Patent ID: 11930033
Assignee: NOZOMI NETWORKS SAGL
Field: Computer technology (Electrical engineering)
Classification: CPC G  H | IPC G  H

Claim 0:
1. A method for verifying vulnerabilities of network device using Common Vulnerabilities and Exposures (“CVE”) entries comprising:
indexing, by a computerized data processing unit, each of said CVE entry, defining an indexed CVE entry;
decoding, by said computerized data processing unit, a network packet on a computer network relating to said network device, defining a decoded string relating to the identity of said network device;
matching, by said computerized data processing unit, said decoded string with said indexed CVE entry, raising an alert when a match is found;
wherein said indexing comprises generating a CVE tree from each of said CVE entry, defining said indexed CVE entry,
wherein said generating comprises identifying the vulnerable configuration fields and extracting, for each of said vulnerable configuration fields, a set of vulnerable conditions comprising an operator attribute and nested Common Platform Enumeration (“CPE”) records, wherein said CVE tree is provided with said operator attribute as node and with said CPE records as leaves from said node,
wherein said generating further comprises splitting each of said CPE records by name attributes defining a split CPE record provided with the first of said name attributes as CPE parent node, and each of the subsequent of said name attributes respectively as CPE leaves from a preceding of said name attribute and as CPE node for a following of said name attribute,
wherein each of said CPE records in said CVE tree is replaced by said related split CPE record with the last of said name attributes as CPE leave from said operator attribute,
wherein said splitting is made for said node of said CVE tree with more of said leaves,
wherein said decoding comprises tokenizing of said decoded string in a sequence of plurality of n-grams having predefined sizes,
wherein said matching comprises a lookup of said sequence of plurality of n-grams into said CVE tree, raising said alert when said operator attribute corresponds to OR operator and a match between at least one of said CPE records is found, and raising said alert when said operator attribute corresponds to AND operator and a match between all of said CPE records is found,
wherein said matching comprises a lookup of said sequence of plurality of n-grams into said CVE tree starting from the smallest of said n-grams to the biggest of said n-grams, with a moving window to generate said n-grams,
wherein said matching comprises a lookup of said sequence of plurality of n-grams into said CVE tree starting from said first of said name attributes of said split node and retracing said CVE tree up to the parent node, and said splitting and said matching are iterated for a subsequent of said node of said CVE tree with more of said leaves.