Detecting a root cause for a vulnerability using subjective logic in social media

A method and system of identifying a computing device vulnerability is provided. Social media communication is monitored. Social media threads that are related to a vulnerability, based on the monitored social media communication, are identified, filtered, and categorized into one or more predetermined categories of computing device vulnerabilities. Upon determining that a number of social media posts related to the vulnerability is above a first predetermined threshold, one or more dependable social media threads in a same one or more categories as the vulnerability are searched. One or more possible root causes of the vulnerability are determined from the searched dependable social media threads. A validity score for each of the one or more possible root causes is assigned. A possible root cause from that has a highest validity score that is above a second predetermined threshold is selected to be the root cause of the vulnerability.

BACKGROUND

Technical Field

The present disclosure generally relates to computer security, and in particular, to detecting vulnerabilities of computing devices by electronic analysis of social media.

Description of the Related Art

In recent years, the Web has become an increasingly important resource of information about computer security threats, such as Botnet, distributed denial of service (DDoS), malware, and the like, collectively referred to herein as a computing device vulnerability. Malicious parties frequently use social media networks to discuss cyber-attacks, identify potential victims, discuss strategies, etc. Upon release of a vulnerability, victims and experts frequently discuss the symptoms of their malfunctioning computing device using social media to find remedy. While monitoring social media networks is a valuable way of discovering malicious cyber activity and remedies thereof, traditional approaches lack automation capabilities to timely and resource efficiently identify vulnerabilities and solutions to the vulnerabilities.

SUMMARY

According to various embodiments, a computing device, a non-transitory computer readable storage medium, and a method are provided of identifying a computing device vulnerability. Social media communication is monitored. Social media threads that are related to a vulnerability of a computing device are identified, based on the monitored social media communication. Each identified social media threads is filtered by removing SPAM postings therefrom, and categorized into one or more predetermined categories of computing device vulnerabilities. Upon determining that a number of social media posts related to the vulnerability is above a first predetermined threshold, one or more dependable social media threads in a same one or more categories as the vulnerability is searched. One or more possible root causes of the vulnerability are determined from the searched dependable social media threads. A validity score is assigned for each of the one or more possible root causes. A possible root cause from the one or more possible root causes that has a highest validity score that is above a second predetermined threshold is selected to be the root cause of the vulnerability.

In one embodiment, identifying dependable social media threads for the one or more predetermined categories includes, during a training phase, receiving a training social media communication. For each thread of the training social media communication, a peer vote, a status of the contributor, a number of views, or a number of comments parameters is evaluated. Further, a dependability of the thread of the training social media communication based on the evaluated parameters is rated. The thread of the training social media communication is stored as a dependable social media thread if the rating of the dependability of the thread is above a predetermined threshold for its category, such that the thread of the training social media communication is available to be searched during a monitoring or resolution phase. The monitoring and resolution phases are after the training phase.

In one embodiment, upon determining the root cause of the vulnerability, a notification is sent to one or more computing devices that are deemed to be affected or are at risk to be affected by the identified vulnerability.

DETAILED DESCRIPTION

Overview

The present disclosure relates to systems and methods of detecting vulnerabilities and solutions thereof via social media. Social media includes, without limitation, computer help forums, hacker blogs and forums, chat rooms, and social media streams, such as Twitter, Pinterest, Facebook, Instagram, etc. Victims experiencing a security threat, security vendors, system administrators, and hackers (sometimes referred to herein as malicious parties), who discuss vulnerabilities on social media sites (e.g., Twitter), provide a rich source of information. Indeed, malicious parties often discuss technical details about exploits and the victims of attacks share their experiences. Also, in some scenarios, vulnerabilities that can be identified via social media communication would not be identified or reported early enough to system administrators. Even though such social media feeds can be inaccurate and replete with misinformation, applicants have identified efficient ways of mining and aggregating the social media fees to electronically analyze the data therein.

Accordingly, what is provided herein is a method and system for identifying a computing device vulnerability. Social media communication is monitored at predetermined intervals, together providing a continuous monitoring of social media. Social media threads that are related to a vulnerability of a computing device are identified, based on the monitored social media communication. The social media communication is filtered to remove irrelevant information therefrom and categorized into appropriate threat categories. Social media threads, that are deemed to be dependable, are searched for possible root causes of the vulnerability. The possible root causes are ranked to identify the most likely root cause.

