Dynamic prioritization of vulnerability exclusion renewals

Patent metadata

Field	Value
Publication number	US-12326941-B2
Application number	US-202217567925-A
Country	US
Kind code	B2
Filing date	Jan 4, 2022
Priority date	Jan 4, 2022
Publication date	Jun 10, 2025
Grant date	Jun 10, 2025

Abstract

A computer-implemented method for prioritizing exclusion renewal records is disclosed. The computer-implemented method includes determining vulnerability factors associated with a vulnerability exclusion record. The computer-implemented method further includes generating a vulnerability factor score for each vulnerability factor associated with the vulnerability exclusion record based, at least in part, on a level of risk associated with the vulnerability factor. The computer-implemented method further includes generating a vulnerability score for the vulnerability exclusion record based, at least in part, on the vulnerability factor score for each vulnerability factor. The computer-implemented method further includes updating a previous vulnerability score of the vulnerability exclusion record.

First claim

What is claimed is:

1. A computer-implemented method for prioritizing exclusion renewal records, the computer-implemented method comprising:
receiving a vulnerability exclusion record from a vulnerability exclusion database, wherein the vulnerability exclusion record is previously reviewed and includes an exemption from remediation;
determining vulnerability factors associated with the vulnerability exclusion record, wherein the vulnerability exclusion record comprises at least two vulnerability factors;
generating a vulnerability factor score for each vulnerability factor associated with the vulnerability exclusion record based, at least in part, on a level of risk associated with the vulnerability factor;
generating a vulnerability score for the vulnerability exclusion record based, at least in part, on the vulnerability factor score for each vulnerability factor;
updating a previous vulnerability score of the vulnerability exclusion record to the vulnerability score;
ranking, based on the updating, the vulnerability exclusion record with respect to other vulnerability exclusion records based, at least in part, on the vulnerability score; and
prioritizing, based on the ranking, the vulnerability exclusion record for a renewal review of the exemption from remediation.

2. The computer-implemented method of claim 1 , wherein generating the vulnerability factor score for a vulnerability factor associated with the vulnerability exclusion record is further based, at least in part, on, a weighted scoring model associated with the vulnerability factors.

3. The computer-implemented method of claim 1 , wherein generating the vulnerability score for the vulnerability exclusion record includes:
multiplying each vulnerability score generated for each vulnerability factor with one another.

4. The computer-implemented method of claim 1 , further comprising:
re-reviewing the vulnerability exclusion record within a first predetermined timeframe if the vulnerability score of the vulnerability exclusion record is above a predetermined threshold.

5. The computer-implemented method of claim 4 , further comprising:
re-reviewing the vulnerability exclusion record within a second predetermined timeframe if the vulnerability score of the vulnerability exclusion record is below the predetermined threshold, wherein the first predetermined timeframe is earlier than the second predetermined timeframe.

6. The computer-implemented method of claim 1 , wherein generating the vulnerability factor score for a vulnerability associated with the vulnerability exclusion record is further based, at least in part, on utilizing a machine learning model.

7. The computer-implemented method of claim 1 , wherein the vulnerability factors are selected from the group consisting of exclusion type, network location, system criticality, credentialed scans, vulnerability anatomy, vulnerability status, time since last scan, exploit score, SIEM score remediation sensitivity, network domicile, and past renewal decisions.

8. A computer program product for prioritizing exclusion renewal records, the computer program product comprising one or more computer readable storage media and program instructions stored on the one or more computer readable storage media, the program instructions including instructions to:
receive a vulnerability exclusion record from a vulnerability exclusion database, wherein the vulnerability exclusion record is previously reviewed and includes an exemption from remediation;
determine vulnerability factors associated with the vulnerability exclusion record, wherein the vulnerability exclusion record comprises at least two vulnerability factors;
generate a vulnerability factor score for each vulnerability factor associated with the vulnerability exclusion record based, at least in part, on a level of risk associated with the vulnerability factor;
generate a vulnerability score for the vulnerability exclusion record based, at least in part, on the vulnerability factor score for each vulnerability factor;
update a previous vulnerability score of the vulnerability exclusion record to the vulnerability score;
rank, based on the updating, the vulnerability exclusion record with respect to other vulnerability exclusion records based, at least in part, on the vulnerability score; and
prioritize, based on the ranking, the vulnerability exclusion record for a renewal review of the exemption from remediation.

9. The computer program product of claim 8 , wherein the instructions to generate the vulnerability factor score for a vulnerability factor associated with the vulnerability exclusion record is further based, at least in part, on, a weighted scoring model associated with the vulnerability factors.

10. The computer program product of claim 8 , wherein the instructions to generate the vulnerability score for the vulnerability exclusion record includes instructions to:
multiply each vulnerability score generated for each vulnerability factor with one another.

11. The computer program product of claim 8 , further comprising instructions to:
re-review the vulnerability exclusion record within a first predetermined timeframe if the vulnerability score of the vulnerability exclusion record is above a predetermined threshold.

12. The computer program product of claim 11 , further comprising instructions to:
re-review the vulnerability exclusion record within a second predetermined timeframe if the vulnerability score of the vulnerability exclusion record is below the predetermined threshold, wherein the first predetermined timeframe is earlier than the second predetermined timeframe.

13. The computer program product of claim 8 , wherein the instructions to generate the vulnerability factor score for a vulnerability associated with the vulnerability exclusion record is further based, at least in part, on instructions to utilize a machine learning model.

14. The computer program product of claim 8 , wherein the vulnerability factors are selected from the group consisting of exclusion type, network location, system criticality, credentialed scans, vulnerability anatomy, vulnerability status, time since last scan, exploit score, SIEM score remediation sensitivity, network domicile, and past renewal decisions.

15. A computer system for prioritizing exclusion renewal records, comprising:
one or more computer processors;
one or more computer readable storage media;
computer program instructions;
the computer program instructions being stored on the one or more computer readable storage media for execution by the one or more computer processors; and
the computer program instructions including instructions to:
receive a vulnerability exclusion record from a vulnerability exclusion database, wherein the vulnerability exclusion record is previously reviewed and includes an exemption from remediation;
determine vulnerability factors associated with the vulnerability exclusion record, wherein the vulnerability exclusion record comprises at least two vulnerability factors;
generate a vulnerability factor score for each vulnerability factor associated with the vulnerability exclusion record based, at least in part, on a level of risk associated with the vulnerability factor;
generate a vulnerability score for the vulnerability exclusion record based, at least in part, on the vulnerability factor score for each vulnerability factor; and
update a previous vulnerability score of the vulnerability exclusion record to the vulnerability score;

rank, based on the updating, the vulnerability exclusion record with respect to other vulnerability e

Assignees

• IBM

Inventors

• Shaieb Johnny Al
• Redford Michael
• Nikolai Jason A
• Bornheimer Jason
• Ocepek Steven
• Maier Robert
• Bedell Christopher
• Glasgow Seth Grey

Classifications

• G06F2221/034

  Test or assess a computer or a system · CPC title

• G06F21/577 Primary

  Assessing vulnerabilities and evaluating computer system security · CPC title