System and method for associating a common vulnerability and exposures (CVE) with a computing device and applying a security patch

A system is configured for associating a CVE with a particular device profile is disclosed. The system receives a request from a user to associate a CVE with a particular device profile. For each device profile from a plurality of device profiles stored in a memory, the system determines feature importance values for features of each device profile. The features of each device profile include at least an operating system and a CPU architecture. The feature importance value of a corresponding feature of a device profile associated with a CVE indicates a probability of the CVE to affect the device profile with respect to that feature. The system identifies a device profile that has features with a total feature importance value above a feature importance threshold value. The system identifies a particular CVE associated with the identified device profile. The system associates the particular CVE with the particular device profile.

TECHNICAL FIELD

The present disclosure relates generally to security vulnerabilities and security exploits technologies, and more specifically to a system and method for associating a Common Vulnerability and Exposures (CVE) with a computing device and applying a security patch.

BACKGROUND

Preventing security vulnerabilities and security exploits in a proactive approach can be difficult using current security vulnerabilities and security exploits management techniques. Current security vulnerabilities and security exploits management techniques utilize an inventory of known device profiles associated with known security vulnerabilities to identify security patching needs. This approach can introduce security gaps as other device profiles with similar features as a device profile present in the inventory may also be vulnerable to those security exploits identified in the known security vulnerabilities associated with the device profile.

SUMMARY

In one embodiment, a system for associating a common vulnerability and exposure (CVE) with a particular device includes a memory to store a plurality of CVEs and a plurality of device profiles. Each device profile is associated with a corresponding CVE. Each device profile comprises features of the device. The features of the device include at least two of an operating system (OS), central processing unit (CPU) architecture, graphics processing unit (GPU) architecture, a memory architecture, and an installed software of the device. The system also includes a processor that is configured to receive a request from a user to associate a CVE with a particular device profile. For each device profile from among the plurality of device profiles stored in the memory, the processor determines feature importance values for features of each device profile. A feature importance value of a corresponding feature of a device profile associated with a CVE indicates a probability of the CVE to affect the device profile with respect to that feature. The processor identifies a device profile from among the plurality of device profiles that has one or more features in common with the particular device profile, where the one or more features are associated with a total feature importance value above a feature importance threshold value. The total feature importance value of the device profile is a sum of feature importance values of the one or more features of the device profile in common with the particular device profile. The processor identifies a particular CVE associated with the identified device profile. The processor associates the particular CVE with the particular device profile.

The existing security and vulnerability management technologies utilize an inventory of known device profiles associated with known CVEs to identify security patching needs of the known device profiles within an organization. The existing security and vulnerability management technologies lack capabilities to determine whether the known CVEs associated with the known device profiles (available in the inventory) also affect other device profiles (not yet included in the inventory) with one or more features with a total feature importance values higher than a feature importance threshold value of features in common with any of the known device profiles. A feature importance value of a feature in a device profile indicates a probability of the CVE (associated with the device profile) to affect the device profile with respect to that feature. For example, assume that a first device profile associated with a CVE-1 already exists in the inventory of known device profiles. Also assume that a second device profile has one or more features, such as an OS, CPU architecture, GPU architecture, memory architecture, installed software, etc. in common with the first device profile (i.e., the second device profile is similar to the first device profile). Also, assume that the total feature importance of the one or more features is above the feature importance threshold value. The existing security and vulnerability management technologies are not configured to associate the CVE-1 with the second device profile or provide a security patch to the second device profile for addressing the security vulnerabilities identified in the CVE-1.

The existing security and vulnerability management technologies use a community-based approach to determine and associate CVEs with device profiles. In the community-based approach, a particular device profile is associated with a particular CVE when a user from the community experiences that the particular device (associated with the particular device profile) is affected by the particular CVE. In other words, the existing security and vulnerability management technologies use a reactive approach in associating CVEs with device profiles. Thereby, the inventory of device profiles is updated after the particular device is affected by the particular CVE; and the particular device profile associated with the particular CVE is added to the inventory of device profiles. This approach does not account for other device profiles which have one or more features with a total feature importance values higher than a feature importance threshold value in common with the device profiles already present in the inventory of known device profiles which may be vulnerable to the same CVEs that affects the known device profiles. This leads to a security gap in which the other device profiles (which are not yet included in the inventory of the known device profiles) remain vulnerable to the same CVE that affects the known device.