By virtue of the concepts discussed herein, an early detection of a vulnerability is provided. Further, a root cause of the vulnerability can be identified, the evolution of existing vulnerabilities can be tracked to mitigate their effects, and a solution to the vulnerability can be provided. Reference now is made in detail to the examples illustrated in the accompanying drawings and discussed below.

Example Architecture

FIG. 1illustrates an example architecture100for identifying a vulnerability related to computing devices via social media. Architecture100may include one or more computing devices102(1) to102(N), one or more social media servers110, a vulnerability database112, a vulnerability server116having a vulnerability engine103, and a cloud120.

The network106allows various users to communicate with each other users (i.e., via their computing devices102(1) to102(N)) and various resources that are connected to the network106, such as a social media server110, a vulnerability database112, vulnerability server116and the cloud120.

The network106may be, without limitation, a local area network (“LAN”), a virtual private network (“VPN”), a cellular network, the Internet, or a combination thereof. For example, the network106may include a mobile network that is communicatively coupled to a private network, sometimes referred to as an intranet, that provides various ancillary services, such as communication with various application stores, libraries, the Internet, and the cloud120. A computing device (e.g.,102(1) to102(N)), among other functions, allows a user to communicate with other users directly (e.g., via e-mail, text, telephone, etc.) or via social media110. A computing device102(1) to102(N) can also be used to receive notifications and/or updates from the vulnerability server116. Users of the computing devices may include malicious parties, victims of the malicious parties, and regular users. Regular users may include users who have not have been directly affected by a vulnerability and/or who can participate in social media to discuss vulnerabilities.

For purposes of later discussion, several computing devices appear in the drawing, to represent some examples of the devices that may receive various resources via the network106. Today, computing devices typically take the form of portable handsets, smart-phones, tablet computers, laptops, desktops, personal digital assistants (PDAs), and smart watches, although they may be implemented in other form factors, including consumer, and business electronic devices.

Social media includes, without limitation, computer help forums, hacker blogs and forums, chat rooms and social media streams, such as Twitter, Pinterest, Facebook, Instagram, and the like, collectively represented herein by way of a social media server110, which is configured to facilitate communication between subscribers via their computing devices102(1) to102(N). The social media110is a source of social media communication115for the vulnerability server116, as well as dependable threads111, discussed in more detail later.

Architecture100may include a vulnerability database112configured to store and maintain an up-to-date list of present network and/or user device102(1) to102(N) security concerns. For example, the vulnerability database112may be maintained by a security software company or a consortium of organizations and/or individuals interested in network security, such as the National Vulnerability Database (NVD), US-CERT Vulnerability Notes Database, Open Sourced Vulnerability Database (OSVDB), X-FORCE by IBM, and the like. The vulnerability database112provides data113that includes network security information in the form of data packets to the vulnerability engine103of the vulnerability server116, at predetermined intervals or upon a trigger event. The security information113from the vulnerability database112can be used by the vulnerability engine103to identify signatures of active and potential vulnerabilities that may be affecting the network106and the computing devices102(1) to102(N) coupled thereto. In some embodiments, the signature may include key terms that are consistent with a vulnerability.

In one embodiment, machine learning may be used by the vulnerability engine103to learn from the security information (sometimes referred to herein as historic data or example data)113received from the vulnerability database112during a training phase. Machine learning is a subfield of computer science that evolved from the study of pattern recognition and computational learning theory in artificial intelligence. Machine learning is used herein to construct algorithms that can learn from and make predictions based on the data stored in the vulnerability database112. Such algorithms operate by building a model from stored prior inputs or baselines therefrom to make data-driven predictions or decisions (OR to provide threshold conditions to indicate a vulnerability), rather than following strictly static criteria.

Based on the machine learning, patterns, trends, and key words that are consistent with a vulnerability are identified from the social media communication115. In various embodiments, the machine learning discussed herein may be supervised or unsupervised. In supervised learning, the monitoring server may be presented with example data113from the vulnerability database112as being acceptable. Put differently, the vulnerability database112acts as a teacher for the monitoring server. In unsupervised learning, the vulnerability database112does not provide any labels as what is acceptable, rather, it simply provides historic data (e.g.,113) to the vulnerability engine103that can be used together with the recently harvested social media communication115from the system to find its own structure among the data. In various embodiments, the machine learning may make use of techniques such as supervised learning, unsupervised learning, semi-supervised learning, naïve Bayes, Bayesian networks, decision trees, neural networks, fuzzy logic models, deep learning, and/or probabilistic classification models.

