Technical Field

[0001] This disclosure relates generally to identifying cybersecurity attacks on computer systems, including networks and/or services, and more particularly relates systems and methods for determining one or more attack types associated with cybersecurity vulnerabilities and predicting a potential likelihood that an identified attack type may target such vulnerabilities.

Background

[0002] New cybersecurity vulnerabilities are discovered and published daily. However, often only a subset of these vulnerabilities are actually used in attacks or include a published exploit. Current vulnerability management tools include goals, such as to identify vulnerabilities and prioritize those vulnerabilities according to their context. Such actions can aid customers in focusing on the most relevant security issues. In the context of prioritizing vulnerabilities, knowing in advance which vulnerabilities will be acted upon, e.g., by use in attacks, in malicious software, or as published exploits, provides information to aid in determining a true severity of vulnerabilities found. Knowing if a vulnerability will be used in an attack, in addition to knowing which type of attack, before such an attack occurs may provide valuable information and allow customers to resolve a vulnerability before such a vulnerability is exploited. Such predictive functionality is generally currently not available in conventional vulnerability management tools, which typically merely point to known attacks for specific vulnerabilities, rather than providing such predictions.

[0003] Accordingly, it can be seen that a need exists for systems and methods directed to identifying types of attacks associated with a vulnerability, and predicting a likelihood that one or more types of attack will occur; and provide remedial or potential remedial actions to address or fix such a vulnerability. The present disclosure is directed to the foregoing and other related, and unrelated, problems/issues in the art. Summary

[0004] Briefly described, according to various aspects, the present disclosure is directed to systems and methods that obtain details/information as to cyber security vulnerabilities and vulnerability features associated with the cyber security vulnerabilities can be extracted. The vulnerability features, once obtained, may form a series of segregated one or more intermediate inputs, each representing different features associated with each of the vulnerabilities and derived from one of the vulnerability features. Once the one or more intermediate inputs are formed, the one or more intermediate inputs may be applied to one or more attack class predictors or classifiers to determine a probability or likelihood that a particular attack is or can be associated with or used in relation to an identified vulnerability. For example, a newly identified and/or published vulnerability. One or more machine learning models trained with known vulnerabilities with known attack types may be utilized to train and form/update the attack class predictor or classifiers. The output generated by the attack class predictors or classifiers may be a probability or likelihood indicative of the likelihood that the particular attack may occur; represented by, for example, a number from a 0 to a 1. Once a likelihood of an attack occurring is determined for each of one or more attacks, attack type labels may be assigned to the identified vulnerability (e.g. a new vulnerability). The results, including the attack type labels and likelihood of an attack to occur, may be displayed, along with relevant information regarding the vulnerability, on a display or a user interface or formatted for display, and additionally can include a determined or suggested solution, remedy identification, or potential remedial action for any of the attack types.

[0005] In one aspect, the present disclosure provides a method for prediction of cybersecurity attacks, including, in embodiments, an attack type or types, and a likelihood for a vulnerability identified in a monitored information handling system such as a computer system, network, services, etc. being subjected to each such identified attack type. The method may include monitoring for a new vulnerability, and in response to a detection of the new vulnerability, extracting one or more inputs including one or more vulnerability features associated with the new vulnerability and inputs to one or more attack type classifiers to determine if and what attack types are associated with the new vulnerability. In embodiments the method includes applying the one or more inputs and each of the one or more types of attacks identifying and/or associated with the new vulnerability to an attack likelihood classifier to generate a likelihood that each of the one or more attacks could/will occur. In addition, the method may include assigning one or more attack type labels to the new vulnerability based on each attack type associated with the new vulnerability. The method also may also include generating a user interface to display the new vulnerability, each of the one or more attack type labels, and the likelihood that each of the one or more attacks occur.

