AUTOMATED MAPPING FOR IDENTIFYING KNOWN VULNERABILITIES IN SOFTWARE PRODUCTS

Systems, methods, and computer-readable for identifying known vulnerabilities in a software product include determining a set of one or more processed words based on applying text classification to one or more names associated with a product, where the text classification is based on analyzing a database of names associated with a database of products Similarity scores are determined between the set of one or more processed words and names associated with one or more known vulnerabilities maintained in a database of known vulnerabilities in products. Equivalence mapping is performed between the one or more names associated with the product and the one or more known vulnerabilities, based on the similarity scores. Known vulnerabilities in the product are identified based on the equivalence mapping.

TECHNICAL FIELD

The subject matter of this disclosure relates in general to the field of application security, more particularly to runtime application self-protection by identifying known vulnerabilities in software products by automatically mapping the software products to known vulnerabilities.

BACKGROUND

The National Vulnerability Database (NVD) is the U.S. government repository of standards based vulnerability management data. The NVD includes databases of security checklist references, security-related software flaws, misconfigurations, product names, and impact metrics. The definitions for vulnerabilities in the NVD typically include a Common Platform Enumeration (CPE), which may include vendor name, product name and product version, along with some other properties/dependencies under which the vulnerability is exposed. One problem with vulnerability assessment of an application or software product using the information obtained from the NVD is that the libraries which used for identifying vulnerabilities in the application's properties or dependencies may not correspond to the CPE used for defining the vulnerabilities in the NVD. For example, the CPEs can be based on standards, formats, nomenclatures, etc., which differ from the identifications and nomenclatures used in the application libraries. This mismatch leads to ineffective use of the NVD in identifying and managing known vulnerabilities in the applications.

DETAILED DESCRIPTION

Overview

Disclosed herein are systems, methods, and computer-readable media for performing automated equivalence mapping between one or more names associated with a software product (the names being based on a first naming convention) and one or more known vulnerabilities, maintained for example, in a database of known vulnerabilities (the known vulnerabilities being defined using a second naming convention which is different from the first naming convention). In various examples below, text classification and mapping techniques are described for the automated equivalence mapping.

In some examples, a method is provided. The method includes determining a set of one or more processed words based on applying text classification to one or more names associated with a product, wherein the text classification is based on analyzing a database of names associated with a plurality of products; determining similarity scores between the set of one or more processed words and names associated with one or more known vulnerabilities maintained in a database of known vulnerabilities in products; and performing equivalence mapping between the one or more names associated with the product and the one or more known vulnerabilities, based on the similarity scores.

In some examples, a system is provided. The system, comprises one or more processors; and a non-transitory computer-readable storage medium containing instructions which, when executed on the one or more processors, cause the one or more processors to perform operations including: determining a set of one or more processed words based on applying text classification to one or more names associated with a product, wherein the text classification is based on analyzing a database of names associated with a plurality of products; determining similarity scores between the set of one or more processed words and names associated with one or more known vulnerabilities maintained in a database of known vulnerabilities in products; and performing equivalence mapping between the one or more names associated with the product and the one or more known vulnerabilities, based on the similarity scores.

In some examples, a non-transitory machine-readable storage medium is provided, including instructions configured to cause a data processing apparatus to perform operations including: determining a set of one or more processed words based on applying text classification to one or more names associated with a product, wherein the text classification is based on analyzing a database of names associated with a plurality of products; determining similarity scores between the set of one or more processed words and names associated with one or more known vulnerabilities maintained in a database of known vulnerabilities in products; and performing equivalence mapping between the one or more names associated with the product and the one or more known vulnerabilities, based on the similarity scores.

In some examples, the names associated with the plurality of products are based on a first naming convention and the names associated with the one or more known vulnerabilities are defined using a second naming convention, the first naming convention being different from the second naming convention.

In some examples, analyzing the database of names associated with the plurality of products comprises: splitting one or more complex words into component word units based on performing word boundary detection on the database of names associated with the plurality of products.