The architecture100includes a vulnerability engine103, which is a software program that runs on the vulnerability server116. In one embodiment, in a training phase, the vulnerability engine103is configured to develop models via machine learning, based on the security information113it receives from the vulnerability database112, to identify vulnerabilities in social media communication115that it receives.

In various embodiments, the social media communication115may be received continuously in real time, at predetermined intervals (e.g., every 10 minutes, every day, etc.) or upon a trigger event, e.g., upon the vulnerability database112indicating that there is an increased network security concern. The vulnerability engine103may discard social media that is deemed to be SPAM. For example, tweets that are intended for marketing, have links to URLs that are deemed to be problematic, mention a threshold number of unrelated users, etc., are removed from the social media communication packet115by the vulnerability engine103, thereby reducing the volume of data to be processed. In various embodiments, keywords, machine learning, or a combination thereof may be used to discern the intent of each social media communication in the data packet115.

For example, natural learning processing (NLP) can be used to process the raw natural language content of each communication in the data packet115. This natural language content may be received in the form of text or voice. Regarding the latter, the vulnerability engine103can perform speech recognition to determine the textual representation thereof. In natural speech, there may not be discernable pauses between successive words. To that end, speech segmentation may be performed to separate the words into meaningful sentences.

In one embodiment, concept expansion, such as the IBM Watson concept expansion, can be used to identify the concept cues in each communication to determine the intent thereof. In this regard, large sets of unstructured sets of data may be provided to the vulnerability engine103during a training phase, such that it can learn therefrom. The large sets of unstructured data may relate to prior communication that is deemed to be SPAM (e.g., by a SPAM filter repository—not shown), which now acts as a corpus of data to learn from. Such concept expansion enables the creation of a specialized dictionary for the cognitive application of identifying the subject matter and scope of the communication, collectively referred to herein as the “intent” of the social media communication (e.g., tweet). Concept expansion enables the vulnerability engine103to build a specialized dictionary for the cognitive application of interacting with the social media communication115that may be stored in a memory of the vulnerability server116(or any other suitable repository, such as the cloud120). Thus, unstructured source text that may not include well-formed language, such as email, text messages, and text that has been extracted via speech recognition, can be analyzed to discern its intent. Accordingly, the vulnerability engine103can correctly understand industry specific terminology, local euphemisms, and colloquial terms that may be encountered in social media. In this way, social media communication that is deemed to be SPAM (e.g., has a marketing effect) can be filtered out.

During a monitoring phase, the vulnerability engine103is configured to determine whether a communication or a communication thread of the social media communication115is related to a vulnerability, by way of the machine learning that may have been performed earlier (i.e., training phase), as discussed above. In this regard, reference is made toFIG. 2, which illustrates a conceptual diagram of a social media communication thread200that is related to a vulnerability. By way of example, and not by way of limitation, the communication200is illustrated as a thread of tweets between several participants. The vulnerability engine203running on the vulnerability server216is able to determine (i) that each post of the communication200is not related to SPAM, (ii) that the communication200is related to a vulnerability, and (iii) the category of the vulnerability (discussed in more detail below).

Accordingly, upon identifying a vulnerability, the vulnerability engine103is configured to classify the vulnerability into a predetermined category. The categories may include, without limitation, Denial of Service (DOS), SQL Injection, code execution, memory corruption, etc., In this regard,FIG. 3illustrates an example column chart of identified vulnerabilities in a predetermine time period. In some scenarios, a vulnerability may be related to more than one category.

Upon determining that the number of vulnerabilities is above a predetermined threshold for an identified vulnerability in a category for a time period, the vulnerability engine103can proceed from the monitoring phase to a resolution phase. In various embodiments, the predetermined threshold may be different for each category, based on the potential harm that it can cause. By virtue of categorizing the identified vulnerability, a more focused approach to resolving the vulnerability is provided. For example, databases and/or social media forums that are related to the identified category are solicited for the resolution of the vulnerability, thereby reducing the computing resources involved in processing the large volume of data received from social media, as discussed in more detail below.