[0006] In other embodiments, the method further can include determining, based on each attack type associated with the new vulnerability and the likelihood that each of the one or more attacks will occur, a severity of the new vulnerability. In another embodiment, the extraction of each of the one or more vulnerability features into one or more inputs may utilize one-hot encoding. In some embodiments, the one or more inputs include topic detection or topic mapping, through which a series of topics defining a topic vector are selected or generated, with each topic having at least one numerical feature extraction. The topics can include a selected number of topics derived from text extracted from the description of the vulnerability (e.g. using Natural Language Processing (NLP) to generate topics based on text derived from prior vulnerabilities). The topics can be developed using machine learning models to create the series of different/separate topics.

[0007] In embodiments, the new vulnerability and one or more vulnerability features associated with the new vulnerability may be obtained from the National Vulnerability Database (NVD) and potentially from other sources such as security analysis. The one or more attack type classifiers may be trained via a machine learning model with known vulnerabilities, associated known attack types, and associated other one or more vulnerability features. For example, the machine learning model can be trained using data (e.g. historical data) relating to prior topic determinations for similar vulnerabilities; by past exploitations available for vulnerabilities, and by input/review of historical data relating to which known vulnerabilities have been attacked by which known attacks to create labels for such attacks for use by the machine learning model.

[0008] In embodiments, the method also may include identifying and/or associating one or more known attacks for a new vulnerability or known vulnerabilities, and based on the identified known attack(s), assigning a label associated with the known attack to the new vulnerability or known vulnerabilities. The label may indicate that the known attack has occurred for the new vulnerability or known vulnerabilities, such as in relation to a user or a third party. The method may further include determining remedial procedures to be performed in response to the known attack.

[0009] In another embodiment, an output of the attack likelihood classifier includes a probability represented by a number between 0.0 and 1.0. A 0.0 may indicate the lowest likelihood that the attack will occur for the vulnerability, while a 1.0 may indicate the highest likelihood that the attack will occur for the vulnerability. The one or more vulnerability features may include one or more of a vulnerability description, a list of one or more vulnerable products, vulnerable configurations, a list or one or more references mentioning the vulnerability, a Bugtraq identifier, a CVSS score, and other CVSS metrics.

[0010] In other embodiments, the extraction of each of the one or more vulnerability features into one or more inputs, further may include application of a vulnerability description included in the one or more vulnerability features to a topic model thereby forming a topic vector. The topic vector may include a selected number of topics, for example, at least 20-30 topics, or more each topic represented by a value between 0.0 and 1.0. The number of topics can be selected to ensure a substantial sample size for each vulnerability.

[0011] In other aspects, the present disclosure provides a system for prediction of attack types and an attack type likelihood that such attacks will be used against or to exploit a vulnerability identified in a monitored computer system, network, services, etc ... In embodiments, the system includes an attack class predictor. For example, the attack class predictor may include a plurality of attack likelihood classifiers. Each attack likelihood classifier can be associated with a distinct attack type and the attack class predictor is configured to obtain a new vulnerability and associated therewith vulnerability features. The attack class predictor can be configured to extract the associated vulnerability features into one or more inputs. The attack class predictor can be configured to submit the one or more intermediate inputs to each of the one or more attack likelihood classifiers, each configured to generate an output indicating the probability that each attack type will occur for the new vulnerability. An output of the attack likelihood classifier may be a value indicating the likelihood or probability that each identified/associated attack type will occur for the new vulnerability. The system further will include an input/output circuitry. The input/output circuitry may be configured to generate a display including vulnerability data in a readable format. The vulnerability data may include one or more of the new vulnerability, the associated vulnerability features, each attack type associated with the new vulnerability, and the likelihood or probability that the attack type will occur.

[0012] In embodiments, each attack type associated with a new vulnerability is indicated by an attack type label, and the attack type circuitry further may be configured to receive a notice, report, or other indication that a particular attack type is associated with the new vulnerability from one or more public or private exploit databases or repositories. In response to reception of such an indication, associate the particular attack type to the new vulnerability. In embodiments, an attack type may be associated with a new vulnerability by setting a bit to a value if 1.0, the bit being associated with an attack type label of the attack type.

