	US 12,289,337 B2
	System, method, and apparatus for improved management of security vulnerabilities in a computing system using a machine learning model
Naif A Alkelaibi, Dhahran (SA); Abdulrahman Mamoun Naffaa, Dammam (SA); Faraj R Ajmi, Dammam (SA); and Yasser A Gahtani, Dammam (SA)
Assigned to Saudi Arabian Oil Company, Dhahran (SA)
Filed by SAUDI ARABIAN OIL COMPANY, Dhahran (SA)
Filed on May 23, 2023, as Appl. No. 18/322,298.
Prior Publication US 2024/0396921 A1, Nov. 28, 2024
Int. Cl. H04L 9/40 (2022.01)

CPC H04L 63/1433 (2013.01)

14 Claims

1. A computing apparatus, comprising:

one or more processors; and

a memory having stored therein machine-readable instructions that, when executed by the one or more processors, cause the one or more processors to:

obtain, via a communication interface, vulnerability data related to a plurality of vulnerabilities associated with a plurality of computing systems;

convert the obtained vulnerability data to one or more predetermined types of vulnerability data having respective one or more potential error indicators;

store the converted vulnerability data to a first database assigned to raw vulnerability data;

process the raw vulnerability data stored in the first database using a learning vulnerability processing model, said processing comprising:

deriving, using the learning vulnerability processing model, a plurality of vulnerability characteristics associated with respective vulnerability records comprised in the raw vulnerability data, said plurality of vulnerability characteristics being selected from the group consisting of record identifier, operating component identifier, operating component version identifier, record source identifier, operating system, software application, network address, vulnerability status, vulnerability record structure, vulnerability type identifier, severity, and mitigation procedure;

classifying a plurality of vulnerability types using the derived plurality of vulnerability characteristics;

classifying, for each of one or more vulnerability records, a descriptive portion using a corresponding one or more of the vulnerability type classifications and the respective derived plurality of vulnerability characteristics;

deriving, for the each of one or more vulnerability records, one or more description characteristics using the descriptive portion classification;

generating one or more refined vulnerability parameters using the derived vulnerability characteristics and the derived one or more description characteristics;

storing processed vulnerability data incorporating the generated one or more refined vulnerability parameters to a second database assigned to the processed vulnerability data;

applying at least a portion of the processed vulnerability data to a task component to output one or more evaluation processes for a corresponding one or more processed vulnerability records;

executing the outputted one or more evaluation processes on a performance measurement component to output one or more evaluation metrics, wherein the one or more evaluation metrics comprises a comparison metric for a comparison between the respective one or more potential error indicators in the raw vulnerability data and the corresponding one or more of the vulnerability type classifications; and

updating one or more parameters of the learning vulnerability processing model using the outputted one or more evaluation metrics;

receive, from a user via the communication interface, a prompt for a vulnerability report;

generate the vulnerability report comprising one or more processed vulnerability records from the second database; and

output, to the user via the communication interface, the vulnerability report comprising the one or more processed vulnerability records.