In some examples, analyzing the database of names associated with the plurality of products comprises: canonicalizing at least a subset of words in the database of names associated with the plurality of products, based on identifying variations for the subset of names in the database of names associated with the plurality of products.

In some examples, analyzing the database of names associated with the plurality of products comprises: identifying stop words in the database of names associated with the plurality of products.

In some examples, analyzing the database of names associated with the plurality of products comprises: associating weights with words in the database of names associated with the plurality of products comprises.

In some examples, determining the similarity scores comprises: determining word distances between the set of one or more processed words and names associated with one or more known vulnerabilities maintained in a database of known vulnerabilities.

In some examples, performing the equivalence mapping comprises: determining a set of potential matches between the one or more names associated with the product and the one or more known vulnerabilities, based on the similarity scores; determining precise scores for the set of potential matches; and identifying a subset of potential matches from the set of potential matches, the subset of potential matches having precise scores greater than a predetermined threshold.

Description of Example Embodiments

Disclosed herein are systems, methods, and computer-readable media for automatically detecting possible equivalents of a vulnerability definition in a library or package used by a product and mapping these equivalents to the CPEs maintained in the NVD to overcome the above-noted problems in existing approaches. In some examples, systems and techniques are provided for automatically mapping packages, libraries, files, or other names used in software products or applications to known vulnerabilities maintained in a database such as the National Vulnerability Database (NVD). To overcome the challenges associated with different naming conventions and definitions relying on customizations and legacy nomenclature which may frequently differ from a Common Platform Enumeration (CPE) definitions for vulnerabilities provided in NVD, machine learning based text-classifiers are disclosed. The text-classifiers can be used to extract meaning from a large collection of library names and definitions used in different products.

For example, the text-classifiers discussed herein can be applied on a large database of libraries for Java packages, such as libraries for Maven standards, Manifests, or others. For example, a large maven Group Id, Artefact Id, Version Id (GAV) database containing GAVs for numerous Java packages can be downloaded from www.maven.org. The text classifier may perform techniques such as word boundary detection, canonicalization to recognize and associate variations with another, recognize synonyms, synthesize meaning of terms, implement stemming to identify stop words, assign word weights, etc., on the GAV database to classify the names in the GAV database. The text-classifier can be used for processing the library names in a product to obtain a set of processed words. The processed words can be mapped by an equivalence mapping engine to the CPE definitions or other naming convention/standard to determine whether a known vulnerability from the NVD may exist in the product. These and other aspects will be discussed in further detail with reference to the figures in the following sections.

FIG. 1Aillustrates a diagram of an example network environment100according to aspects of this disclosure. A network106can represent any type of communication, data, control, or transport network. For example, the network106can include any combination of wireless, over-the-air network (e.g., Internet), a local area network (LAN), wide area network (WAN), software-defined WAN (SDWAN), data center network, physical underlay, overlay, or other. The network106can be used to connect various network elements such as routers, switches, fabric nodes, edge devices, aggregation switches, gateways, ingress and/or egress switches, provider edge devices, and/or any other type of routing or switching device, compute devices or compute resources such as servers, firewalls, processors, databases, virtual machines, etc.

In some examples, compute resources108a-brepresent examples of the network devices which may be connected to the network106for communications with one another and/or with other devices. For example, the compute resources108a-bcan include various host devices, servers, processors, virtual machines, or others capable of hosting applications, executing processes, performing network management functions, etc. In some examples, applications110a-bcan execute on the compute resource108a, and applications110c-dcan execute on the compute resource108b. The applications can include any type of software applications, processes, or workflow defined using instructions or code.

A data ingestion block102representatively shows a mechanism for providing input data any one or more of the applications110a-d. The network106can be used for directing the input data to the corresponding applications110a-dfor execution. One or more applications110a-dmay generate and interpret program statements obtained from the data ingestion block102, for example, during their execution. Instrumentation such as vulnerability detection can be provided by a vulnerability detection engine104for evaluating the applications during their execution. During runtime, the instrumented application gets inputs and creates outputs as part of its regular workflow. Each input that arrives at an instrumented input (source) point is checked by one or more vulnerability sensors, which examine the input for syntax that is characteristic of attack patterns, such as SQL injection, cross-site scripting (XSS), file path manipulation, and/or JavaScript Object Notation (JSON) injection. For example, runtime application self-protection (RASP) agents112a-dcan be provided in the corresponding applications110a-dfor evaluating the execution of applications during runtime.