Certain embodiments of this disclosure provide unique solutions to technical problems of previous security and vulnerability management technologies, including those problems described above. For example, the disclosed system provides several technical advantages, which include: 1) associating CVEs to other device profiles (not included in the inventory of known device profiles) which have one or more features with a total feature importance values higher than a feature importance threshold value (e.g., 80%) in common with known device profiles already present in the inventory. A feature importance value of each feature in a particular device profile associated with a particular CVE (already present in the inventory) is determined based at least in part upon a probability that a particular CVE to affect the particular device profile with respect to that feature. (i.e., providing CVEs for the device which have similar device profiles as the known device); and 2) providing security patches to the other device profiles to address security vulnerabilities and security exploits which are identified in the known CVEs associated with the other device profiles. As such, this disclosure may improve the underlying operation of other devices (associated with the other device profiles not included in the inventory). Accordingly, the disclosed system may provide a practical application of associating security vulnerabilities and security exploits with the other devices before they affect the other devices. This, in turn, provides an additional practical application of providing a solution to reduce a risk of exposure to emerging security vulnerabilities and security exploits, such as emerging malware, cyberattacks, etc. for the other devices by recommending a security patch associated with the known CVEs.

DETAILED DESCRIPTION

FIG.1illustrates one embodiment of a system100configured to associate a CVE140with a particular device profile150. In one embodiment, the system100comprises a computing device102that includes processor120in signal communication with a memory130and a network interface106. Memory130includes software instructions124that when executed by the processor120cause the computing device102to perform one or more functions described herein. Memory130may also include a device profile database132and a training dataset142which provides information that may be used by software instructions124and/or processor120. In one embodiment, the processor120includes a classifier122. In other embodiments, system100may not have all of the components listed and/or may have other elements instead of, or in addition to, those listed above.

In general, the system100improves the security and vulnerability management technologies by associating the CVEs140with device profiles150which are not included in the device profile database132. For example, the system100predicts that a CVE140-1affects a device profile150-1by identifying a device profile134-1(associated with the CVE140-1) which has one or more features136in common with the device profile150-1, where a total feature importance value138associated with the common one or more features136is above the feature importance threshold value146. The feature importance value138associated with a feature136in a device profile134(associated with a CVE140) indicates a probability that the CVE140to affect the device profile134with respect to that feature136. System100also provides a solution for reducing the risk of CVE140-1affecting the device profile150-1by recommending a security patch144-1to update the device profile150-1.

Computing device102is generally any computing device configured to communicate with other computing devices, servers, etc. through the network interface106. The computing device102is configured to perform specific functions described herein and interact with users104, e.g., via user interfaces. Examples of the computing device102include but are not limited to desktop computers, mobile phones, tablet computers, laptop computers, servers, etc.

Within an organization, there may be a large number of computing devices (e.g., computing device102) associated with device profiles134, where a device profile134associated with each computing device includes features136, such as, for example, an Operating System (OS), Central Processing Unit (CPU) architecture, Graphics Processing Unit (GPU) architecture, memory architecture, installed software, etc. The device profile database132within the organization is an inventory of the computing devices with device profiles134associated with CVEs140. The CVEs140include security vulnerabilities and exploits that affect the computing devices associated with the device profiles134. For example, a CVE140may indicate that a particular driver in an update of Windows 7 OS includes a defect that allows a third party to gain the privilege of accessing the OS files. In one embodiment, the CVEs140are recorded in the National Vulnerability Database (NVD) and available to the public. Typically, a particular CVE140-1is associated with the device profile134-1as an employee of the organization operating the computing device (associated with the device profile134-1) experiences that the particular CVE140-1has affected the computing device. The employee of the organization may then report the particular CVE140-1affecting the computing device to an appropriate department to update the device profile database132to include the device profile134-1associated with the particular CVE140-1.

