Quantifying satisfaction of security features of cloud software systems

Patent metadata

Field	Value
Publication number	US-12579277-B2
Application number	US-202217993073-A
Country	US
Kind code	B2
Filing date	Nov 23, 2022
Priority date	Nov 23, 2021
Publication date	Mar 17, 2026
Grant date	Mar 17, 2026

Abstract

A method of quantifying the satisfaction of security requirements is provided via characterizing a security feature; matching the security feature to a security metric; computing a quantification score that indicates the exploitability of a system to which the security feature is applied; and outputting the quantification score to a security analyst.

First claim

What is claimed is:

1 . A method, comprising:
characterizing a security requirement; matching the security requirement to a security metric; computing a quantification score that indicates an exploitability of a system to which the security requirement is applied; and outputting the quantification score to a security analyst, wherein the security metric is one of a plurality of security metrics matched to the security requirement, the method further comprising: in response to the quantification score being below a satisfaction threshold, identifying, to the security analyst, at least one security requirement of a plurality of security requirements that was not satisfied, and wherein the method is performed on a virtual machine of a cloud infrastructure including a virtual processor and a virtual memory.

2 . The method of claim 1 , wherein characterizing the security requirement further comprises:
identifying an asset in a computing environment to protect according to the security requirement; and identifying a security objective of the security requirement to protect the asset.

3 . The method of claim 1 , wherein matching the security requirement to the security metric further comprises:
identifying an exploitability measure, a defense measure, and an attack strength measure.

4 . The method of claim 3 , wherein quantifying the security requirement further comprises:
computing the exploitability measure, the defense measure, and the attack strength measure to quantify a level of satisfaction of the security requirement.

5 . The method of claim 1 , wherein the security requirement is one of a plurality of security requirements characterized to quantify the exploitability of the system.

6 . A system, comprising:
a processor; and a memory including instructions that when executed by the processor perform operations that comprise:
characterizing a security requirement;
matching the security requirement to a security metric;
computing a quantification score that indicates an exploitability of a system to which the security requirement is applied; and
outputting the quantification score to a security analyst,
wherein the security metric is one of a plurality of security metrics matched to the security requirement, the operations further comprising: in response to the quantification score being below a satisfaction threshold, identifying, to the security analyst, at least one security requirement of a plurality of security requirements that was not satisfied, and wherein the processor comprises a virtual processor and the memory comprises a virtual memory provided as part of a virtual machine of a cloud infrastructure.

7 . The system of claim 6 , wherein characterizing the security requirement further comprises:
identifying an asset in a computing environment to protect according to the security requirement; and identifying a security objective of the security requirement to protect the asset.

8 . The system of claim 6 , wherein matching the security requirement to the security metric further comprises:
identifying an exploitability measure, a defense measure, and an attack strength measure.

9 . The system of claim 8 , wherein quantifying the security requirement further comprises:
computing the exploitability measure, the defense measure, and the attack strength measure to quantify a level of satisfaction of the security requirement.

10 . The system of claim 6 , wherein the security requirement is one of a plurality of security requirements characterized to quantify the exploitability of the system.

11 . A non-transitory computer readable memory including instructions that when executed by a processor perform operations comprising:
characterizing a security requirement; matching the security requirement to a security metric; computing a quantification score that indicates an exploitability of a system to which the security requirement is applied; and outputting the quantification score to a security analyst, wherein the security metric is one of a plurality of security metrics matched to the security requirement, the operations further comprising: in response to the quantification score being below a satisfaction threshold, identifying, to the security analyst, at least one security requirement of a plurality of security requirements that was not satisfied, and wherein the operations are performed on a virtual machine of a cloud infrastructure including a virtual processor and a virtual memory.

12 . The computer readable memory of claim 11 , wherein characterizing the security requirement further comprises:
identifying an asset in a computing environment to protect according to the security requirement; and identifying a security objective of the security requirement to protect the asset.

13 . The computer readable memory of claim 11 , wherein matching the security requirement to the security metric further comprises:
identifying an exploitability measure, a defense measure, and an attack strength measure.

14 . The computer readable memory of claim 13 , wherein quantifying the security requirement further comprises:
computing the exploitability measure, the defense measure, and the attack strength measure to quantify a level of satisfaction of the security requirement.

15 . The computer readable memory of claim 11 , wherein the security requirement is one of a plurality of security requirements characterized to quantify the exploitability of the system.

Assignees

• Qatar Found Education Science & Community Dev
• Univ Qatar

Inventors

• Nhlabatsi Armstrong
• Khan Khaled
• Hong Jin
• Kim Dong Seong
• Fernandez Rachel
• Fetais Noora

Classifications

• H04L63/1433

  Vulnerability analysis · CPC title

• G06F21/53 Primary

  by executing in a restricted environment, e.g. sandbox or secure virtual machine · CPC title

• G06F2221/033

  Test or assess software · CPC title

• G06F21/577 Primary

  Assessing vulnerabilities and evaluating computer system security · CPC title