The RASP agents112a-dmay conduct any type of security evaluation of applications as they execute. In some examples, as shown with reference toFIG. 1B, the applications130a-bcan be store on a code repository120or other memory storage, rather than being actively executed on a computing resource. Similar agents such as the RASP agents can perform analysis (e.g., static analysis) of the applications. A code scanner agent122, for example, can be used to analyze the code in the applications130a-b. The RASP agents112a-dand/or the code scanner agent122or other such embedded solutions can be used for analyzing the health and state of applications in various stages, such as during runtime or in a static condition in storage.

In some examples, sensors can be used to monitor and gather dynamic information related to applications executing on the various servers or virtual machines and report the information to the collectors for analysis. The information can be used for providing application security, such as to the RASP agents. The RASP techniques, for example, can be used to protect software applications against security vulnerabilities by adding protection features into the application. In typical RASP implementations, these protection features are instrumented into the application runtime environment, for example by making appropriate changes and additions to the application code and/or operating platform. The instrumentation is designed to detect suspicious behavior during execution of the application and to initiate protective action when such behavior is detected.

During runtime of applications on virtual machines or servers in the network environment100, for example, the sensors provided for monitoring the instrumented applications can receive inputs and creates outputs as part of the regular workflow of the applications. In some examples, inputs that arrives at an instrumented input (source) point of a sensor can be checked for one or more vulnerabilities. For example, the sensors may gather information pertaining to applications to be provided to one or more collectors, where an analytics engine can be used to analyze whether vulnerabilities may exist in the applications.

The vulnerabilities can include weaknesses, feature bugs, errors, loopholes, etc., in a software application that can be exploited by malicious actors to gain access to, corrupt, cause disruptions, conduct unauthorized transactions, or cause other harmful behavior to any portion or all of the network environment100. For example, cyber-attacks on computer systems of various businesses and organizations can be launched by breaching security systems (e.g., using computer viruses, worms, Trojan horses, ransomware, spyware, adware, scareware, and other malicious programs) due to vulnerabilities in the software or applications executing on the network environment100. Most businesses or organizations recognize a need for continually monitoring of their computer systems to identify software at risk not only from known software vulnerabilities but also from newly reported vulnerabilities (e.g., due to new computer viruses or malicious programs). Identification of vulnerable software allows protective measures such as deploying specific anti-virus software or restricting operation of the vulnerable software to limit damage.

As previously described, system or software vulnerabilities may be identified as they are detected, cataloged, and published by independent third parties or organizations. Government organizations such as the National Institute for Standards and Technology (NIST) as well as private firms (e.g., anti-virus software developers) can report known vulnerabilities for use by private individuals and organizations in detecting whether known vulnerabilities exist in their systems and determine appropriate remedial measures. Databases such as the NVD maintained by the National Institute of Standards and Technology (NIST) contain a list of known vulnerabilities in various software applications and products. Consulting the NVD using the information obtained from the applications can reveal whether an application has a known vulnerability. However, mapping the information gathered during the runtime of an application in an automated manner to obtain real time vulnerability assessment is a significant challenge in known approaches because such processes are typically very tedious and rely on significant manual intervention because of a lack of standardization across different application dependencies, libraries, definitions, nomenclatures, naming conventions, etc.

A computer security organization that catalogs or reports computer system vulnerabilities may use an industry naming standard (software nomenclature) to report software system vulnerabilities. For example, NIST, which investigates and reports software system vulnerabilities, subscribes to the Common Platform Enumeration (CPE) standard for naming software systems. The industry naming standards may provide guidance on how software systems should be named so that the reported vulnerabilities can be mapped to the exact same software systems in a business or organization's computer system regardless of who is reporting those vulnerabilities. The standardized naming of software systems for vulnerability reporting may enable various stakeholders across different entities and organizations to share vulnerability reports and other information in a commonly understood format.