Network interface106is configured to enable wired and/or wireless communications. The network interface106is configured to communicate data between the computing device102and other devices, systems, or domain(s). For example, the network interface106may comprise a WIFI interface, a local area network (LAN) interface, a wide area network (WAN) interface, a modem, a switch, or a router. The processor120is configured to send and receive data using the network interface106. The network interface106may be configured to use any suitable type of communication protocol as would be appreciated by one of ordinary skill in the art.

Processor120comprises one or more processors operably coupled to network interface106, and memory130. The processor120is any electronic circuitry including, but not limited to, state machines, one or more central processing unit (CPU) chips, logic units, cores (e.g. a multi-core processor), field-programmable gate array (FPGAs), application-specific integrated circuits (ASICs), or digital signal processors (DSPs). The processor120may be a programmable logic device, a microcontroller, a microprocessor, or any suitable combination of the preceding. The one or more processors are configured to process data and may be implemented in hardware or software. For example, the processor120may be 8-bit, 16-bit, 32-bit, 64-bit, or of any other suitable architecture. The processor120may include an arithmetic logic unit (ALU) for performing arithmetic and logic operations, processor registers that supply operands to the ALU and store the results of ALU operations, and a control unit that fetches instructions from memory and executes them by directing the coordinated operations of the ALU, registers and other components. The one or more processors are configured to implement various instructions. For example, the one or more processors are configured to execute instructions (e.g., software instructions124) to implement classifier122. In this way, processor120may be a special-purpose computer designed to implement the functions disclosed herein. In an embodiment, the processor120is implemented using logic units, FPGAs, ASICs, DSPs, or any other suitable hardware. The processor120is configured to operate as described inFIGS.1-3. For example, the processor120may be configured to perform the steps of method300as described inFIG.3.

Memory130may be volatile or non-volatile and may comprise a read-only memory (ROM), random-access memory (RAM), ternary content-addressable memory (TCAM), dynamic random-access memory (DRAM), and static random-access memory (SRAM). Memory130may be implemented using one or more disks, tape drives, solid-state drives, and/or the like. Memory130is operable to store the software instruction124, device profile database132, training dataset142, and/or any other data or instructions. The software instruction124, device profile database132, and training dataset142may comprise any suitable set of instructions, logic, rules, or code operable to execute the processor120. The stored software instruction124, device profile database132, and training dataset142are described in more detail below.

Classifier

Classifier122may be implemented using software instructions124executed by the processor120, and is configured to associate a CVE140with a device profile150that is not present in the device profile database132. In one embodiment, the classifier122may be implemented using machine learning classification algorithms, such as, for example, Support Vector Machine (SVM), Naive Bayes, Logistic Regression, k-Nearest Neighbors, Decision trees, etc. In other embodiment, classifier122may utilize a plurality of neural network (NN) layers, Convolutional NN layers (CNN) layers, and/or the like, in which weights and biases of perceptrons of the NN and CNN layers are optimized in the training process of the classifier122.

In one embodiment, the classifier122may associate a particular CVE140with a particular device profile150by identifying a device profile134(associated with the particular CVE140) which includes one or more features136with a total feature importance value138above the feature importance threshold value146. Throughout this process, the classifier122first determines feature importance values138associated with features136in each device profile134. The feature importance value138associated with a feature136in a device profile134(associated with a CVE140) is a numerical representation of a probability or likelihood of the CVE140to affect the device profile134with respect to that feature136.

In one embodiment, within an organization, the feature importance values138associated with features136in each device profile134may be determined by data gathered from employees of the organization, for example, via Jira tickets, etc. For example, when an employee of the organization operating a computing device (associated with a device profile134), the employee may experience that a security vulnerability identified in a CVE140is affecting the computing device and report in a Jira ticket that the computing device is affected by the CVE140. The reported Jira ticket may also indicate the severity and frequency of the CVE140affecting the computing device with respect to different features136. Thus, the feature importance values138associated with features136in each device profile134within the organization may be determined based on the severity and frequency of the CVE140affecting the computing devices with respect to different features136indicated in a plurality of Jira tickets from employees of the organization.

