DETERMINING TECHNOLOGY-APPROPRIATE REMEDIATION FOR VULNERABILITY
원문보기
IPC분류정보
국가/구분
United States(US) Patent
공개
국제특허분류(IPC7판)
G06F-021/00
G06F-011/00
출원번호
US-0439385
(2012-04-04)
공개번호
US-0192281
(2012-07-26)
발명자
/ 주소
D'Mello, Kurt
Tyree, David Spencer
O'Brien, Eric David
Gandhe, Sudhir
출원인 / 주소
Fortinet, Inc.
인용정보
피인용 횟수 :
0인용 특허 :
0
초록▼
A machine-actionable memory comprises one or more machine-actionable records arranged according to a data structure. Such a data structure may include links that respectively map between: a RID field, the contents of which denote an identification (ID) of a remediation (RID); at least one TID field,
A machine-actionable memory comprises one or more machine-actionable records arranged according to a data structure. Such a data structure may include links that respectively map between: a RID field, the contents of which denote an identification (ID) of a remediation (RID); at least one TID field, the contents of which denotes an ID of at least two technologies (TIDs), respectively; and at least one ACTID field, the contents of which denotes an ID of an action (ACTID). A method, of selecting a remediation that is appropriate to a technology present on a machine to be remediated, may include: providing such a machine-actionable memory; and indexing into the memory using a given RID value and a given TID value to determine values of the at-least-one ACTID corresponding to the given RID value and appropriate to the given TID value.
대표청구항▼
1. A machine-actionable memory comprising: one or more machine-actionable records arranged according to a data structure, the data structure including links that respectively map between: a RID field, the contents of which denote an identification (ID) of a remediation (RID);at least one TID field,
1. A machine-actionable memory comprising: one or more machine-actionable records arranged according to a data structure, the data structure including links that respectively map between: a RID field, the contents of which denote an identification (ID) of a remediation (RID);at least one TID field, the contents of which denotes an ID of at least two technologies (TIDs), respectively; andat least one ACTID field, the contents of which denotes an ID of an action (ACTID). 2. The memory of claim 17, wherein the data structure for at least one of the one-or more machine-actionable records includes at least two of the TID fields, the contents of which denote least two TIDs, respectively. 3. The memory of claim 17, wherein the data structure for at least one of the one or more machine-actionable records includes: a plurality of ACTID fields, the contents of which denote ACTIDs, respectively;at least one SS link relating the plurality of ACTID fields;at least one T-SS link between the at-least-one TID field and the at-least-one subset, respectively; andat least on R-SS link between the RID field and the at-least-one subset. 4. The memory of claim 3, wherein, for at least one of the one-or-more machine-actionable records, the data structure includes: two or more of the SS links, the two-or-more SS links relating one or more of the plurality of ACTID fields as subsets, respectively, of the plurality of ACTID fields;at least two of the T-SS links, the at-least two T-SS links being between the at least-two TID fields and the two-or-more subsets, respectively; andat least two of the R-SS links, the at-least-two R-SS links being between the RID field and the two-or-more subsets, respectively. 5. The memory of claim 1, wherein each data structure further includes: an invasiveness field, the contents of which denote a value that is indicative of a degree to which implementing the remediation on a machine is invasive thereof. 6. The memory of claim 5, wherein the value corresponding to the invasiveness field represents a point on a continuum of invasiveness which classifies patching an operating system as being a more invasive type of remediation and classifies editing a file as being a less invasive type of remediation. 7. The memory of claim 6, wherein the continuum of invasiveness classifies editing a registry value as being a moderately invasive type of remediation. 8. An automated computerized method of determining one or more technology-appropriate remediations for a common aspect of vulnerability in a system, the method comprising: receiving one or more vulnerability identifications (VIDs) and descriptions thereof, respectively, that have a common aspect of vulnerability;in response to the receiving of the one or more VIDs, determining, by executing instructions on a processor of a computer, a remediation identification (RID) associated with the common aspect of vulnerability;in response to the determining of the RID, creating, by executing further instructions on the processor of the computer, based upon the one or more VIDs and the descriptions thereof, a first machine-actionable map between the RID, one or more technology identifications (TIDs), and one or more action identifications (ACTIDs) for actions that remediate the common aspect of vulnerability represented by the RID, where the first machine-actionable map is a representation of the remediation candidate, wherein the creating of the first machine-actionable map includes: providing a plurality of machine-actionable second maps, each second map being between a given RID, at least two TIDs for which the given RID can be used, and two or more sets of ACTIDs, the two or more set of ACTIDs corresponding to the at least two TIDs, respectively;selecting one or more instances of the plurality of second maps, where the one or more selected instances of second maps represents the first machine-actionable map; andstoring the first machine-actionable map. 9. The automated computerized method of claim 8, wherein the selecting of one or more instances of the plurality of second maps includes: indexing into the plurality of second maps using the RID to obtain a first subset of the plurality of second maps;determining a list of one or more TIDs that correspond to the one or more VIDs, the determining of the list including: determining, for each of the one or more VIDs, a technology genus associated with a given VID; andpopulating the list with TIDs of technology species associated with the technology genus; andeliminating members of the first subset that are specific to TIDs which are not present on the list. 10. The automated computerized method of claim 8, further comprising: transmitting the machine-actionable map via a network to a client to remediate at least one of the one or more vulnerabilities for which the remediation was created to remediate. 11. The computerized method of claim 8, wherein: the receiving receives two or more VIDs and descriptions thereof, respectively; andthe creating creates the first machine-actionable map between the RID, two or more TIDs, and the two or more action identifications (ACTIDs). 12. The computerized method of claim 8, wherein the creating of the first machine-actionable map includes: creating a machine-actionable map between the one or more TIDs and the RID; andexpanding the machine-actionable map to include the one or more ACTIDs. 13. The computerized method of claim 8, wherein each ACTID represents one or more operations that remediate the common aspect of vulnerability represented by the RID for a given TID. 14. The computerized method of claim 13, wherein each operation is an automatically-machine-actionable type of operation. 15. The computerized method of claim 14, wherein each operation is a machine-language command. 16. The computerized method of claim 15, wherein the machine-language command is a set of one or more Java byte codes. 17. The computerized method of claim 8, wherein the description of a VID is provided in a substantially non-machine-actionable format. 18. The computerized method of claim 17, wherein the description of a VID includes substantially non-machine-actionable identifications of one or more technologies which are susceptible to a specific vulnerability corresponding to the VID. 19. The computerized method of claim 8, further comprising: expanding the first machine-actionable map to include a non-machine-actionable description of vulnerability corresponding to the RID. 20. An apparatus for selecting a remediation that is appropriate to a technology present on a machine to be remediated, the method comprising: a machine-actionable memory that includes one or more machine-actionable records arranged according to a data structure, the data structure including links that respectively map between: a RID field, the contents of which denote an identification (ID) of a remediation (RID);at least one TID field, the contents of which denotes an ID of at least two technologies (TIDs), respectively; andat least one ACTID field, the contents of which denotes an 10 of an action (ACTID); and an indexing module executable by at least one processing device to index into the memory using a given RID value and a given TID value to determine values of the at-least-one ACTID corresponding to the given RID value and appropriate to the given TID value.
※ AI-Helper는 부적절한 답변을 할 수 있습니다.