Automated cybersecurity vulnerability prioritization

Patent metadata

Field	Value
Publication number	US-12476994-B2
Application number	US-202418409916-A
Country	US
Kind code	B2
Filing date	Jan 11, 2024
Priority date	Jan 19, 2023
Publication date	Nov 18, 2025
Grant date	Nov 18, 2025

Abstract

Implementations include a computer-implemented method comprising: obtaining data representing observed conditions in an enterprise network, each observed condition being associated with at least one cybersecurity issue, a cybersecurity issue comprising one of (i) a vulnerability comprising an instance of a vulnerable condition or (ii) a weakness that is likely to cause a vulnerability to occur; using a plurality of exploitation prediction models to determine probabilities of exploitation of the cybersecurity issues associated with the observed conditions in the enterprise network, wherein the plurality of exploitation prediction models are trained using a knowledge mesh generated using data from cybersecurity repositories; assigning a priority ranking to each of the observed conditions in the enterprise network based on the respective probabilities of exploitation for the cybersecurity issues associated with the observed conditions; and performing one or more actions to mitigate the observed conditions in the enterprise network based on the priority rankings.

First claim

What is claimed is:

1 . A computer-implemented method for reducing cybersecurity risk in enterprise networks, comprising:
obtaining data representing observed conditions in an enterprise network, each observed condition being associated with at least one cybersecurity issue, wherein a cybersecurity issue comprises one of (i) a vulnerability comprising an instance of a vulnerable condition or (ii) a weakness that is likely to cause a vulnerability to occur; using a plurality of exploitation prediction models to determine probabilities of exploitation of the cybersecurity issues associated with the observed conditions in the enterprise network, wherein the plurality of exploitation prediction models are trained using a knowledge mesh generated using data from one or more cybersecurity repositories; assigning a priority ranking to each of the observed conditions in the enterprise network based on the respective probabilities of exploitation for the cybersecurity issues associated with the observed conditions; and performing one or more actions to mitigate the observed conditions in the enterprise network based on the respective priority rankings, wherein the observed conditions include a first condition that is associated with a first vulnerability and is associated with a first weakness, further comprising:
obtaining output from a first model indicating a first probability of exploitation for the first vulnerability;
obtaining output from a second model indicating a second probability of exploitation for the first weakness; and
assigning a priority ranking to the first condition based on at least one of the first probability of exploitation for the first vulnerability and the second probability of exploitation for the first weakness.

2 . The method of claim 1 , further comprising training, using the knowledge mesh, the plurality of exploitation prediction models to determine probabilities of exploitation of cybersecurity issues,
wherein the knowledge mesh includes a plurality of modules, each module maintaining a knowledge graph generated using data from the one or more cybersecurity repositories.

3 . The method of claim 2 , wherein training, using the knowledge mesh, the plurality of exploitation prediction models to determine probabilities of exploitation of cybersecurity issues comprises:
training the first model to determine probabilities of exploitation of vulnerabilities; and training the second model to determine probabilities of exploitation of weaknesses.

4 . The method of claim 3 , wherein using the plurality of exploitation prediction models to determine probabilities of exploitation of the observed conditions comprises:
extracting, from the obtained data, vulnerabilities associated with the observed conditions, providing, as input to the first model, the vulnerabilities, obtaining, as output from the first model, respective probabilities of exploitation for each of the vulnerabilities.

5 . The method of claim 3 , wherein using the plurality of exploitation prediction models to determine probabilities of exploitation of the observed conditions comprises:
extracting, from the obtained data, weaknesses associated with the observed conditions, providing, as input to the second model, the weaknesses, and obtaining, as output from the second model, respective probabilities of exploitation for each of the weaknesses.

6 . The method of claim 3 , wherein the first model comprises a first machine learning model of a first set of machine learning models trained to determine probabilities of exploitation of vulnerabilities.

7 . The method of claim 6 , further comprising:
training the first set of machine learning models to determine probabilities of exploitation of vulnerabilities; evaluating each of the first set of machine learning models including determining, for each of the plurality of exploitation prediction models, an accuracy, a false positive rate, and a false negative rate; and selecting the first model from the first set of machine learning models based on evaluating each of the first set of machine learning models.

8 . The method of claim 3 , wherein the second model comprises a second machine learning model of a second set of machine learning models trained to determine probabilities of exploitation of vulnerabilities.

9 . The method of claim 8 , further comprising:
training the second set of machine learning models to determine probabilities of exploitation of vulnerabilities; evaluating each of the second set of machine learning models including determining, for each of the plurality of exploitation prediction models, an accuracy, a false positive rate, and a false negative rate; and selecting the second model from the second set of machine learning models based on evaluating each of the second set of machine learning models.

10 . The method of claim 1 , wherein the knowledge mesh includes historical data indicating, for each of multiple cybersecurity issues, whether the cybersecurity issue has been exploited.

11 . The method of claim 10 , wherein training, using the knowledge mesh, an exploitation prediction model of the plurality of exploitation prediction models to determine probabilities of exploitation of cybersecurity issues comprises:
providing, as input to the exploitation prediction model, training samples generated from the knowledge mesh, a training sample comprising:
information identifying the cybersecurity issue, and
a label indicating whether the cybersecurity issue has been exploited.

12 . The method of claim 1 , wherein the data indicating vulnerabilities includes, for each vulnerability, a textual description and a severity score.

13 . The method of claim 1 , wherein a probability of exploitation of a cybersecurity issue comprises:
a likelihood that the exploitation of the cybersecurity issue will occur; and a likelihood that the exploitation of the cybersecurity issue will not occur.

14 . The method of claim 1 , wherein the first probability of exploitation for the first vulnerability is different than the second probability of exploitation for the first weakness.

15 . The method of claim 14 , further comprising:
assigning the priority ranking to the first condition based on a combination of the first probability of exploitation and the second probability of exploitation.

16 . The method of claim 14 , further comprising:
assigning the priority ranking to the first condition based on the first probability of exploitation or the second probability of exploitation.

17 . A system comprising:
one or more computers; and one or more storage devices storing instructions that are operable, when executed by the one or more computers, to cause the one or more computers to perform operations comprising:
obtaining data representing observed conditions in an enterprise network, each observed condition being associated with at least one cybersecurity issue, wherein a cybersecurity issue comprises one of (i) a vulnerability comprising an instance of a vulnerable condition or (ii) a weakness that is likely to cause a vulnerability to occur;
using a plurality of exploitation prediction models to determine probabilities of exploitation of the cybersecurity issues associated with the observed conditions in the enterprise network, wherein the plurality of exploitation prediction models are trained using a knowledge mesh generated using data from one or more cybersecurity repositories;
assigning a priority ranking to each of the observed conditions in the enterprise network based on

Assignees

• Accenture Global Solutions Ltd

Inventors

• Ding aolin
• BINYAMINI Hodaya
• Engelberg Gal
• Divalentin Louis William
• Mccarty Benjamin Glen
• Klein Dan
• Hass Amin

Classifications

• G06N5/022 Primary

  Knowledge engineering; Knowledge acquisition · CPC title

• G06N7/01

  Probabilistic graphical models, e.g. probabilistic networks · CPC title

• G06N20/00

  Machine learning · CPC title

• H04L63/1433 Primary

  Vulnerability analysis · CPC title