Unfortunately, many of the existing software systems pre-date use of the naming standards for the software nomenclature used in reporting vulnerabilities. The names of the existing or pre-deployed software systems may not comply with the software naming standards now used (e.g., by NIST) for reporting vulnerabilities. For instance, a business or organization may refer to or name a pre-deployed software component in its computer system as org.apache.spark:1.6″, “Apache Spark version 1.6.1”, etc, however, NIST under the CPE standard, may report a vulnerability on this particular software component as “apache.spark:1.6.1”. Further, even when common naming standards are used for software systems or components, other identifying information related to the software systems or components such as versions, updates and editions may be represented or named differently by different businesses and organizations. In particular, this other identifying information related to a software system may be represented or named differently by a business organization than the representation or name used for the other identifying information in the standardized vulnerability reports published by the third party computer security organizations.

Due to the vast number of different software system products used, standardization attempts by organizations or individuals is a significant challenge which may be possibly futile. Haphazard and uncoordinated standardization attempts can lead to imprecise names. Further, any free and open-source software systems deployed in an organization's computer systems can have unstandardized and conflicting names. Accordingly, a user or system administrator may be tasked with manually mapping the libraries to the known vulnerabilities in the NVD to utilize the benefits of the NVD or other such standard database.

Example systems and techniques described herein are directed to automated mapping of the non-standard names and information used in applications and libraries to vulnerability databases using standardized naming, such as to the CPE used by NVD. The automated mapping can be implemented by one or more computing devices and storage mechanisms such as databases, classifiers, mapping functions and others which may be deployed in the network environment100, for example.

FIG. 2illustrates a system200configured for automated equivalence mapping between one or more software products, packages, libraries, or the like and known vulnerabilities maintained in a standard database such as the NVD. The system200illustrates various functional blocks whose functionality will be explained below, while keeping in mind that these functional blocks may be implemented by a suitable combination of computational devices, network systems, and storage mechanisms such as those provided in the network environment100.

One or more databases of package names202can be obtained from various sources. For example, a database of package names202can include names of Apache Maven products/packages available from a publicly accessible repository such as a website, cloud storage location or other. A Maven database can include popularly used Java package names in a naming convention which uses Group ID, Artefact ID, and Version ID (GAV) to name the various software products developed and supported by Maven. Although the Maven GAV is used as an illustrative example here, it will be understood that various other databases of known package names, including those of internal products used in organizations, can be used in addition to or as an alternative to the Maven GAV names in the database of package names202. For example, the database of package names202can include package names from naming conventions/standards used in Gradle, Manifest, or other libraries used for Java projects. In general, the naming convention used for names in the database of package names202is referred to as a first naming convention, while a naming convention used for known vulnerabilities such as those defined using the CPE in the NVD are referred to as a second naming convention, where the first naming convention is different from the second naming convention.

Continuing with the example of Maven GAV, the database of package names202can be populated with a large collection of names in the GAV format, e.g., by downloading all project names from the Maven database available at www.maven.org or other suitable source location. In the GAV format, Group Id uniquely identifies a project across all projects. The Group ID follows Java's package name rules. The Group ID starts with a reversed domain name which may be controlled by a user. For example, “org.apache.maven” or “org.apache.commons” can be Group IDs. It is noted that Maven does not enforce the above naming rules, which means that many legacy projects may not follow this naming convention and instead may use single word Group IDs. Furthermore, within the Group ID, a user may create one or more subgroups to reflect a project's structure. For example, the subgroup names can be created by appending a new identifier to a parent's Group ID, such as “org.apache.maven.plugins” or “org.apache.maven.reporting” created by appending identifiers to “org.apache.maven.”