In another embodiment, the classifier122may determine the feature importance values138associated with features136in each device profile134, e.g., using a Natural Language Processing (NLP) algorithm by paring through a documentation of the CVE140(associated with each device profile134) which is available on the webpage of the CVE140. The NLP algorithm may be implemented using software instructions124executed by the processor120, and is configured to determine a meaning and sentiment of documentations of CVEs140. The NLP algorithm may implement a plurality of NN layers, CNN layers, etc., in which weights and biases of perceptrons of the NN and CNN layers are adjusted to determine the meaning and the sentiment of the documentations of the CVEs140more accurately.

The classifier122may also extract incidents caused by security vulnerabilities identified in the documentation of the CVEs140which are reported by different users104(available on the webpage of the CVE140). The classifier122may extract the reported incidents by web scraping and determine the severity and frequency of the CVE140affecting a computing device with a device profile134with respect to each feature136. For example, the classifier122may extract specific keywords identified in the reported incidents (available in the reference links provided in the webpage of the CVE140) and determine the severity and frequency of the CVE140affecting the computing device with the device profile134with respect to each feature136.

For example, assume that security vulnerabilities of a CVE140are identified in a description of the CVE140, such as, “ActiveX Control(HShell.dll) in Handy Groupware 1.7.3.1 for Windows 7 allows an attacker to execute arbitrary command via the ShellExec method.” Thus, the classifier122(e.g., using the NLP algorithm) may determine the meaning and sentiment of this description and determine that this particular CVE140is related to Windows 7 OS feature136and this particular CVE140affects device profiles134which include Windows 7 OS feature136.

The classifier122may also extract the number of times this CVE140affects device profiles134with Windows 7 OS feature136reported by different users, e.g., using web scraping the reference links provided in the webpage of the CVE140. If the number of times this CVE140affected the device profiles134with Windows 7 OS feature136is high, the classifier122may determine that the severity of the CVE140is also high. The classifier122may also determine the severity of the CVE140affecting device profiles134with Windows 7 OS feature136based on a risk of the CVE140imposes on the device profiles134with Windows 7 OS feature136. For example, as a consequence of this CVE140, if a third party would be able to access confidential data, the classifier122may determine that the severity of the CVE140is high. In another example, as a consequence of this CVE140, if a third party would be able to erase the memory of the device profile134with Windows 7 OS feature136, the classifier122may determine that the severity of the CVE140is high.

Thus, based on the determined meaning of the description of the CVE140, the extracted reported incidents, and frequency and severity of the CVE140, the classifier122may determine and assign feature importance values138for each feature136in device profiles134. Some examples of the classifier122determining feature importance values138for features136in device profiles134are described in conjunction with the method300illustrated inFIG.3. Once the feature importance values138associated with features136in each device profile134are determined, the classifier122is trained, tested, and refined with the training dataset142(which includes the device profiles134labeled with CVEs140). In implementation, the classifier122may be given one or more of the device profiles150(which are not labeled with CVEs140) and asked to associate one or more CVEs140to them. Details of training, testing, and refining the classifier122are described inFIG.2.

FIG.2illustrates one example of a modeling of the classifier122. In one embodiment, the classifier122is generated or modeled using the device profiles databases132and training dataset142. The training dataset142includes the device profiles134associated or classified with CVEs140and security patches144. In the training dataset142, each device profile134is labeled with its corresponding CVE140. As such, the target variables in training the classifier122are the CVEs140. In the training process, the classifier122is given a first portion of device profiles134labeled with CVEs140(from a first portion of the training dataset142) to learn the association between the device profiles134and their corresponding CVEs140.

Once the classifier122is trained, it is tested using a second portion of device profiles134without their corresponding CVEs140(from a second portion of the training dataset142) which the classifier122has not yet been exposed thereto. In this process, the classifier122is given the second portion of the device profiles134and is asked to predict or associate CVEs140with them. The classifier122predicts or associates CVEs140with the second portion of the device profiles134based on the learned data from the training process. The prediction results from the testing process is then evaluated. In this process, the classifier122compares the predicted CVEs140with the actual CVEs140associated with the second portion of the device profiles134. If one or more of the second portion of the device profiles134are not associated with a correct CVE140, the classifier122is refined, e.g., by performing a backpropagation process in which one or more weight and bias values in the neural network layers of the classifier122are adjusted. In one embodiment, the classifier122may be refined by using a third portion of the device profiles134which the classifier122has not yet been exposed thereto. The classifier122may go through the training, testing, and refining process until the prediction results of CVEs140associated with the device profiles150are above, e.g., 99%.

