Patent ID: 11861013
Assignee: ACCENTURE GLOBAL SOLUTIONS LIMITED
Field: Computer technology (Electrical engineering)
Classification: CPC G | IPC G

Claim 13:
14. A method for assessing software vulnerability, comprising the steps of:
accessing an automated triage rule library comprising a plurality of predefined automated triage policies corresponding to a plurality of predetermined vulnerability types, wherein each automated triage policy comprises a decision tree for determining whether one of the plurality of predetermined vulnerability types is exploitable;
accessing a machine learning model library for probabilistic determination of whether one of the plurality of predetermined vulnerability types is exploitable;
obtaining an electronic document listing potential vulnerability issues of a software product based on scanning source code of the software product;
determining whether the potential vulnerability issues are associated with one of the plurality of predetermined vulnerability types;
when it is determined that the potential vulnerability issues are associated with the one of the plurality of predetermined vulnerability types:
classifying whether the software product is exploitable among classes of being exploitable, not exploitable, or suspicious of exploitability based on a rule-based deterministic classifier for processing the electronic document using an automated triage policy retrieved from the automated triage rule library associated with the one of the plurality of predetermined vulnerability types and based on a corresponding decision tree;
determining probabilistically whether the software product is exploitable based on a pretrained machine-learning probabilistic classifier; and
using an arbitrator to determine which classifier is more trustworthy when there is a classification conflict; and

otherwise, when it is determined that the potential vulnerability issues are not associated with the one of the plurality of predetermined vulnerability types, only determining probabilistically whether the software product is exploitable based on the pretrained machine-learning probabilistic classifier.