The Artefact ID is the name of a “JAR” file which does not include version information. A JAR or Java ARchive is a package file format typically used to aggregate many Java class files and associated metadata and resources (text, images, etc.) into one file for distribution. JAR files are archive files that include a Java-specific manifest file. The Artefact ID may be created using a user chosen name, e.g., “maven” or “commons-math”.

The Version ID can include version information for the project being named, such as an identifier using a suitable combination of numbers, punctuations, etc. (e.g., version 1.0, 1.1, 1.0.1, etc.).

Depending on whether the above aspects of the GAV (Group ID, Artefact ID, Version ID) are created by users following a specific format, using standardizations specified by organizations, inherited from legacy names or third parties, etc., there can be numerous variations in the names for the same product or package. Thus, the database of package names202can include two or more names for the same product, or may exhibit patterns in naming conventions for similar products, products by the same vendor, etc. Classifying these product names using machine learning techniques according to example aspects of this disclosure can synthesize meaning or context behind the names and enable equivalence mapping to a standard format such as a CPE for known vulnerabilities, as maintained by the NVD. According to some examples, a text classifier204may be used to analyze one or more names obtained from the database of package names202. One or more names of a product can be classified based on the text classifier204trained based on the analysis, to yield a set of processed words, where the processed words as discussed herein refer to words are output from the text classifier204.

FIG. 3illustrates examples of the text classification techniques which may be implemented by the text classifier204for analyzing the database of package names202.FIG. 3is illustrated as a process flow, but it will be understood that the techniques described with reference to the process steps need not be performed in the sequence illustrated, but equivalent functions or combinations thereof may be implemented in any suitable combination without deviating from the scope of the text classifier204described herein.

In step302, the text classifier204can perform word boundary detection on the database of package names202. For example, machine learning techniques may be used to identify word units in the database of package names202. One or more dictionaries (e.g., including words of a natural language, words and names used in software programming languages, or others) may be used as exemplars or training data. The database of package names202can be analyzed to identify word boundaries. Complex words which may have been formed using a combination of two or more word units can be split along these identified boundaries to separate the complex words into its component word units. For example, word boundary detection techniques applied on the complex word “apachespark” may reveal that “apache” and “spark” appear as individual words in the dictionaries. Accordingly, splitting along a word boundary can result in splitting the complex word “apachespark” into separate words or word units “apache” and “spark”. The result of splitting words based on identified word boundaries can facilitate canonicalization, word weighting, equivalence mapping, etc., on the individual word units.

In step304, the text classifier204can perform canonicalization on the database of package names202. In some examples, the canonicalization can be performed upon word boundary detection in step302to split the words, but in other examples, canonicalization may be independent of the step302. For example, canonicalization can be applied to identify and standardize variations of the same word or name in the GAV format. This process may use machine learning techniques with possible input from skilled users to identify variations of the same word or name and associate these variations with the same name.

For example, some naming conventions may use acronyms or abbreviations of one or more words or names. Thus, “DB” and “database” may be variations of the same word used in different product names. Similarly, “Excel” and “XL” may be variations of the same name when referring to a spreadsheet, which may have been created using a Microsoft Excel file, while possibly having “spreadsheet” in the name of a file to also convey the same meaning. In some examples, the names can also include variations of numerals or alphabets to denote versions, such as “1.6.0” and “1.6” being alternatives used to denote the same version. Thus, in some examples, the variations for a file name (or variations in individual word units upon word boundary detection) may be based on specific industries, contexts, meanings. Recognizing these variations can be based on analyzing large collections of names and identifying similarities in names for the same or similar files, file types, libraries, etc. The process of canonicalization in the step304can lead to associations or mappings between different names which are recognized as variations or alternatives for the same name.

In step306, the text classifier204can implement stemming processes on the database of package names202to determine stop words. For example, commonly used words for naming files or products can include “.com”, “bin”, etc., used as stop words. Stemming is a process for determining the stop words in the database of package names202created in the GAV format. In some examples, the stemming words can be excluded from the name of a product when determining equivalence to another name, such as in identifying similarity between a name in the GAV format and the vulnerability names in the CPE format. Excluding the stop words or minimizing their influence in determining the equivalence/similarity can be useful because the stop words or stemming words may not have inherent importance or high relative weight in the overall GAV based name of the product. Excluding or minimizing influence of stop words in the search can enable more efficient mapping functions to the known vulnerabilities maintained in the CPE format or other standard format.