Once the classifier122is finalized, it is implemented to associate the CVEs140with the device profiles150(which are not included in the device profile database132or the training dataset142). In the implementation process, the user104may request the classifier122to associate a CVE140with a device profile150. The classifier122identifies a particular device profile134which has one or more features136in common with the device profile150, and a total feature importance values138associated with the one or more common features136is above the feature importance threshold value146, e.g., 80%. The classifier122identifies the particular CVE140associated with the particular device profile134. The classifier122then associates the particular CVE140with the device profile150. Details of the operation of the classifier122are described in conjunction with the method300illustrated inFIG.3.

In one embodiment, the classifier122may associate one or more of known CVEs140with the particular device profile150. For example, the classifier122may identify that the first device profile134-1associated with the CVE140-1has one or more features136with a total feature importance value138higher than the feature importance threshold value146. Thus, the classifier122may associate the particular device profile150with the CVE140-1. In the same example, the classifier122may also identify that the second device profile134-2associated with the CVE140-2has one or more features136with a total feature importance value138higher than the feature importance threshold value146. Thus, the classifier122may also associate the CVE140-2with the particular device profile150. The classifier122may duplicate the particular device profile150for each of these two CVEs140-1and140-2and associate the CVE140-1with a first copy of the particular device profile150; and associate the CVE140-2with a second copy of the particular device profile150.

Example of a Method for Associating a CVE with a Device Profile

FIG.3illustrates a flow chart of a method300for associating a CVE140with a device profile150. One or more of steps302-324of the method300may be implemented, at least in part, in the form of software instructions124stored on non-transitory, tangible, machine-readable media (e.g., memory130) that when run by one or more processors (e.g., processor120) may cause the one or more processors to perform steps302-324. In some embodiments, method300may be performed on system100ofFIG.1, including the computing device102, processor120, and the classifier122. Aspects of the steps302-324of the method300have been covered in the description forFIGS.1-2; and additional aspects are provided below.

The method300begins at step302where the user104sends a request to the classifier122to determine a CVE140for a particular device profile150(which is not included in the device profile database132). For example, the user104may send the request to the classifier122by a user interface of the computing device102, coding console application of the classifier122, etc.

In step304, the classifier122determines feature importance values138associated with the features136of device profiles134in the device profile database132, for example, as described inFIG.1.

In a first example, consider a device profile134-1(associated with a first computing device, e.g., a desktop computer, a server, a laptop, etc.) which includes features136, such as, Windows 7 SP1 OS feature136-1a, X64 CPU architecture feature136-2a, Compute Unified Device Architecture (CUDA) GPU architecture feature136-3a, Double Data Rate 3 (DDR3) memory architecture feature136-4a, and Python 2.7 feature136-5a, as illustrated in TABLE. 1.

As illustrated in TABLE 1, the device profile134-1is associated with the CVE140-1. The device profile134-1may also be associated with other CVEs140which are recorded in separate device profiles134associated with the first computing device. In this example, assume that the documentation of the CVE140-1includes a text description, such as, for example, “a security vulnerability may occur when a user attempts to send an HTTP server request using an installed Python Idle software with version 2.7 from a urllib.request.AbstractBasicAuthHandler package.”