[0013] In embodiments, each of the plurality of attack likelihood classifiers may be trained via a supervised machine learning model. In another embodiment, each of the plurality of attack likelihood classifiers may be trained with training data including one or more known vulnerabilities associated with a particular attack type and each of the one or more known vulnerabilities’ features. In another embodiment, the display may be transmitted to a graphical user interface (GUI), the GUI including vulnerability management and remediation data and statistics.

[0014] In other aspects, the present disclosure can provide a non-transitory machine-readable storage medium storing processor-executable instructions or programming that, when executed by at least one processor, causes the at least one processor to obtain a new vulnerability and associated vulnerability features. The executed instructions may further pre-process the associated vulnerability features to form one or more inputs provided or supplied to one or more attack type classifiers that are configured to identify one or more attack types associated with the vulnerability. The executed instructions apply, for each of the one or more attack types, the one or more inputs and one of the one or more attack types associated with the vulnerability to an attack likelihood classifier to thereby determine a probability that the identified attack type is likely to occur. This step can be repeated for each identified attack type for the vulnerability. The executed instructions also may generate a display including then new vulnerability, the associated vulnerability features, each of the one or more attack types associated with the new vulnerability, and the probability that each of the one or more attack type is likely to occur.

[0015] In another embodiment, the new vulnerability may be obtained from one or more of public repositories, private repositories, and other private sources. In another embodiment, the preprocessing may include one or more of applying vulnerability descriptions to a topic model, determining a character length of the vulnerability’s description, determining a number of vulnerable products, determining a number of vulnerable configurations, determining a number of references mentioning the vulnerability, setting a bit to 1.0 if a Bugtraq identifier exists, and assigning a numerical value to CVSS metrics.

[0016] In other aspects, in order to improve the prioritization of vulnerabilities that can render information handling systems open to attacks, the present disclosure provides systems and methods for identifying and associating attack types with vulnerabilities and predicting a likelihood or probability of such attacks occurring for each attack type associated with such vulnerabilities. For example, such attacks can include an attack through malware, Advanced Persistent Threats (APT), direct exploitation by a malicious actor, published exploits or weaponized exploits, or other attack types. System supervised machine learning modules or engines, programmed with a combination of prediction models, where each model is trained using features associated with known vulnerabilities to predict one specific type of attack, are utilized. The combination of the output of these models gives the predicted type(s) of attack of a vulnerability. While some previous work built models that predict if an attack will occur or not, such models described herein predict the type(s) of attack(s) targeting vulnerabilities, as well as the likelihood such an attack(s) will occur.

[0017] In an embodiment, a first step of the method consists in building the features which will be used by the predictive models. The features are based upon a combination of properties associated with a vulnerability, along with a generation of topics from the textual vulnerability descriptions. These topics are identified through the use of a topic model, a natural language processing algorithm, which identifies the underlying concepts of a corpus of text. This model outputs a list of topics, represented as a series of words and their importance as a number between 0 and 1, along with the importance of these topics for every vulnerability, as a fixed-length vector of the number of topics for exploit prediction. Following this, supervised learning is used to train a predictive model for each class, i.e., each type of attack, using historical attack, malware, and exploit data as labels for vulnerabilities. Each model is trained on historical data using the features previously built, and the combination of all model prediction outputs identifies the predicted type(s) of attack. A vulnerability can have multiple labels: it can be predicted as used in one type of attack, used in multiple attacks, or used in none. Further, each attack can have a different likelihood or probability of actually occurring. Once these models are trained, they are then used as part of a cybersecurity platform/service, such as Taegis VDR® from SecureWorks, Inc., on every new or newly published vulnerability in order to predict if it will be seen in any type of attack in the near future.