In step308, the text classifier204can assign weights to the words or word units obtained from splitting words. For example, minimizing the influence of stemming words or stop words can include assigning a low weight to the stemming words. Word weights may be based on determining the amount of variation in a name or information gain that is accomplished based on the inclusion of a specific word or word unit in the name of a product obtained from the database of package names202. In some examples, words or word units which may contribute to the largest variation of a product name from other product names may be weighted more heavily, while the names contributing to the least variation may be weighted less. For example, in the name (or portion thereof) which includes “org.apache.spark”, the word “org” may be assigned the lowest weight while the word “spark” may be assigned the highest weight. This is because many products may be found to include the word “org”, which may lead to a determination that this word “org” may not contribute too heavily as a distinguishing feature of the name. On the other hand, the word “spark” may be used in a relatively smaller set of names which may have some common underlying characteristics such as belonging to a specific project, and thus weighting “spark” more heavily can mean it has higher relevance or stronger association with the specific project's name. When determining equivalence mapping to the product/package names having known vulnerabilities (e.g., in the NVD), word distances may be determined based on weighting the names using the weights applied by the text classifier204.

As shown inFIG. 2, the text classification techniques determined by the text classifier204based on analyzing the database of package names202can be used to process one or more names in the product206to obtain a set of processed words. The set of processed words can be used to determine mapping between the one or more names in the product206and the known vulnerabilities.

RevisitingFIG. 2, the system200includes an equivalence mapping engine208configured to perform equivalence mapping based on the text classifier204described above. In some implementations, the text classifier204and the equivalence mapping engine208can be implemented in the same functional block or one or more processes can be redistributed amongst these functional blocks even though they are shown and described as separate functional blocks for implementing the techniques described herein according to some illustrative examples.

As illustrated, a product206can be assessed for the presence of known vulnerabilities using the equivalence mapping engine208. In an example, the equivalence mapping engine208can utilize the text classifier204to analyze the names of libraries, files, etc., in a software product such as the product206and determine whether the known vulnerability database210may have known vulnerabilities which are pertinent to the product206. For example, the equivalence mapping engine208can determine equivalence between one or more processed words obtained from names (e.g., named according to GAV naming conventions) in the product206and one or more known vulnerabilities (e.g., defined using the CPE) in the NVD or other known vulnerability database210.

FIG. 4illustrates examples of the equivalence mapping techniques which may be implemented by the equivalence mapping engine208.FIG. 4is illustrated as a process flow, but it will be understood that the techniques described with reference to the process steps need not be performed in the sequence illustrated, but equivalent functions or combinations thereof may be implemented in any suitable combination without deviating from the scope of equivalence mapping engine208described herein.

In step402, the equivalence mapping engine208can determine word distance or lexical similarity between one or more processed words obtained by applying the text classifier204to names of the product206and the words obtained from the known vulnerability database210. For example, the text classification techniques provided by the text classifier204based on one or more of the word boundary detection (e.g., step302), canonicalization (e.g., step304), determining stemming or stop words (e.g., step306), and/or applying the weights to the words (e.g., step308) can be used to classify or process the names of libraries or other software products in the product206to yield the set of processed words. For example, the names in the product206may be suitably split based on the guidance provided by the text classifier204, variations to known alternatives identified based on canonicalization, stemming or stop words therein determined, and word units suitably weighted to generate a set of one or more processed words. The equivalence mapping engine208can implement a hashmap to consider variations of the names in the product206, where the variations may be obtained from the database of package names202provided in the GAV format according to the above example.

In step404, the equivalence mapping engine208can implement a fast score builder, e.g., using a hashmap or other mapping to yield a set of potential matches between the names in the product206and the known vulnerability database210(e.g., when there is at least one potential match). The set of potential matches may be too large in some cases, which could result in a large number of false positives. Thus a more precise mapping may be desirable.