The classifier122determines the feature importance values138-1ato138-5aassociated with the features136-1ato136-5a, respectively, based on the probability or likelihood of the CVE140-1to affect the first computing device with respect to each feature136-1ato136-5a. The probability of the CVE140-1to affect the first computing device with respect to each feature136-1ato136-5ais determined based on the determined meaning of the description of the CVE140, the extracted reported incidents, and frequency and severity of the CVE140-1, as described inFIG.1. In one embodiment, the classifier122uses the NLP algorithm to determine the probabilities of CVE140-1affecting the first computing device with respect to each feature136-1ato136-5a, e.g., by paring through the documentation of CVE140-1. In this process, the classifier122may use the NLP algorithm to extract the meaning of the documentation of the CVE140-1and determine that the CVE140-1affects the first computing device with respect to the installed Python software 2.7 feature136-5a. The classifier122may also extract reported incidents (available on the webpage of the CVE140-1) by web scraping and determine a severity and frequency of the CVE140-1affecting the first computing device with respect to the installed Python software 2.7 feature136-5a, as described inFIG.1. Thus, based on the determined meaning of the description of the CVE140-1and the extracted reported incidents, the classifier122may determine that the probability of the CVE140-1to affect the first computing device with respect to the installed Python software 2.7 feature136-5ais high. The classifier122may also determine that CVE140-1documentation does not include a security vulnerability related to any other features136of device profile134-1(i.e., determines that the probability of CVE140-1to affect the first computing device with respect to other features136is 0%). Thus, the classifier122may determine that the probability of the CVE140-1to affect the first computing device with respect to the installed Python software 2.7 feature136-5ais 100%. As such, the classifier122assigns a high feature importance value138-5a(i.e., 100%) to the installed Python software 2.7 feature136-5a. The classifier122may assign a low feature importance value138(i.e., 0%) to other features136of the device profile134-1, as illustrated in TABLE. 2.

In a second example, consider a second device profile134-2(associated with a second computing device, e.g., a desktop computer, a server, a laptop, etc.) which includes features136, such as, Windows 7 SP1 OS feature136-1b, X64 CPU architecture feature136-2b, Open Computing Language (OpenCL) GPU architecture feature136-3b, DDR2 memory architecture feature136-4b, and Python 2.7 feature136-5a, as illustrated in TABLE. 3.

As illustrated in TABLE 3, the device profile134-2is associated with a CVE140-2. In this example, assume that the documentation of the CVE140-2includes a text description, such as, for example, “In Python 2.7, an insecure dependency load upon launch on Windows 7 may result in an attacker's copy of api-ms-win-core-path-11-1-0.dll being loaded and used instead of the system's copy.” The classifier122determines the feature importance values138-1bto138-5bassociated with the features136-1bto136-5b, respectively, based on the probability or likelihood of the CVE140-2to affect the second computing device with respect to each feature136-1bto136-5b. The classifier122may use the NLP algorithm to extract the meaning of the documentation of the CVE140-2and determine that the CVE140-2affects the second computing device with respect to the Windows 7 OS feature136-1aand installed Python software 2.7 feature136-5b. The classifier122may also extract reported incidents (available on the webpage of the CVE140-2) by web scraping and determine a severity and frequency of the CVE140-2affecting the second computing device with respect to the Windows 7 OS feature136-1band installed Python software 2.7 feature136-5b. For example, assume that 70 out of 100 users104who reported the CVE140-2affected their computing device (which includes the Windows 7 OS feature136-1band installed Python software 2.7 feature136-5b) also reported that the CVE140-2poses a greater risk with respect to the Windows 7 OS feature136-1b, such as, for example, these users104were unable to recover the api-ms-win-core-path-11-1-0.dll file in their Windows 7 OS. Also, assume that 30 out of 100 of users104who reported the CVE140-2affected their computing device (which includes the Windows 7 OS feature136-1band installed Python software 2.7 feature136-5b) also reported that they were able to recover the above-mentioned file by removing the Python 2.7 from their computing device. Thus, based on the determined meaning of the CVE140-2and the extracted reported incidents, the classifier122may determine that the probability of the CVE140-2to affect the second computing device with respect to the Windows 7 OS feature136-1bis, e.g., 70%; and the probability of CVE140-2to affect the second computing device with respect to the installed Python software 2.7 feature136-5bis, e.g., 30%.

The classifier122may also determine that the documentation of the CVE140-2does not include a security vulnerability related to any other features136of device profile134-2. Thus, the classifier122may determine that the probability of CVE140-2to affect the second computing device with respect to other features is 0%. As such, the classifier122assigns a low probability or low feature importance value138(i.e., 0%) to other features136of the device profile134-2, as illustrated in TABLE. 4.