[0018] Various objects, features and advantages of the present disclosure will become apparent to those skilled in the art upon a review of the following detail description, when taken in conjunction with the accompanying drawings. Brief Description of the Drawings

[0019] It will be appreciated that for simplicity and clarity of illustration, elements illustrated in the Figures are not necessarily drawn to scale. For example, the dimensions of some elements may be exaggerated relative to other elements. Embodiments incorporating teachings of the present disclosure are shown and described with respect to the drawings herein, in which:

[0020] Fig. l is a schematic diagram of a data center including a networked system of information handling systems, according to one aspect of the present disclosure.

[0021] Fig. 2 is a schematic diagram of a system for identifying cybersecurity vulnerability details and features and for predicting a likelihood each of one or more attack types and occur, according to one aspect of the present disclosure.

[0022] Fig. 2B is another schematic diagram of a system to predict a likelihood each of one or more attack types occur, according to one aspect of the present disclosure.

[0023] Fig. 3 is a schematic diagram illustrating a flow of information into system. Such as shown in Figs 2 A or 2B.

[0024] Fig. 4 is a schematic diagram of an attack class predictor, according to one aspect of the present disclosure.

[0025] Figs. 5A and 5B are schematic diagrams of a system to train an attack type classifier and/or an attack likelihood classifier, according to one aspect of the present disclosure.

[0026] Figs. 6A and 6B are methods/processes for predicting one or more attack types and a likelihood each of the one or more attack types occur, according to one aspect of the present disclosure.

[0027] Fig. 7 is a schematic diagram of an information handling system capable of administering each of the specific embodiments, according to one aspect of the present disclosure.

[0028] The use of the same reference symbols in different drawings indicates similar or identical items. Detailed Description

[0029] The following description in combination with the figures is provided to assist in understanding the teachings disclosed herein. The description is focused on specific implementations and embodiments of the teachings, and is provided to assist in describing the teachings. This focus should not be interpreted as a limitation on the scope or applicability of the teachings.

[0030] As shown in Figs. 1-7, the present disclosure includes systems and methods for determining one or more attack types and a likelihood of an attack to occur for a new or newly identified/published vulnerability. For example, data or data sets from external sources (e.g. external databases, National Vulnerability Database (NVD), Bugtraq, etc.) or internal sources (e.g., security specialists, internal databases or repositories, etc.) can identify vulnerabilities. The new cybersecurity vulnerabilities for information handling systems can be received/obtained and interpreted, analyzed, modeled, etc. to determine one or more attack types associated with a new vulnerability or newly identified vulnerabilities (e.g., an attack type which can be used to exploit such a vulnerability) and the likelihood that the one or more attack types can occur.

[0031] The term “computing device” or “system device” is used herein to refer to any one or all of programmable logic controllers (PLCs), programmable automation controllers (PACs), industrial computers, desktop computers, personal data assistants (PDAs), laptop computers, tablet computers, smart books, palm-top computers, personal computers, smartphones, wearable devices (such as headsets, smartwatches, or the like), and similar electronic devices equipped with at least a processor and any other physical components necessarily to perform the various operations described herein. Devices such as smartphones, laptop computers, tablet computers, and wearable devices are generally collectively referred to as mobile devices.

[0032] The term “server” or “server device” is used to refer to any computing device capable of functioning as a server, such as a master exchange server, web server, mail server, document server, or any other type of server. A server may be a dedicated computing device or a server module (e.g., an application) hosted by a computing device that causes the computing device to operate as a server. A server module (e.g., server application) may be a full function server module, or a light or secondary server module (e.g., light or secondary server application) that is configured to provide synchronization services among the dynamic databases on computing devices. A light server or secondary server may be a slimmed-down version of server type functionality that can be implemented on a computing device, such as a smart phone, thereby enabling it to function as an Internet server (e.g., an enterprise e-mail server) only to the extent necessary to provide the functionality described herein.

[0033] The term “non-transitory machine-readable storage medium” is used to refer to any electronic, magnetic, optical, or other physical storage apparatus to contain or store information such as executable instructions, data, and the like. For example, any machine-readable storage medium described herein may be any of random access memory (RAM), volatile memory, non-volatile memory, flash memory, a storage drive (e.g., hard drive), a solid state drive, any type of storage disc, and the like, or a combination thereof. The memory may store or include instructions executable by the processor.

