of the risk of vulnerability subject to change impact regarding protection against a computer virus or cyber-attack comprises identification of one or more past changes that caused an incident in the historical information based at least on probabilistic linkage of changes and the incident according to a predictive model; and
generate recommendations and best action to mitigate risk and impact, and remediate the vulnerabilities based on the risk assessment and business priorities.

18. The computer program product of claim 17 , further comprising program instructions executable by processor to cause the processor to determine risk and impact comprises using the predictive model that predicts the risk of a change based on incident history.

19. The computer program product of claim 17 , further comprising program instructions executable by processor to cause the processor to identify current vulnerability of the computer network.

20. The computer program product of claim 17 , wherein identification of the one or more changes in the past that caused the incident is further based on structured documentation.

21. The computer program product of claim 17 , wherein identification of the one or more changes in the past that caused the incident is further based on at least one of: scanning incident resolutions, problem records, or root cause analysis data for evidence of a change causing the incident.

22. The computer program product of claim 17 , wherein the predictive model comprises at least one of: a logical regression model; a Bayesian network; a neural network; hidden Markov model (HMM); or a support vector machine (SVM).

23. The computer program product of claim 18 , wherein the incident history comprises at least one of: category of change; owner group performing changes; similar changes; affected configuration items; or questionnaire answers indicating risk.

Assignees

• IBM

Inventors

• Zeng Sai
• Sreedhar Vugranam C
• Murthy Karin
• Hwang Jinho
• Hernandez Milton H
• Chavez Lisa M
• Bulut Muhammed Fatih
• Mayo Virginia
• Wang Xinli
• Mullen Cindy

Classifications

• G06N7/01

  Probabilistic graphical models, e.g. probabilistic networks · CPC title

• G06N3/0499

  Feedforward networks · CPC title

• G06N3/09

  Supervised learning · CPC title

• H04L63/145 Primary

  the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms · CPC title

• G06N20/00

  Machine learning · CPC title