In one embodiment, machine learning is used for the classification of identified vulnerabilities into one or more categories. For example, support vector machines (SVMs), which are supervised learning models with associated learning algorithms that analyze data used for classification and regression analysis, can be used. To that end, the vulnerability engine103may receive training examples from the vulnerability database112.

The vulnerability engine103is also configured to identify and search dependable threads111for different categories that include communication related to the identified vulnerability. In various embodiments, the identification may be during the training, monitoring, or resolution phase. For example, dependable threads may be identified from the received social media communication115for different categories, during a training (or monitoring phase), and stored in a memory of the vulnerability server116(or any other suitable repository, such as the cloud120). Then, during the resolution phase, the vulnerability engine can retrieve the identified dependable threads111for one or more categories related to the subject vulnerability. In this way, a focused search is performed during a resolution phase into the corpus of social media communication, thereby conserving valuable computing resources, reducing the time for resolution of the identified vulnerability, and providing a resolution that is more likely to be successful. The identification of dependable threads is discussed in more detail later.

In one embodiment, in a resolution phase, the vulnerability engine103is configured to identify a root cause of the vulnerability. To that end, the vulnerability engine103identifies different possible solutions and ranks them based on the dependability (e.g., quality) of the source and/or individual of each solution. The vulnerability engine103may receive many such communication threads. From these threads, the vulnerability engine103can identify the most likely root cause of the vulnerability, which is discussed in more detail later.

In one embodiment, in a resolution phase, the vulnerability engine103is also configured to send notification(s) to appropriate recipients, in response to identifying a vulnerability and/or resolution therefor. The appropriate recipients may be individuals, organizations, or any other suitable entity that may be affected by the identified vulnerability, including the vulnerability database112. The notification may be sent in various ways, such as common short code (CSC) using a short message service (SMS), multimedia message service (MMS), e-mail, telephone, social media, etc. In various embodiments, the notification can be provided on a user interface of a computing device (e.g.,102(1)) in the form of a message on the screen, an audible tone, a haptic signal, or any combination thereof. In some embodiments, the notification is not only an alert, but a patch (e.g., remedy) for the identified vulnerability.

While the social media110server110, vulnerability database112, and vulnerability server116are illustrated by way of example to be on different platforms, it will be understood that in various embodiments, these platforms may be combined in various combinations. In other embodiments, one or more of these computing platforms may be implemented by virtual computing devices in the form of virtual machines or software containers that are hosted in the cloud120, thereby providing an elastic architecture for processing and storage. The cloud120is discussed in more detail later.

Example Identification of Dependable Social Media Threads

As discussed above, the determination of the root cause of a vulnerability may include the identification of dependable threads in social media. In various embodiments, this identification may be performed during the training, monitoring, or resolution phase. Different types of criteria and/or logic can be used to determine which social media source (e.g., thread or contributor) is dependable. To that end, different criteria may be used, wherein each criterion may be attributed a different weight, to determine dependable social media sources. For example, peer vote, status of the source (whether the contributor is a known authority in the category); number of views, number of comments; the quality of the comments (e.g., positive or negative). Peer vote can be, for example, a rating by a peer as to whether the response was deemed to be helpful. For each tweet that is deemed to be related to a vulnerability, the number of replies, likes, retweets, and influence of the contributor can be used to determine dependability of the tweet in particular and/or thread in general. The threads that are deemed dependable (e.g., that are rated to be above a predetermined threshold) may be stored in their corresponding categories, such that these threads can be later referred to during the monitoring or resolution phase.

In one embodiment, a ranking algorithm, such as PageRank, can be used to determine the dependability of a source. For example, the PageRank algorithm can be adapted to count the number and quality of links to a social media communication to determine how important a social media communication is. The underlying assumption in PageRank (originally developed for Web links) is that more relevant websites are likely to receive more links from other websites. In one embodiment, applicants have used a similar approach to rank the dependability of social media communication. A ranking of a social media communication based on the PageRank algorithm is provided in equation 1 below:
PR(A)=(1−d)+d(PR(T1)/C(T1)+ . . . +PR(Tn)/C(Tn))  (Eq. 1)Where:d is a damping factor between 0 to 1;A is the user being evaluated;Ti is the user who gave a ling to user A; andC(Ti) is a total count of links from user Ti.

