US 12,335,290 B2
Automated matching of vulnerability data between vulnerability feeds
Ariel M. Zelivansky, Mountain View, CA (US); Sharon Ben Zeev, Tel Aviv (IL); Shaul Ben Hai, Petah Tikva (IL); and Liron Levin, Kefar Sava (IL)
Assigned to Palo Alto Networks, Inc., Santa Clara, CA (US)
Filed by Palo Alto Networks, Inc., Santa Clara, CA (US)
Filed on May 31, 2022, as Appl. No. 17/804,719.
Prior Publication US 2023/0388330 A1, Nov. 30, 2023
Int. Cl. H04L 9/40 (2022.01)
CPC H04L 63/1433 (2013.01) 20 Claims
OG exemplary drawing
 
1. A method comprising:
based on detection of a cybersecurity vulnerability update in a first publicly accessible data feed, determining likelihood that the cybersecurity vulnerability update and one of a plurality of informal cybersecurity vulnerability records describe a same cybersecurity vulnerability, wherein determining likelihood that the cybersecurity vulnerability update and one of the plurality of informal cybersecurity vulnerability records describe a same cybersecurity vulnerability comprises, for each of the plurality of informal cybersecurity vulnerability records,
assessing similarity of data of a first set of fields of the cybersecurity vulnerability update and data of a second set of fields of the informal cybersecurity vulnerability record,
wherein each of the first and second sets of fields at least comprises a prose description field,
wherein assessing similarity of data of the prose description field in the informal cybersecurity vulnerability record and the prose description field in the cybersecurity vulnerability update comprises pre-processing the prose descriptions to clean and trim text and measuring similarity based on text distance or text representation; and
updating a confidence variable of the informal cybersecurity vulnerability record based, at least in part, on assessed similarity of the data; and
identifying a first of the plurality of informal cybersecurity vulnerability records having a greatest value for the confidence variable among the plurality of informal cybersecurity vulnerability records;
determining that the confidence variable for the first informal cybersecurity vulnerability record satisfies a threshold for automatic merging;
automatically merging data from the cybersecurity vulnerability update with data from the first informal vulnerability record based on the determination that the confidence variable for the first informal cybersecurity vulnerability record satisfies the threshold for automatic merging; and
publishing a security advisory with the merged data from the first informal vulnerability record and from the cybersecurity vulnerability update identified with its common vulnerability enumerator (CVE) identifier.