In step406, the equivalence mapping engine208can determine precise scores from the set of potential matches. For example, based on suitable weighting of the processed words, the similarity between the names in the product206(as well as their variations, if any) can be measured against the potential matches identified from the hashmap based fast score builder. For example, the potential matches may determine equivalence between the GAV based names and the potential matches defined in the CPE format obtained from the known vulnerability database210. Similarity scores can be measured while accounting for upper or lower case sensitivities, typographical errors, common abbreviations or shortening of some words, etc. In some examples, the equivalent fields can be compared in measuring similarities. For example, numerical canonicalized versions obtained from the product206can be measured against similar version fields in the CPE, or product/vendor names can be compared against similar product/vendor name fields in the CPE, etc.

In step406, the equivalence mapping engine208can determine equivalence mapping using the precise scores. For example, a threshold score may be predefined or predetermined to represent an acceptable score precision above which a GAV based name in the product206can be considered to match a CPE based known vulnerability obtained from the known vulnerability database210. If the precise score is greater than this predetermined threshold score for one or more names of the product206, the equivalence mapping engine208may identify the projects, files, libraries, packages, or other software associated with the one or more names as having potential known vulnerabilities. Information regarding the corresponding known vulnerabilities can be obtained from the known vulnerability database210, such as the NVD. In some examples, additional remedial measures may be adopted based on guidance provided in the NVD for the known vulnerabilities.

Having described example systems and concepts, the disclosure now turns to the process500illustrated inFIG. 5. The blocks outlined herein are examples and can be implemented in any combination thereof, including combinations that exclude, add, or modify certain steps.

At the block502, the process500includes determining a set of one or more processed words based on applying text classification to one or more names associated with a product, wherein the text classification is based on analyzing a database of names associated with a plurality of products. For example, the text classifier204can be used to determine a set of one or more processed words based on applying text classification to one or more names associated with the product206.

As described with reference toFIG. 3, the text classifier204can implement various functions for analyzing the database of names associated with the plurality of products. For example, as described with reference to step302, analyzing the database of names associated with the plurality of products can include splitting one or more complex words into component word units based on performing word boundary detection on the database of names associated with the plurality of products. Further, as described with reference to step304, analyzing the database of names associated with the plurality of products can also include canonicalizing at least a subset of words in the database of names associated with the plurality of products, based on identifying variations for the subset of names in the database of names associated with the plurality of products. Additionally, as described with reference to step306, analyzing the database of names associated with the plurality of products can also include analyzing the database of names associated with the plurality of products can also include identifying stop words in the database of names associated with the plurality of products. Moreover, as described with reference to step308, analyzing the database of names associated with the plurality of products can also associating weights with words in the database of names associated with the plurality of products comprises.

At the block504, the process500includes determining similarity scores between the set of one or more processed words and names associated with one or more known vulnerabilities maintained in a database of known vulnerabilities in products. For example, the equivalence mapping engine208can be used to determine similarity scores between the set of one or more processed words and names associated with one or more known vulnerabilities maintained in a database of known vulnerabilities in products. In some examples, as described with reference to step402ofFIG. 4, determining the similarity scores can include determining word distances between the set of one or more processed words and names associated with one or more known vulnerabilities maintained in a database of known vulnerabilities.

At the block506, the process500includes performing equivalence mapping between the one or more names associated with the product and the one or more known vulnerabilities, based on the similarity scores. For example, the equivalence mapping engine208can be used to perform equivalence mapping between the one or more names associated with the product and the one or more known vulnerabilities, based on the similarity scores, as discussed with reference toFIG. 4. In some examples, performing the equivalence mapping can include determining a set of potential matches between the one or more names associated with the product and the one or more known vulnerabilities, based on the similarity scores (e.g., as discussed with reference to step404), determining precise scores for the set of potential matches (e.g., as discussed with reference to step406), and identifying a subset of potential matches from the set of potential matches, the subset of potential matches having precise scores greater than a predetermined threshold (e.g., as discussed with reference to step408).