To reduce the volume of social media communication to review, in one embodiment, only social media threads that have a rating that is above a predetermined threshold are deemed to be dependable. In this way, computing resources and time associated in analyzing the social media communication is reduced in the resolution phase.

Example Resolution Phase

The resolution phase, which follows the training and monitoring phase, the root cause of the vulnerability is determined and/or notifications are sent out by the vulnerability engine103to provide alerts and/or remedies for the identified vulnerability. To that end, the social media communication that is deemed to be dependable is analyzed to find different possible root causes of the vulnerability. In one embodiment, subjective logic is used to take uncertainty and the veracity of the source into account. In this way, the uncertainty to a root cause of a vulnerability and/or to a solution thereof, can be ranked with respect to other root causes and/or solutions, respectively. I one embodiment, if a veracity score is below a predetermined threshold, then it is not deemed to be an identified root cause (and/or solution); rather, the vulnerability engine103may deem it as a possible intelligent guess in a trial and error scenario, which is pursued only when a more likely root cause cannot be discerned from the social media.

For example, arguments in subjective logic are subjective opinions that take values form a domain (sometimes referred to as a state space), where a state value can be thought of as a proposition that can be true or false. For example, a domain may be the type of social media (e.g., Twitter) and the state could represent the root cause or the factors to evaluate the root case. In various embodiments, the opinions can be binomial or multinomial. For example, a multinomial opinion applies to a state variable of multiple possible values.

An opinion is represented as wxA, where A represents the source of the opinion and x represents a state variable. For example, x can be considered as a binomial opinion, which can be represented as the quadruple wx=(bx, dx, ux, ax) where bxrepresents the belief that x is true, dxrepresents x is false, uxrepresents uncertainty, axrepresents the prior probability in the absence of belief or disbelief. Prior probability is a measure of one's belief regarding a quantity before considering any evidence. The foregoing parameters satisfy the relationship of equation 2 below:
bx+dx+ux=1  (Eq. 2)Where:bx, dx, and uxare [0 to 1]

Opinions of participants in a social media thread can be aggregated. For example, if two opinions <b1, d1, u1> and <b2, d2, u2> support each other, then we compute the aggregation as provided in equation 3 below:
<b=(b1+b2)/2,d=(d1+d2)/2,1−(b+d)>  (Eq. 3)Where:b1 and b2 represent beliefs from different sources (e.g., social media contributors) that a statement is true; andd1 and d2 represent beliefs from different sources that a statement is false.

If two opinions <b1, d1, u1> and <b2, d2, u2> conflict each other, then we compute the aggregation as provided in equation 3 below:
<b=(b1+d2)/2,d=(d1+b2)/2,1−(b+d)>  (Eq. 4)

By way of demonstrative example, consider a scenario where a social media participant (e.g., a tweeter) is proposing a root cause and/or a mitigation action for an identified vulnerability by the vulnerability engine103. In this regard, reference is made toFIG. 3, which illustrates a conceptual diagram of a social media communication300that is related to a possible solution to a vulnerability identified by the vulnerability engine303. By way of example, and not by way of limitation, the communication300is illustrated as a thread of tweets between several participants. The vulnerability engine303running on the vulnerability server316receives the communication in the form of a data packet311representing a dependable thread.

In the example ofFIG. 3, user1proposes a root cause302for a vulnerability that has been identified by the vulnerability engine303. Accordingly, the challenge for the vulnerability engine303is to attribute a validity score and later compare this score to other validity scores of root causes suggested in other social media threads. To that end, the subjective logic model may be applied as discussed above, where the vulnerability engine303leverages the response and credibility of other users participating in the thread to determine a validity score of the thread300in general, and the proposed root cause302in particular. For example, each response304to308would be assigned a different bx, dx, and uxscores, respectively. By aggregating all the scores in the thread, the vulnerability engine103can compute the overall bx, dx, and uxscore, representing the validity score of the proposed root cause302. The subjective logic model relies on evidence provided by users. It does not rely on the credibility of users. Based on the evidence, b, d, u scores can be assigned for each evidence. Further, a sign can be assigned as to whether an evidence is supportive (+) or conflicting (−).