[0034] The term “processor” or “processing circuitry” is used to refer to any one processor or multiple processors included in a single device or distributed across multiple computing devices. The processor may be at least one of a central processing unit (CPU), a semiconductor-based microprocessor, a graphics processing unit (GPU), a field-programmable gate array (FPGA) to retrieve and execute instructions, a real time processor (RTP), other electronic circuitry suitable for the retrieval and execution instructions stored on a machine-readable storage medium, or a combination thereof.

[0035] The term “computer security vulnerability” is used to refer to a weakness or exploitable portion in software or instructions. Such a weakness can be used to attack software or instructions, user, or a computing device hosting the software or instructions. The term “exploit” is used to refer to a portion of code, instructions, or software written to abuse or take advantage of a vulnerability for the gain of the attacker.

[0036] The term “malware” is used to refer to malicious software or instructions installed on a user’ s computing device, typically without the knowledge of the user or without the user’s knowledge of the malicious intent, which may cause damage or is harmful to the computing device or the user. The term “Advanced Persistent Threats” (APT) is used to refer to advanced and targeted attacks by malicious actors, often including a highly stealthy approach.

[0037] The term “direct exploitation by an attacker” is used to refer to an attack consisting of an attacker directly attacking a vulnerability without the use of any software or instructions.

[0038] The term “Common Vulnerabilities and Exposures” (CVE) is used to refer to numbers and/or identifiers assigned to vulnerabilities to uniquely identify them. CVEs are a free and open standard used by the cybersecurity community. Each vulnerability may be assigned a unique CVE number. The term “Common Vulnerability Scoring System” (CVSS) is used to refer to a free and open industry standard, identifying vulnerabilities by a score between 0 and 10 and other individual metrics, used for assessing the severity of security vulnerabilities. The CVSS identifies a number of metrics or characteristics to gauge the severity of a vulnerability. Each new vulnerability published with a CVE score includes a CVSS score. The term “Bugtraq” is used to refer to an electronic mailing list dedicated to computer security issues.

[0039] FIG. 1 is a block diagram of an exemplary data center 10 that may be managed or partially managed by a vulnerability management system. As shown in FIG. 1, the data center 10 can include a network 12 that may provide communications among a plurality of information handling systems 14, which can include work stations, personal computers, smart cellular telephones, personal digital assistants, laptop computers, servers, computing devices, other suitable devices, and/or combinations thereof. The information handling systems 14 further can be coupled to the network 12 through wired line connections 16, wireless connections 18, or any other suitable lines of communication or connection. As further shown in FIG. 1, the data center 10, and/or one or more of the information handling systems 14 thereof, can be communicatively coupled to a network, including a cloud based or other network as shown at 12 or 20 in Fig. 1, for example, through wired line connection 16, or through any other suitable connection, such as a wireless connection 18 (e.g., WiFi, cellular, etc.). The network 12 further can be accessible to/by one or more user or client managed information handling systems or devices 22 to facilitate communication between the client managed information handling systems 22 and the data center 10 managed or partially managed by a vulnerability management system. The network 12 can include an API interface of the vulnerability management system., though the network can include any suitable network, such as the Internet or other wide area network, a local area network, or a combination of networks, and may provide communications, e.g., data communications, among the vulnerability management system and the client managed information handling systems 22.

[0040] The client managed information handling systems 22 can be connected to the network 20 through wired connections, e.g., an Ethernet cable, or other suitable wired or wireless connections 18, e.g., WiFi, Bluetooth®, cellular connections (e.g., 3G, 4G, LTE, 5G, etc ), other suitable wireless connections or combinations thereof (FIG. 1), to enable the clients or operators of information handling systems 22 to communicate with the vulnerability management service, e.g., to access one or more services provided thereby. For example, the vulnerability management service can be a web service, such as Taegis VDR® from SecureWorks, Inc.

