Security vulnerability communication and remediation with machine learning

Patent metadata

Field	Value
Publication number	US-2023120174-A1
Application number	US-202117451097-A
Country	US
Kind code	A1
Filing date	Oct 15, 2021
Priority date	Oct 15, 2021
Publication date	Apr 20, 2023
Grant date	—

Abstract

In some implementations, a remediation device may receive, from a database that stores information regarding security vulnerabilities, security vulnerability indicators associated with one or more cloud-based applications. The remediation device may cluster, using at least one machine learning model, the security vulnerability indicators into classes, and may determine, for each class, a corresponding remediation recommendation. The remediation device may transmit, based on a setting, a corresponding message for each class. The remediation device may receive input associated with at least one of the corresponding messages, and may trigger, for at least one of the classes of security vulnerability indicators and based on the input, an automated remediation script based on a corresponding one of the remediation recommendations. The automated remediation script causes a cloud environment to perform an action for a cloud-based application associated with the security vulnerability indicators in the class(es).

First claim

What is claimed is:

1 . A system for automated communications and remediation for security vulnerabilities, the system comprising:
one or more memories; and one or more processors, communicatively coupled to the one or more memories, configured to:
receive, from a database that stores information regarding security vulnerabilities, security vulnerability indicators associated with one or more cloud-based applications;
cluster, using at least one similarity between two or more of the security vulnerabilities, the security vulnerability indicators into classes;
determine, for each class, a corresponding remediation recommendation;
transmit, based on a setting and via one or more communication interfaces, a corresponding message for each class;
receive input associated with at least one of the corresponding messages;
trigger, for at least one of the classes of security vulnerability indicators and based on the input, an automated remediation script based on a corresponding one of the remediation recommendations, wherein the automated remediation script causes a cloud environment to perform an action for a cloud-based application associated with the security vulnerability indicators in the at least one of the classes;
validate that the automated remediation script has resolved the security vulnerabilities associated with the security vulnerability indicators in the at least one of the classes; and
transmit an indication, based on the validation, that the security vulnerabilities, associated with the security vulnerability indicators in the at least one of the classes, have been resolved.

2 . The system of claim 1 , wherein the one or more processors are further configured to:
exclude at least one of the security vulnerability indicators from classification based on at least one exclusion indicator associated with the at the least one excluded security vulnerability indicator.

3 . The system of claim 2 , wherein the corresponding messages do not indicate the at least one excluded security vulnerability indicator.

4 . The system of claim 1 , wherein the one or more processors, to cluster the security vulnerability indicators, are configured to:
apply a plurality of regular expressions to one or more fields included in the security vulnerability indicators.

5 . The system of claim 1 , wherein the classes are associated with corresponding unique identifiers, and wherein the one or more processors, to cluster the security vulnerability indicators, are configured to:
map corresponding identifiers associated with the security vulnerability indicators to the corresponding unique identifiers associated with the classes.

6 . The system of claim 1 , wherein the security vulnerabilities are associated with one or more corresponding servers, and wherein the one or more processors, to cluster the security vulnerability indicators, are configured to:
group the security vulnerability indicators according to, at least in part, the one or more corresponding servers.

7 . A method of applying machine learning to automated communications and remediation for security vulnerabilities, comprising:
receiving, from a database that stores information regarding security vulnerabilities, security vulnerability indicators associated with one or more cloud-based applications; clustering, using at least one machine learning model, the security vulnerability indicators into classes; determining, for each class, a corresponding remediation recommendation; transmitting, based on a setting and via one or more communication interfaces, a corresponding message for each class; receiving input associated with at least one of the corresponding messages; and triggering, for at least one of the classes of security vulnerability indicators and based on the input, an automated remediation script based on a corresponding one of the remediation recommendations, wherein the automated remediation script causes a cloud environment to perform an action for a cloud-based application associated with the security vulnerability indicators in the at least one of the classes.

8 . The method of claim 7 , wherein the one or more cloud-based applications include at least one application that controls, at least in part, a networked hardware device.

9 . The method of claim 7 , wherein the at least one machine learning model uses at least server indications associated with the security vulnerability indicators and application indications associated with the security vulnerability indicators to cluster the security vulnerability indicators.

10 . The method of claim 7 , further comprising:
excluding at least one of the security vulnerability indicators from the at least one machine learning model based on at least one exclusion indicator associated with the at the least one excluded security vulnerability indicator.

11 . The method of claim 7 , wherein the input comprises selection of a hyperlink included in the at least one of the corresponding messages.

12 . The method of claim 7 , further comprising:
receiving, with the input, at least one credential associated with at least one recipient of the at least one of the corresponding messages, wherein the automated remediation script is triggered based on an authorization using the at least one credential.

13 . The method of claim 7 , further comprising:
validating that the automated remediation script has resolved the security vulnerability indicators in the at least one of the classes; and transmitting an indication, based on the validation, that the security vulnerability indicators in the at least one of the classes have been resolved.

14 . A non-transitory computer-readable medium storing a set of instructions for applying machine learning to automated communications and remediation for security vulnerabilities, the set of instructions comprising:
one or more instructions that, when executed by one or more processors of a device, cause the device to:
receive, from a database that stores information regarding security vulnerabilities, security vulnerability indicators associated with one or more cloud-based applications;
receive historical information associated with the security vulnerability indicators, the historical information including at least environmental information, user information, and remediation information associated with the security vulnerability indicators;
identify, using at least one machine learning model and the historical information, at least one of the security vulnerabilities;
determine, for the at least one of the security vulnerabilities, a corresponding remediation recommendation based on the remediation information associated with the at least one of the security vulnerabilities; and
generate an automated remediation script based on the corresponding remediation recommendation.

15 . The non-transitory computer-readable medium of claim 14 , wherein the one or more instructions, when executed by the one or more processors, further cause the device to:
exclude at least one of the security vulnerability indicators from the at least one machine learning model based on at least one exclusion indicator associated with the at the least one excluded security vulnerability indicator.

16 . The non-transitory computer-readable medium of claim 14 , wherein the one or more instructions, that cause the device to identify the at least one of the security vulnerabilities, cause the device to perform one or more of:
identifying the at least one of the security vulnerabilities based on determining that a quantity of affecte

Assignees

• Capital One Services Llc

Inventors

• Seck Mohamed
• Franzen Krystan R

Classifications

• H04L63/1433

  Vulnerability analysis · CPC title

• G06F21/566 Primary

  Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities · CPC title

• G06F2221/033

  Test or assess software · CPC title

• G06F21/552

  involving long-term monitoring or reporting · CPC title

• G06F21/577 Primary

  Assessing vulnerabilities and evaluating computer system security · CPC title