US 11,947,679 B2
Systems and methods for managing vulnerability data
Samiksha Patel, New York, NY (US); Jessica Colvin, Beaconsfield (GB); Patrick M. Ward, Caldwell, NJ (US); Marty Grant, Jr., Middletown, DE (US); David Everett, New York, NY (US); and Jean-Francois Legault, Brooklyn, NY (US)
Assigned to JPMORGAN CHASE BANK, N.A., New York, NY (US)
Filed by JPMORGAN CHASE BANK, N.A., New York, NY (US)
Filed on Apr. 19, 2023, as Appl. No. 18/303,317.
Application 18/303,317 is a continuation of application No. 17/242,071, filed on Apr. 27, 2021, granted, now 11,704,414.
Claims priority of provisional application 63/017,545, filed on Apr. 29, 2020.
Prior Publication US 2023/0252164 A1, Aug. 10, 2023
This patent is subject to a terminal disclaimer.
Int. Cl. G06F 21/57 (2013.01); G06F 16/215 (2019.01); G06F 21/60 (2013.01); H04L 9/40 (2022.01)
CPC G06F 21/577 (2013.01) [G06F 16/215 (2019.01)] 18 Claims
OG exemplary drawing
 
1. A method for managing vulnerability data, comprising:
ingesting, by a data ingestion engine, vulnerability data from a plurality of sources;
normalizing, by a data normalizer module, the vulnerability data into a plurality of data records, each data record having a predefined format and a plurality of pre-defined fields;
de-duplicating, by a data processing module, the data records;
generating, by the data processing module, a dynamic risk score for each de-duplicated data record, wherein the dynamic risk score is based on one or more rules;
storing, by a risk record register, a risk record for each data de-duplicated record, wherein the risk record comprises the dynamic risk score, a priority level, an identifier for a software application, and a software dependency;
selecting, by a control policy selection engine, a control policy based on one of the dynamic risk scores;
implementing, by the risk record register, the selected control policy;
monitoring, by the risk record register, implementation of the control policy; and
updating, by the risk record register, the control policy selection engine based on the monitoring.