US 12,373,567 B2
Techniques for detecting exploitation of manufacturing device vulnerabilities
Shaked Gitelman, Tel Aviv (IL); and Tal Ravid, Tel Aviv (IL)
Assigned to Armis Security Ltd.
Filed by Armis Security Ltd., Tel Aviv-Jaffa (IL)
Filed on Aug. 24, 2022, as Appl. No. 17/821,914.
Application 17/821,914 is a continuation of application No. 16/801,748, filed on Feb. 26, 2020, granted, now 11,841,952.
Prior Publication US 2022/0414230 A1, Dec. 29, 2022
Int. Cl. G06F 21/57 (2013.01); G06F 21/55 (2013.01); G06N 5/04 (2023.01); G06N 20/00 (2019.01)
CPC G06F 21/577 (2013.01) [G06F 21/554 (2013.01); G06N 5/04 (2013.01); G06N 20/00 (2019.01); G06F 2221/034 (2013.01)] 18 Claims
OG exemplary drawing
 
1. A method for detecting manufacturing device exploitable vulnerabilities, comprising:
sequentially applying a plurality of sub-models of a hierarchy to a plurality of features extracted from device activity data, wherein each sub-model outputs a class when applied to at least a portion of the plurality of features, wherein each class comprises a classifier output representing a device attribute, wherein applying the plurality of sub-models further comprises iteratively determining a next sub-model to apply based on the classifier output by a most recently applied sub-model and the hierarchy;
determining a first device attribute of a manufacturing device based on the classifier output by a last sub-model of the sequentially applied plurality of sub-models;
determining at least one exploitation condition for the manufacturing device based on the first device attribute of the manufacturing device and a plurality of second device attributes indicated in a vulnerabilities database, wherein the vulnerabilities database further indicates a plurality of known exploits for the plurality of second device attributes;
analyzing the manufacturing device to detect an exploitable vulnerability for the manufacturing device, wherein the exploitable vulnerability is a behavior or configuration of the manufacturing device which meets the at least one exploitation condition, wherein analyzing the behavior and configuration of the manufacturing device further comprises identifying that a port is open and querying a vulnerability scanner for identifying information of the open port; and
performing at least one mitigation action based on the exploitable vulnerability.