Example Process

With the foregoing overview of the example architecture100and conceptual diagrams of social media communication200and300that are related to a vulnerability, it may be helpful now to consider a high-level discussion of an example process. To that end,FIG. 4presents an illustrative process400for identifying a vulnerability related to computing devices via social media. Processes400is illustrated as a collection of blocks in a logical flowchart, which represents a sequence of operations that can be implemented in hardware, software, or a combination thereof. In the context of software, the blocks represent computer-executable instructions that, when executed by one or more processors, perform the recited operations. Generally, computer-executable instructions may include routines, programs, objects, components, data structures, and the like that perform functions or implement abstract data types. The order in which the operations are described is not intended to be construed as a limitation, and any number of the described blocks can be combined in any order and/or performed in parallel to implement the process. For discussion purposes, the process400is described with reference to the architecture100ofFIG. 1.

At block402, the vulnerability engine103monitors social media communication110. In this regard, the social media communication115may be received at predetermined intervals or upon a trigger event (e.g., upon the vulnerability database112indicating that there is a network security concern that is above a predetermined threshold).

At block404, for each social media communication115received, the vulnerability engine103determines whether the communication therein (e.g., social media thread(s)) is related to a vulnerability of a computing device). If not (i.e., “NO” at decision block404), the process continues with block406, where the social media communication (e.g., a post or a thread) is discarded. However, upon determining that the social media communication is related to a vulnerability (i.e., “YES” at decision block404), in various embodiments, the process continues with block410or412.

At block410, the social media communication is filtered by discarding social media communication that is deemed to be SPAM by the vulnerability engine103(i.e., “YES” at decision block410). Upon filtering, the process continues with block412, where the vulnerability engine classifies each identified vulnerability into a corresponding predetermined category.

At block414, the vulnerability engine103determines, for each identified vulnerability, whether the number of social media posts related to the vulnerability exceeds a predetermined threshold. In various embodiments, the threshold may be based on the longevity (e.g., time) of the social media communication, volume of the social media communication (e.g., number of posts in a thread and/or a number of threads identifying a substantially similar vulnerability), or a combination thereof. The predetermined threshold may be different for each predetermined category. In this way, more serious threat categories can have a lower trigger point than less consequential threat categories.

Upon determining that the number of social media posts related to the vulnerability is not above the predetermined threshold (e.g., for its category) (i.e., “NO” at decision block414), the process continues with block402, thereby continuing to monitor the social media. However, upon determining that the number of social media posts related to the vulnerability is above the predetermined threshold (i.e., “YES” at decision block414), the process continues with block416, where the vulnerability engine103searches dependable social media threads that are related to the identified vulnerability.

At block418, one or more possible root causes of the vulnerability are identified from the searched dependable social media threads. In one embodiment, since the search is narrowed to only the one or more predetermined categories of the identified vulnerability, computational resources are conserved and the determination of the possible causes is expedited.

At block420, a validity score for each of the one or more possible root causes is assigned.

At block422, a root cause of the vulnerability is identified, based on a root cause that has a highest validity score and is above a predetermined threshold.

At block424, in one embodiment, the vulnerability engine103sends notification(s) to appropriate recipients, in response to identifying a vulnerability and/or resolution therefor. The appropriate recipients may be individuals, organizations, or any other suitable entity that may be affected by the identified vulnerability, including the vulnerability database112. The notification may be sent in various ways, such as common short code (CSC) using a short message service (SMS), multimedia message service (MMS), e-mail, telephone, social media, etc. In various embodiments, the notification can be provided on a user interface of a computing device (e.g.,102(1)) in the form of a message on the screen, an audible tone, a haptic signal, or any combination thereof. In some embodiments, the notification is not only an alert but a patch (e.g., remedy) for the identified vulnerability.

Example Computer Platform

As discussed above, functions relating to identifying a vulnerability related to computing devices via social media, can be performed with the use of one or more computing devices connected for data communication via wireless or wired communication, as shown inFIG. 1and in accordance with the process400ofFIG. 4.FIG. 5provides a functional block diagram illustration of a computer hardware platform that is capable of facilitating the monitoring of social media communication, identification of vulnerabilities of computing devices based on the monitored social media communication, determination of a root cause of the vulnerabilities, identification of potential remedies for the vulnerabilities, and the sending of notifications, as discussed herein. In particular,FIG. 5illustrates a network or host computer platform500, as may be used to implement a server, such as the vulnerability analysis server116ofFIG. 1.