In the above-referenced examples, the names associated with the plurality of products can be based on a first naming convention (e.g., Maven GAV) and the names associated with the one or more known vulnerabilities can be defined using a second naming convention (e.g., the CPE used for defining vulnerabilities in the NVD), the first naming convention being different from the second naming convention.

FIG. 6illustrates an example network device600suitable for implementing the aspects according to this disclosure. In some examples, the devices described with reference to system100and/or the network architecture may be implemented according to the configuration of the network device600. The network device600includes a central processing unit (CPU)604, interfaces602, and a connection610(e.g., a PCI bus). When acting under the control of appropriate software or firmware, the CPU604is responsible for executing packet management, error detection, and/or routing functions. The CPU604preferably accomplishes all these functions under the control of software including an operating system and any appropriate applications software. The CPU604may include one or more processors608, such as a processor from the INTEL X86 family of microprocessors. In some cases, processor608can be specially designed hardware for controlling the operations of the network device600. In some cases, a memory606(e.g., non-volatile RAM, ROM, etc.) also forms part of the CPU604. However, there are many different ways in which memory could be coupled to the system.

Although the system shown inFIG. 6is one specific network device of the present technologies, it is by no means the only network device architecture on which the present technologies can be implemented. For example, an architecture having a single processor that handles communications as well as routing computations, etc., is often used. Further, other types of interfaces and media could also be used with the network device600.

The network device600can also include an application-specific integrated circuit (ASIC), which can be configured to perform routing and/or switching operations. The ASIC can communicate with other components in the network device600via the connection610, to exchange data and signals and coordinate various types of operations by the network device600, such as routing, switching, and/or data storage operations, for example.

FIG. 7illustrates an example computing device architecture700of an example computing device which can implement the various techniques described herein. The components of the computing device architecture700are shown in electrical communication with each other using a connection705, such as a bus. The example computing device architecture700includes a processing unit (CPU or processor)710and a computing device connection705that couples various computing device components including the computing device memory715, such as read only memory (ROM)720and random access memory (RAM)725, to the processor710.

The computing device architecture700can include a cache of high-speed memory connected directly with, in close proximity to, or integrated as part of the processor710. The computing device architecture700can copy data from the memory715and/or the storage device730to the cache712for quick access by the processor710. In this way, the cache can provide a performance boost that avoids processor710delays while waiting for data. These and other modules can control or be configured to control the processor710to perform various actions. Other computing device memory715may be available for use as well. The memory715can include multiple different types of memory with different performance characteristics. The processor710can include any general purpose processor and a hardware or software service, such as service1732, service2734, and service3736stored in storage device730, configured to control the processor710as well as a special-purpose processor where software instructions are incorporated into the processor design. The processor710may be a self-contained system, containing multiple cores or processors, a bus, memory controller, cache, etc. A multi-core processor may be symmetric or asymmetric.

Storage device730is a non-volatile memory and can be a hard disk or other types of computer readable media which can store data that are accessible by a computer, such as magnetic cassettes, flash memory cards, solid state memory devices, digital versatile disks, cartridges, random access memories (RAMs)725, read only memory (ROM)720, and hybrids thereof. The storage device730can include services732,734,736for controlling the processor710. Other hardware or software modules are contemplated. The storage device730can be connected to the computing device connection705. In one aspect, a hardware module that performs a particular function can include the software component stored in a computer-readable medium in connection with the necessary hardware components, such as the processor710, connection705, output device735, and so forth, to carry out the function.

Devices implementing methods according to these disclosures can comprise hardware, firmware and/or software, and can take any of a variety of form factors. Some examples of such form factors include general purpose computing devices such as servers, rack mount devices, desktop computers, laptop computers, and so on, or general purpose mobile computing devices, such as tablet computers, smart phones, personal digital assistants, wearable devices, and so on. Functionality described herein also can be embodied in peripherals or add-in cards. Such functionality can also be implemented on a circuit board among different chips or different processes executing in a single device, by way of further example.