[0041] For purposes of the present disclosure, the information handling systems 14/22 may include any instrumentality or aggregate of instrumentalities operable to compute, calculate, determine, classify, process, transmit, receive, retrieve, originate, switch, store, display, communicate, manifest, detect, record, reproduce, handle, or utilize any form of information, intelligence, or data for business, scientific, control, or other purposes. In one embodiment, the information handling systems may include a storage, such as random access memory (RAM) or (ROM), one or more processing resources such as a central processing unit (CPU) or hardware or software control logic, ROM, and/or other types of nonvolatile memory. Additional components of the information handling system may include one or more disk drives, one or more network ports for communicating with external devices as well as various input and output (I/O) devices, such as a keyboard, a mouse, touchscreen and/or a video display. The information handling systems also may include one or more buses operable to transmit communications between the various hardware components.

[0042] Figs. 2A-2B are schematic diagrams illustrating non-limiting example configurations of an attack type detection and production system predicting one or more attack types and a likelihood each of the one or more attack types occur. An attack predictor system 202 can be configured to identify cybersecurity vulnerabilities of information handling systems and, according to aspects of the present disclosure, likelihood of the cybersecurity vulnerabilities occurring. For example, the attack system 200 of Fig. 2A-2B may be implemented in or by the information handling system 10 (e.g. in hardware or memory) of Fig. 1. In one embodiment, the attack system 200, as illustrated in Fig. 2A, includes a system device 202, a storage device 204, a communications network 206, and client devices 208A, 208B, up to 208N. The attack predictor system 202 may further be connected to a number of private and/or public databases, repositories, or other data sources. The attack predictor system 202 may monitor each of the client devices 208A, 208B, up to 208N, and other data sources for new vulnerabilities. The attack predictor system 202 may include various modules, engines, or circuitry, such as an attack class predictor 220 and/or an input/output module or 214. Each module may include corresponding instructions and may comprise hardware (e.g., one or more predictor processors and memory and/or other circuitry) or a portion of hardware in the attack predictor system 202. In another embodiment, the modules or circuitry may include, rather than physical components, specific instructions stored in memory of the attack predictor system 202 and/or in the storage device 204. [0043] As noted, the attack predictor system 202 includes an attack class predictor 220 or engine. The attack class predictor 220 may be configured to monitor various data sources, described above and herein, for new vulnerabilities. For example, the attack class predictor 220 may monitor the National Vulnerability Database (NVD) and/or Bugtraq communications, as well as monitoring data received at the input/output module 214 from other data sources and/or client devices 208A, 208B, up to 208N. For example, the attack class predictor 220 may include an application program interface (API) configured to allow users to send data, in particular new vulnerabilities, to the attack type identifier module 210. In such examples, a user may discover a vulnerability and send such information, for example via email or via a graphical user interface (GUI) or web-based user interface (WUI), to the attack class predictor 220 for classification and/or to generate predictions and notify one or more client devices 208A, 208B, up to 208N. Such notifications can be sent to a range of client devices or to a selected subset thereof. Further, the determinations or analysis described herein may automatically occur, as the attack class predictor 220 discovers new vulnerabilities, or may occur on demand, as the attack class predictor 220 is sent a request or sent a new vulnerability. The attack class predictor 220 may include, as instructions, one or more attack type or likelihood classifiers, as will be described in further detail below, to determine whether a particular attack is associated with or likely to occur/be exploited in relation to a new vulnerability. The attack class predictor 220 may also include pre-processing and/or feature extraction instructions utilized to process data and/or features associated with a new vulnerability prior to application to the one or more attack type classifiers. Such pre-processing and/or feature extraction instructions may include forming, based on the vulnerability features, one or more intermediate inputs.

