Systems and methods for predicting which software vulnerabilities will be exploited by malicious hackers to prioritize for patching

Patent metadata

Field	Value
Publication number	US-12436827-B2
Application number	US-202318496880-A
Country	US
Kind code	B2
Filing date	Oct 29, 2023
Priority date	Nov 3, 2017
Publication date	Oct 7, 2025
Grant date	Oct 7, 2025

Abstract

Various embodiments for predicting which software vulnerabilities will be exploited by malicious hackers and hence prioritized by patching are disclosed.

First claim

What is claimed is:

1. A non-transitory computer-readable medium storing instructions that cause a processor to:
generate a learned function referencing features associated with a plurality of datasets defining software vulnerabilities and at least one machine learning algorithm; and
evaluate accuracy of the learned function by applying a portion of the plurality of datasets associated with software vulnerabilities to the learned function, including
predicting a likelihood of exploitation associated with a software vulnerability including computation of an associated class label, wherein the likelihood of exploitation predicts an actual exploitation of the respective software vulnerabilities before disclosure based on hacker communications from training data.

2. The non-transitory computer-readable medium of claim 1 comprising additional instructions that cause the processor to:
implement a random forest as part of the at least one machine learning algorithm that combines bagging for each tree with random feature selection at each node to split data utilized by the random forest, such that a result of implementing the random forest is an ensemble of decision trees each having their own independent opinion on class labels for a given disclosed vulnerability.

3. The non-transitory computer-readable medium of claim 1 comprising additional instructions that cause the programmable processor to:
detect, from the plurality of datasets, vulnerabilities that appear before an associated exploitation date.

4. The non-transitory computer-readable medium of claim 1 comprising additional instructions that cause the programmable processor to:
access features from the plurality of datasets that contain measures computed from social connections of users posting hacking-related content.

5. The non-transitory computer-readable medium of claim 1 comprising additional instructions that cause the programmable processor to:
access features from the plurality of datasets that measure a centrality of the users in a social graph.

Assignees

• Univ Arizona State

Inventors

• Shakarian Paulo
• Almukaynizi Mohammed
• Shakarian Jana
• Nunes Eric
• Dharaiya Krishna
• Senguttuvan Manoj Balasubramaniam
• Grimm Alexander

Classifications

• G06F18/2148

  characterised by the process organisation or structure, e.g. boosting cascade · CPC title

• G06F18/24

  Classification techniques · CPC title

• G06F21/577

  Assessing vulnerabilities and evaluating computer system security · CPC title

• G06F21/552

  involving long-term monitoring or reporting · CPC title

• G06F21/54

  by adding security routines or objects to programs · CPC title