Cybersecurity vulnerability classification and remediation based on network utilization

Patent metadata

Field	Value
Publication number	US-11277429-B2
Application number	US-201816196544-A
Country	US
Kind code	B2
Filing date	Nov 20, 2018
Priority date	Nov 20, 2018
Publication date	Mar 15, 2022
Grant date	Mar 15, 2022

Abstract

A technology solution for remediating a cyberattack risk in a computing resource asset in a network system. The technology solution includes monitoring data traffic directed to the computing resource asset in the network system along with data traffic to one or more additional computing resource assets in the network system, generating network utilization data based on the monitored data traffic to the computing resource asset and the monitored data traffic to the one or more additional computing resource assets in the network system, receiving a common vulnerability score (CVSS) for a vulnerability in the computing resource asset, determining a network traffic adjustment (NTA) value for the common vulnerability score (CVSS) based on the network utilization data, adjusting the common vulnerability score (CVSS) by the network traffic adjustment (NTA) value to generate a prioritized common vulnerability score (PCVSS) for the computing resource asset, and remediating the computing resource asset to resolve the vulnerability based on the prioritized common vulnerability (PCVSS) score.

First claim

What is claimed is:

1. A method for remediating a cyberattack risk in a computing resource asset in a network system, the method comprising:
monitoring data traffic directed to a computing resource asset in a network system along with data traffic to one or more additional computing resource assets in the network system;
generating network utilization data based on the monitored data traffic to the computing resource asset and the monitored data traffic to the one or more additional computing resource assets in the network system;
receiving a Common Vulnerability Scoring System score for a vulnerability in the computing resource asset;
determining a network traffic adjustment value for the Common Vulnerability Scoring System score based on the network utilization data;
calculating a sum of the Common Vulnerability Scoring System score and the network traffic adjustment value by numerically adding the network traffic adjustment value to the Common Vulnerability Scoring System score to generate a prioritized common vulnerability score for the computing resource asset; and
remediating the computing resource asset to resolve the vulnerability based on the prioritized common vulnerability score,
wherein the network traffic adjustment value comprises a 0.0, a 1.0, or a 2.0,
wherein the data traffic is monitored based on a server log,
wherein the network utilization data comprises a ranking threshold
based on a predetermined percentile range of network traffic directed to the computing resource asset during a predetermined period of time,
wherein the network utilization data is selected from an amount of traffic value and a pro rata traffic value,
wherein the amount of traffic value represents an amount of data traffic passing through or received by the computing resource asset, and
wherein the pro rata traffic value is associated with the computing resource asset.

2. The method in claim 1 , wherein the data traffic is monitored by a Security Information and Event Management system.

3. The method in claim 1 , wherein the Common Vulnerability Scoring System score comprises a base score.

4. The method in claim 3 , wherein the Common Vulnerability Scoring System score comprises at least one of a temporal score and an environment score that fine tunes the base score.

5. A non-transitory computer readable medium having stored thereon instructions for remediating a vulnerability in a computing resource asset in a network system comprising machine executable code which, when executed by at least one computing device, causes the at least one computing device to perform steps comprising:
monitoring data traffic directed to a computing resource asset in a network system along with data traffic to one or more additional computing resource assets in the network system;
generating network utilization data based on the monitored data traffic to the computing resource asset and the monitored data traffic to the one or more additional computing resource assets in the network system;
receiving a Common Vulnerability Scoring System score for a vulnerability in the computing resource asset;
determining a network traffic adjustment value for the Common Vulnerability Scoring System score based on the network utilization data;
calculating a sum of the Common Vulnerability Scoring System score and the network traffic adjustment value by numerically adding the network traffic adjustment value to the Common Vulnerability Scoring System score to generate a prioritized common vulnerability score for the computing resource asset; and
remediating the computing resource asset to resolve the vulnerability based on the prioritized common vulnerability score,
wherein the network traffic adjustment value comprises a 0.0, a 1.0, or a 2.0,
wherein the data traffic is monitored based on a server log,
wherein the network utilization data comprises a ranking threshold, and
based on a predetermined percentile range of network traffic directed to the computing resource asset during a predetermined period of time,
wherein the network utilization data is selected from an amount of traffic value and a pro rata traffic value,
wherein the amount of traffic value represents an amount of data traffic passing through or received by the computing resource asset, and
wherein the pro rata traffic value is associated with the computing resource asset.

6. The non-transitory computer readable medium in claim 5 , wherein the network utilization data is based on traffic data received from a Security Information and Event Management system.

7. A cyberattack risk remediation system for remediating a vulnerability in a computing resource asset in a network, the system comprising:
a network traffic adjustment unit that
receives a Common Vulnerability Scoring System score for a vulnerability on a computing resource asset in a network,
generates network utilization data for the computing resource asset based on data traffic to the computing resource asset compared to one or more other computing resource assets in the network,
determines a network traffic adjustment value for the Common Vulnerability Scoring System score based on the network utilization data, and
calculates a sum of the Common Vulnerability Scoring System score and the network traffic adjustment value by numerically adding the network traffic adjustment value to the Common Vulnerability Scoring System score to generate a prioritized common vulnerability score for the computing resource asset; and

a client device that remediates the vulnerability,
wherein the network traffic adjustment value comprises a 0.0, a 1.0, or a 2.0,
wherein the data traffic is monitored based on a server log,
wherein the network utilization data comprises a ranking threshold
based on a predetermined percentile range of network traffic directed to the computing resource asset during a predetermined period of time,
wherein the network utilization data is selected from an amount of traffic value and a pro rata traffic value,
wherein the amount of traffic value represents an amount of data traffic passing through or received by the computing resource asset, and
wherein the pro rata traffic value is associated with the computing resource asset.

Assignees

• Saudi Arabian Oil Co

Inventors

• Ababtain Mohammed Ahmad
• Alsharif Sultan Saadaldean

Classifications

• H04L43/16

  Threshold monitoring · CPC title

• H04L63/1433 Primary

  Vulnerability analysis · CPC title

• H04L63/1441

  Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002) · CPC title

• H04L43/062

  related to network traffic · CPC title

• H04L63/1416

  Event detection, e.g. attack signature detection · CPC title