In step306, the classifier122identifies the device profiles134which include one or more features in common with the particular device profile150. In this process, the classifier122determines the features152associated with the particular device profile150and compares each of those features152with the features136associated with each device profile134. For example, assume that the classifier122is comparing the particular device profile150-1with the device profile134-1. The classifier122determines that the particular device profile150-1includes the features152-1ato152-5a; and the device profile134-1includes the features136-1ato136-5a. Then, the classifier122determines the features152in the particular device profile150-1which are in common with features136in the device profile134-1. In some examples, the classifier122may identify a plurality of device profiles134which have one or more features136in common with the particular device profile150-1.

For example, assume that the particular device profile150-1(associated with a computing device, e.g., a desktop computer, a server, a laptop, etc.) includes the features152, such as, Windows 8 OS feature152-1a, X86 CPU architecture feature152-2a, OpenCL GPU architecture feature152-3a, DDR4 memory architecture feature152-4a, and Python 2.7 feature152-5a, as illustrated in TABLE. 5.

In this example, the classifier122compares the features136of the device profiles134-1and134-2illustrated in TABLES 2 and 4, respectively. In comparing the device profile150-1with the device profile134-1, the classifier122determines that the device profile134-1has the installed software Python 2.7 feature136-5ain common with the device profile150-1. In comparing the device profile150-1with the device profile134-2, the classifier122determines that the device profile134-2has the OpenCL GPU architecture feature136-3band the installed software Python 2.7 feature136-5bin common with the device profile150-1.

In step308, the classifier122selects a device profile134from among the plurality of device profiles134for evaluation. The classifier122iteratively selects a device profile134from among the plurality of device profiles134for evaluation.

In step310, the classifier122determines a total feature importance value138associated with the features136which are in common between the device profile134and the particular device profile150.

In a first example, assume that the classifier122is determining the total feature importance value138associated with features136in device profile134-1(illustrated in TABLE. 2.) in common with the device profile150-1(illustrated in TABLE. 5.). In this example, the classifier122identifies that the device profile134-1has the feature136-5ain common with the device profile150-1, where both the device profile134-1and the device profile150-1include Python 2.7 installed software feature135-5a. Thus, the classifier122identifies that the feature importance value138-5aassociated with the feature135-5ais 100%. In this particular example, since CVE140-1affects the first device profile134-1with the installed software Python 2.7, it may also affect the device profile150-1.

In a second example, assume that the classifier122is determining the total feature importance value138associated with features136in device profile134-2(illustrated in TABLE. 4.) in common with the device profile150-1(illustrated in TABLE. 5.). In this example, the classifier122determines that the device profile134-2has the features136-3band136-5bin common with the device profile150-1. The classifier122sums up the feature importance values138-3band138-5band determines that the total feature importance value138is 30%. In this particular example, since the CVE140-2affects computing devices with device profiles150which include the Windows 7 OS feature136-1band the Python 2.7 installed software feature136-5b, the classifier122determines that computing devices with device profiles150which do not include either of these features may not be affected by the CVE140-2.

In step312, the classifier122determines whether the total feature importance value138associated with the features136of device profile134which are in common with the particular device profile150is above the feature importance threshold value146, e.g. 80%. If the classifier122determines that the total feature importance value138associated with the common features136is below the feature importance threshold value146, the method300returns to the step308where another device profile134which includes one or more features136in common with the particular device profile150is selected for evaluation. If, however, the classifier122determines that the total feature importance value138associated with the common features136is above the feature importance threshold value146, the method300proceeds to step314.

Continuing the first example in step310, the classifier122determined that the device profile134-1has the Python 2.7 installed software feature136-5ain common with the device profile150-1. The classifier122also determined that the feature importance values138-5aassociated with the common feature136-5ais 100% which is above the feature importance threshold value146(i.e., 80%). In other words, the classifier122determines that a similarity between the device profile134-1and the device profile150-1is above a similarity threshold or the feature importance threshold value (i.e., 80%).

