System and method for grouping computer vulnerabilities

Patent metadata

Field	Value
Publication number	US-9811667-B2
Application number	US-201113239271-A
Country	US
Kind code	B2
Filing date	Sep 21, 2011
Priority date	Sep 21, 2011
Publication date	Nov 7, 2017
Grant date	Nov 7, 2017

Abstract

A system and method in one embodiment includes modules for creating a vulnerability set including one or more vulnerabilities, adding the vulnerability set to a program, and updating the program by adding a new vulnerability to the vulnerability set. More specific embodiments include a program that includes a scan, creating the vulnerability set by generating a query including one or more conditions associated with the vulnerabilities, and creating the vulnerability set by selecting one or more vulnerabilities from a plurality of vulnerabilities. Other embodiments include a program that includes a report template, adding a vulnerability set to the report template by generating a query to include a condition associated with the vulnerability set, running a scan, and generating a report including one or more results from the scan meeting the condition associated with the vulnerability set.

First claim

What is claimed is:

1. A method comprising:
providing a query including at least one condition defining at least one vulnerability, the query to be displayed by a graphical user interface (GUI) of a computer that includes a processor;
creating a vulnerability set based on the query;
adding the vulnerability set to a program;
running the query upon execution of the program to dynamically select one or more vulnerability checks to apply to one or more assets in a network, wherein the at least one condition in the query indicates a level of severity of vulnerabilities, and wherein a vulnerability check is selected for the program based, at least in part, on one or more vulnerabilities associated with the vulnerability check meeting the level of severity indicated by the at least one condition;
updating the program by updating the query to add at least one other condition defining at least one other vulnerability and running the updated query upon a subsequent execution of the program;
producing scan results based on the subsequent execution of the program; and
generating an asset report that includes data based on the scan results indicating a vulnerability of at least one asset of the one or more assets.

2. The method of claim 1 , wherein the subsequent execution of the program comprises identifying the vulnerability of the at least one asset indicated in the asset report.

3. The method of claim 1 , wherein the program comprises a report template.

4. The method of claim 1 , further comprising:
running a second program comprising the vulnerability set; and
generating a report, such that the report comprises at least one result from the second program meeting the at least one condition associated with the vulnerability set.

5. The method of claim 1 , wherein:
the creating the vulnerability set comprises generating the query including the at least one condition associated with the at least one vulnerability; and
the updating the query comprises generating the updated query including the at least one other condition associated with the at least one other vulnerability.

6. The method of claim 5 , wherein the at least one condition is selected from a group comprising a vulnerability module, a vulnerability category, a Common Vulnerabilities and Exposures (CVE) Number, a Common Weakness Enumeration (CWE), an intrusive check, a Microsoft (MS) Number, a risk, a vulnerability name, and a vulnerability severity.

7. The method of claim 1 , wherein the query further comprises a nested condition expression using at least one operator selected from a group comprising AND, OR, Equals (EQ), Not Equals (NE), Greater Than (GT), Less Than (LT), Contains, Does not Contain, Greater Than or Equal (GE), and Less Than or Equal (LE).

8. The method of claim 1 , wherein the creating the vulnerability set comprises selecting the at least one vulnerability from a plurality of vulnerabilities.

9. An apparatus comprising:
a memory element configured to store data; and
a processor operable to execute instructions associated with the data, wherein the apparatus is configured for:
providing a query including at least one condition defining at least one vulnerability, the query to be displayed by a graphical user interface (GUI) of a computer that includes the processor;
creating a vulnerability set based on the query;
adding the vulnerability set to a program;
running the query upon execution of the program to dynamically select one or more vulnerability checks to apply to one or more assets in a network, wherein the at least one condition in the query indicates a level of severity of vulnerabilities, and wherein a vulnerability check is selected for the program based, at least in part, on one or more vulnerabilities associated with the vulnerability check meeting the level of severity indicated by the at least one condition;
updating the program by updating the query to add at least one other condition defining at least one other vulnerability and running the updated query upon a subsequent execution of the program;
producing scan results based on the subsequent execution of the program; and
generating an asset report that includes data based on the scan results indicating a vulnerability of at least one asset of the one or more assets.

10. The apparatus of claim 9 , wherein the subsequent execution of the program comprises identifying the vulnerability of the at least one asset indicated in the asset report.

11. The apparatus of claim 9 , wherein:
the program comprises a report template; and
wherein the apparatus is configured for generating the query to include the at least one condition associated with the vulnerability set.

12. The apparatus of claim 11 , further comprising:
running a second program comprising the vulnerability set; and
generating a report, such that the report comprises at least one result from the second program meeting the at least one condition associated with the vulnerability set.

13. The apparatus of claim 9 , wherein:
the creating the vulnerability set comprises generating the query including the at least one condition associated with the at least one vulnerability; and
the updating the query comprises generating the updated query including the at least one other condition associated with the at least one other vulnerability.

14. The apparatus of claim 9 , wherein creating the vulnerability set comprises selecting the at least one vulnerability from a plurality of vulnerabilities.

15. One or more non-transitory media that includes code for execution and when executed by a processor is operable to perform operations comprising:
providing a query including at least one condition defining at least one vulnerability, the query to be displayed by a graphical user interface (GUI) of a computer that includes the processor;
creating a vulnerability set based on the query;
adding the vulnerability set to a program;
running the query upon execution of the program to dynamically select one or more vulnerability checks to apply to one or more assets in a network, wherein the at least one condition in the query indicates a level of severity of vulnerabilities, and wherein a vulnerability check is selected for the program based, at least in part, on one or more vulnerabilities associated with the vulnerability check meeting the level of severity indicated by the at least one condition;
updating the program by updating the query to add at least one other condition defining at least one other vulnerability and running the updated query upon a subsequent execution of the program;
producing scan results based on the subsequent execution of the program; and
generating an asset report that includes data based on the scan results indicating a vulnerability of at least one of the one or more assets.

16. The one or more non-transitory media of claim 15 , wherein the subsequent execution of the program comprises identifying the vulnerability of the at least one asset indicated in the asset report.

17. The one or more non-transitory media of claim 15 , wherein:
the program comprises a report template; and
the code, when executed by the processor, is operable to perform further operations comprising generating the query to include the at least one condition associated with the vulnerability set.

18. The one or more non-transitory media of claim 17 , wherein the code, when executed by the processor, is operable to perform further operations comprising:
running a second program comprising the vulnerability set; and
generating a report, suc

Assignees

• Hugard Iv James M
• Leroux Alexander Lawrence
• Mallabarapu Charles
• Muniz Jorge Armando
• Russell Braden C
• Wu Zengjue
• Mcafee Inc

Inventors

• Hugard Iv James M
• Leroux Alexander Lawrence
• Mallabarapu Charles
• Muniz Jorge Armando
• Russell Braden C
• Wu Zengjue

Classifications

• G06F11/3051

  Monitoring arrangements for monitoring the configuration of the computing system or of the computing system component, e.g. monitoring the presence of processing resources, peripherals, I/O links, software programs (verification or detection of system hardware configuration G06F11/2247) · CPC title

• H04L63/1433

  Vulnerability analysis · CPC title

• H04L63/20

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title

• G06F21/57

  Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities · CPC title

• G06F21/577 Primary

  Assessing vulnerabilities and evaluating computer system security · CPC title