The computer platform500may include a central processing unit (CPU)504, a hard disk drive (HDD)506, random access memory (RAM) and/or read only memory (ROM)508, a keyboard510, a mouse512, a display514, and a communication interface516, which are connected to a system bus502.

In one embodiment, the HDD506, has capabilities that include storing a program that can execute various processes, such as the vulnerability engine540, in a manner described herein. The vulnerability engine540may have various modules configured to perform different functions.

For example, there may be an interaction module542that is operative to receive electronic data from various sources, including social media communication115, data from dependable threads111, security information from the vulnerability database112, and data provided by the cloud120.

In one embodiment, there is a natural language processing module544operative to process the raw natural language content of each communication in the data packet115. There may be a concept expansion module548, operative to identify the concept cues in each social media communication to determine the intent thereof. There may be a machine learning module548operative to learn from the security information113received from the vulnerability database112during a training phase. The machine learning module548may also aid in identifying SPAM such that it can be removed from social media threads being evaluated.

In one embodiment, there is a classification module550operative to place each identified vulnerability into a corresponding predetermined threat category. There may be a subjective logic module554operative to take uncertainty and the veracity of the source of a social media communication into account to determine the dependability of a social media communication.

In one embodiment, there is a ranking module552that is operative to determine the dependability of a source. There may be a notification module556operative to send alerts (e.g., notification(s)) to appropriate recipients, in response to identifying a vulnerability and/or resolution therefor.

In one embodiment, a program, such as Apache™, can be stored for operating the system as a Web server. In one embodiment, the HDD506can store an executing application that includes one or more library software modules, such as those for the Java™ Runtime Environment program for realizing a JVM (Java™ virtual machine).

Example Cloud Platform

As discussed above, functions relating to identifying a vulnerability related to computing devices via social media may include a cloud200. It is to be understood that although this disclosure includes a detailed description on cloud computing, implementation of the teachings recited herein are not limited to a cloud computing environment. Rather, embodiments of the present disclosure are capable of being implemented in conjunction with any other type of computing environment now known or later developed.

Characteristics are as follows:

Service Models are as follows:

Deployment Models are as follows:

Referring now toFIG. 6, an illustrative cloud computing environment600is depicted. As shown, cloud computing environment600includes one or more cloud computing nodes610with which local computing devices used by cloud consumers, such as, for example, personal digital assistant (PDA) or cellular telephone654A, desktop computer654B, laptop computer654C, and/or automobile computer system654N may communicate. Nodes610may communicate with one another. They may be grouped (not shown) physically or virtually, in one or more networks, such as Private, Community, Public, or Hybrid clouds as described hereinabove, or a combination thereof. This allows cloud computing environment650to offer infrastructure, platforms and/or software as services for which a cloud consumer does not need to maintain resources on a local computing device. It is understood that the types of computing devices654A-N shown inFIG. 6are intended to be illustrative only and that computing nodes610and cloud computing environment650can communicate with any type of computerized device over any type of network and/or network addressable connection (e.g., using a web browser).

Hardware and software layer760includes hardware and software components. Examples of hardware components include: mainframes761; RISC (Reduced Instruction Set Computer) architecture based servers762; servers763; blade servers764; storage devices765; and networks and networking components766. In some embodiments, software components include network application server software767and database software768.

Virtualization layer770provides an abstraction layer from which the following examples of virtual entities may be provided: virtual servers771; virtual storage772; virtual networks773, including virtual private networks; virtual applications and operating systems774; and virtual clients775.

Workloads layer790provides examples of functionality for which the cloud computing environment may be utilized. Examples of workloads and functions which may be provided from this layer include: mapping and navigation791; software development and lifecycle management792; virtual classroom education delivery793; data analytics processing794; transaction processing795; and identifying a vulnerability related to computing devices via social media and solutions therefor796, as discussed herein.

CONCLUSION

Aspects of the present disclosure are described herein with reference to a flowchart illustration and/or block diagram of a method, apparatus (systems), and computer program products according to embodiments of the present disclosure. It will be understood that each block of the flowchart illustrations and/or block diagrams, and combinations of blocks in the flowchart illustrations and/or block diagrams, can be implemented by computer readable program instructions.