Systems and methods for predicting which software vulnerabilities will be exploited by malicious hackers to prioritize for patching

Patent metadata

Field	Value
Publication number	US-11892897-B2
Application number	US-201816640878-A
Country	US
Kind code	B2
Filing date	Oct 26, 2018
Priority date	Nov 3, 2017
Publication date	Feb 6, 2024
Grant date	Feb 6, 2024

Abstract

Various embodiments for predicting which software vulnerabilities will be exploited by malicious hackers and hence prioritized by patching are disclosed.

First claim

What is claimed is:

1. A method for assessing a likelihood of exploitation of software vulnerabilities, comprising:
utilizing a processor in operable communication with at least one memory for storing instructions that are executed by the processor to perform operations, including:
accessing a plurality of datasets associated with a predetermined set of data sources, the plurality of datasets including training data comprising hacker communications;
accessing features from the plurality of datasets that include measures computed from social connections of users posting hacking-related content
applying learning algorithms to the training data to generate classification models that are configured to predict class labels defining a likelihood of exploitation of respective software vulnerabilities;
accessing one or more features associated with a software vulnerability; and
computing, by applying the one or more features to the classification model, a class label defining one or more values defining a likelihood of exploitation associated with the software vulnerability, wherein the likelihood of exploitation predicts an actual exploitation of the respective software vulnerabilities before disclosure based on the hacker communications from the training data.

2. The method of claim 1 , further comprising generating a plurality of estimation outputs based on the one or more values to derive an overall quantitative score.

3. The method of claim 1 , wherein the plurality of datasets include vulnerability data for vulnerabilities that are publicly disclosed and obtaining exploits data for exploits that were used in real world attacks.

4. The method of claim 3 , further comprising:
aligning the exploits data with the vulnerability data; and
cleaning the exploits data of noise and predetermined portions of the exploits data that is irrelevant to associated software vulnerabilities.

5. The method of claim 1 , wherein certain features correspond to a known vulnerability obtained from the plurality of datasets.

6. The method of claim 1 , further comprising testing the classification models by applying additional training data and one or more algorithms and evaluation metrics to optimize the classification models until the classification models compute the likelihood of exploitation according to a predefined error rate.

7. The method of claim 1 , further comprising vectorizing text features derived from the plurality of datasets using term frequency-inverse document frequency to create a vocabulary of associated words.

8. The method of claim 1 , further comprising:
sorting vulnerabilities associated with the plurality of datasets according to time;
training the classification model using the training data, the training data defining a first subset of the plurality of datasets associated with a predetermined period of time; and
testing the classification model using a second subset of the plurality of datasets associated with the predetermined period of time.

9. The method of claim 1 , further comprising computing mutual information from the plurality of datasets informative as to what information a given feature provides about another feature.

10. The method of claim 1 , further comprising:
detecting, from the plurality of datasets, vulnerabilities that appear before an associated exploitation date.

11. The method of claim 1 , further comprising:
accessing features from the plurality of datasets that measure a centrality of the users in a social graph.

12. The method of claim 1 , further comprising:
accessing one or more features indicative of temporal connections between at least two of:
a time associated with discussion of a vulnerability by users posting hacking-related content at a web forum prior to disclosure to a public vulnerability database;
a time associated with disclosure of the vulnerability to the public vulnerability database; and
a time associated with exploitation of the vulnerability as obtained through exploits data associated with real-world exploitation of the vulnerability.

13. The method of claim 1 , further comprising vectorizing text features derived from textual content of the plurality of datasets using a predetermined natural language process (NPL).

14. A computing device, configured via machine learning to apply a learned function to data associated with a software vulnerability to estimate a likelihood of exploitation of the software vulnerability, the learned function associated with a prediction model derived from at least one machine learning algorithm and a plurality of datasets associated with software vulnerabilities, the plurality of datasets including information associated with discussion of vulnerabilities by users posting hacking-related content, wherein the likelihood of exploitation predicts an actual exploitation of the software vulnerability before disclosure based on hacker communications from the plurality of datasets.

15. The computing device of claim 14 , wherein the prediction model is at least one classification model that outputs from features of the software vulnerability a score indicative of the likelihood of exploitation.

16. The computing device of claim 14 , wherein the predictive model includes a Random Forest (RF) method including multiple decision tree predictors applied in combination to classify the software vulnerability which is used to estimate the likelihood of exploitation.

17. The computing device of claim 14 , wherein the computing device is further configured to apply the learned function to data associated with each of a plurality of new software vulnerabilities and compute a respective likelihood of exploitation for each of the plurality of new software vulnerabilities.

18. A method of prioritizing vulnerabilities using cyber threat intelligence, comprising:
utilizing a processor in operable communication with at least one memory for storing instructions that are executed by the processor to perform operations including:
accessing a plurality of datasets associated with a predetermined set of data sources, at least a portion of the plurality of datasets defining training data including hacker communications;
applying learning algorithms to the training data to generate a predictive model configured to predict a likelihood of exploitation of respective software vulnerabilities;
accessing one or more features associated with a software vulnerability; and
computing, by applying the one or more features to the predictive model, one or more values defining a likelihood of exploitation associated with the software vulnerability, wherein the likelihood of exploitation predicts an actual exploitation of the respective software vulnerabilities before disclosure based on the hacker communications from the training data.

19. The method of claim 18 , further comprising generating a plurality of estimation outputs based on the one or more values to derive an overall quantitative score.

20. The method of claim 18 , wherein the plurality of datasets include vulnerability data for vulnerabilities that are publicly disclosed and obtaining exploits data for exploits that were used in real world attacks.

Assignees

• Univ Arizona State

Inventors

• Shakarian Paulo
• Almukaynizi Mohammed
• Shakarian Jana
• Nunes Eric
• Dharaiya Krishna
• Senguttuvan Manoj Balasubramaniam
• Grimm Alexander

Classifications

• G06F11/008 Primary

  Reliability or availability analysis · CPC title

• G06F18/2148

  characterised by the process organisation or structure, e.g. boosting cascade · CPC title

• G06F18/24

  Classification techniques · CPC title

• G06F21/54

  by adding security routines or objects to programs · CPC title

• G06F21/552

  involving long-term monitoring or reporting · CPC title