Continuing the second example in step310, the classifier122determined that the device profile134-2has the features136-3band136-5bin common with the device profile150-1. The classifier122sums up the feature importance values138-3band138-5band determines that the total feature importance value138is 30% which is below the feature importance threshold value146(i.e., 80%). Thus, even though the device profile134-2has the features136-3band136-5bin common with the device profile150, the classifier122determines that a similarity between the device profile134-2and the device profile150-1is below the similarity threshold or the feature importance threshold value (i.e., 80%).

In step314, classifier122identifies the particular CVE140which is associated with the selected device profile134. In one example, the classifier122identifies the particular CVE140based on its corresponding unique CVE ID, such as CVE2020-4332, etc.

In step316, the classifier122associates or classifies a particular device profile150with the particular CVE140.

Continuing the first example in step310, since the total feature importance value138associated with the common feature136-5ais above the feature importance threshold value146, the classifier122predicts that the device profile150-1may also be affected by the CVE140-1(which is associated with the first device profile134-1). In other words, the classifier122predicts that the security vulnerability identified in the CVE140-1may also affect the device profile150-1. As such, the classifier122associates the device profile150-1with the CVE140-1, e.g., by adding the CVE140-1column to the device profile150-1, as illustrated in TABLE. 6.

As such, the classifier122may associate any device profile150which includes the Python 2.7 feature152with the CVE140-1.

Continuing the second example in step310, since the total feature importance value138associated with the common feature features136-3band136-5bis below the feature importance threshold value146, the classifier122predicts that the CVE140-2does not affect the device profile150-1which does not include Windows 7. In this example, since the CVE140-2affects device profiles150with Windows 7 OS feature136-1aand Python 2.7 installed software features152-5a, the classifier122determines that the CVE140-2does not affect the device profile150-1which does not include Windows 7 OS feature152. Thus, in this example, the classifier122does not associate the CVE140-2with the device profile150-1.

In a third example, assume that device profile150-2includes features152, such as, Windows 7 SP1 OS feature152-1b, X86 CPU architecture feature152-2b, CUDA GPU architecture feature152-3b, DDR3 memory architecture feature152-4b, and Python 2.7 feature152-5b. The classifier122identifies that the device profile134-2(illustrated in TABLE. 4) has features136-1band136-5bin common with the device profile150-2. The classifier122sums up the feature importance values138-1band138-5bassociated with the common features136-1band136-5band determines that their total feature importance values138is 100% which is above the feature importance threshold value146(i.e., 80%). Thus, the classifier122predicts that the device profile150-2may also be affected by the CVE140-2(which is associated with the device profile134-2). As such, the classifier122associates the device profile150-2with the CVE140-2, e.g., by adding the CVE140-2column to the device profile150-2, as illustrated in TABLE. 7.

As such, the classifier122may associate any device profile150which includes the Windows 7 OS feature152and the Python 2.7 feature152with the CVE140-2.

In step318, the classifier122identifies the particular security patch144associated with the selected device profile134. In one embodiment, the classifier122may identify the particular security patch144based on its corresponding unique security patch ID, such as, Security Patch ID2020-4312, etc. The classifier122may identify the particular security patch144based on the training dataset142, in which the particular security patch144is associated with the particular CVE140.

In step320, the classifier122associates the particular security patch144with the particular device profile150. In this process, the classifier122, for example, may add the particular security patch144in a new column or a new section of the particular device profile150-1.

Continuing the first example in step310, the classifier122associates the security patch144-1with the device profile150-1to address the security vulnerabilities identified in the CVE140-1, as illustrated in TABLE. 8.

In step322, the classifier122flags the particular device profile150-1to be updated with the particular security patch144to address the security vulnerabilities identified in the particular CVE140associated with the particular device profile150.

In step324, the classifier122determines whether to select another device profile134. Here, the classifier122determines whether all of the device profiles134which have one or more features136in common with the particular device profile150have been evaluated. The classifier122determines to select another device profile134when at least one device profile134from among the plurality of the device profiles134(which has one or more features136in common with the particular device profile150) has not yet been evaluated. If the classifier122determines that at least one device profile134has no been evaluated, the method300returns to the step308where the classifier122selects another device profile134(which has one or more features136in common with the particular device profile150). Otherwise, the method300reaches the end of the classification process and determining CVEs140for the particular device profile150.