[0044] In embodiments and as noted above, the attack class predictor 220 includes instructions to receive a new vulnerability and the one or more intermediate inputs, and generates a probability value indicating a probability of each of a series of attack types occurring or being brought against the new vulnerability as an output therefrom. In other embodiments, a plurality of attack class predictors or classifiers are included in the attack class predictor system 202. Each of the attack class predictors or classifiers may be based on a particular type of attack and will each determine a likelihood that a particular attack associated with that attack class predictor may occur or be brought against or used to exploit the new vulnerability based on the one or more intermediate inputs and one of the types of attack associated with the attack likelihood classifier. Each of the attack class predictors or classifiers can generate a probability value indicating such a likelihood or probability of that particular attack type occurring with respect to the new vulnerability as an output therefrom. Such actions may occur, as noted, for each type of known attack type. [0045] Once the likelihood or probability that each of the attack types may occur is determined, based upon this probability output, each type of attack associated with the new vulnerability will be identified. Each attack class predictor 220 further will be configured to determine a severity of each associated attack type or an overall severity of the new vulnerability. Such a severity may be determined based on the amount of attack types, the type of each attack type, the likelihood that each of the attack types may occur, whether a solution exists in relation to the vulnerability and any attack type, and/or the types of existing solutions. The determined severity values for each associated attack type further can be used to rank the likelihood of each such attack type occurring or being brought against the vulnerability. In addition, as a further output based upon the determined severity of the vulnerability a notification can be provided to a user interface or a portion of user interface. The notification will include the new vulnerability, the associated vulnerability features, the assigned one or more attack type labels, the likelihood that each attack may occur, and the severity of the vulnerability. In an embodiment, such an attack class predictor 220 may be offered as a service by a vulnerability management service.

[0046] Fig. 2A is schematic illustration of another configuration or non-limiting example embodiment of the attack predictor system 202 configured to predict one or more attack types and a likelihood each of the one or more attack types occur, according to one aspect of the present disclosure. The attack predictor system of Fig. 2B may be implemented in or by the information handling system 10 of Fig. 1. Similar to Fig 2A, the attack predictor system 202 may include instructions in a memory or other storage 204 related to the attack class predictor 220. The memory 205 may store such instructions, as well as other data 222 or instructions. The attack predictor system 202 may connect to various internal or external databases 224, repositories, or data sources.

[0047] Fig. 3 schematically illustrates the operation of the attack predictor system 202 in accordance with the principles of present disclosure. In one embodiment, as a new vulnerability or newly identified vulnerability is received by the attack predictor system 202, details 300 of the new or newly identified vulnerability are identified and extracted or segregated. For example, the vulnerability details, as illustrated at 300, will include a description of the vulnerability 302, a list of vulnerable products 304, a list of vulnerable configurations 306, a list of references 308, and further can include a Bugtraq ID 310, and a CVSS score 312 (e.g. a common vulnerability scoring system score of typically between 1 to 10). Other details or aspects of the vulnerability also can be captured and extracted by the attack predictor system 202. The description 302 of the vulnerability can be taken from a listing of such a newly identified or new vulnerability as provided by an outside source (e.g. external databases, National Vulnerability Database (NVD), Bugtraq, etc.) or internal sources (e.g., security specialists, internal databases or repositories, etc.). In addition, prior vulnerabilities from a selected time period, (e.g. 10 years, 20 years, or other time period) can be utilized to identify descriptions common with past identified vulnerabilities and to extract or develop common textural identifiers, including words, phrases, or other identifiers.

[0048] Such vulnerability details 300 are used to generate a series of vulnerability features 320 that will be used by the predictive models or engines of a labeling system or module 330 to develop labels to identify attacks likely to be associated with or brought against the new or newly identified vulnerability. Each of the features 320 generally will comprise or include a combination of properties associated with a vulnerability, along with generation of a topic vector including a series of topics 322 generated from the recognized/selected text from the vulnerability description 302. In an example embodiment as shown in Fig. 3, a series of topics 322, including approximately 30 topics is illustrated, although it will be understood that a greater or lesser number of topics also can be developed or generated. Each of the topics are identified through the use of a topic model, which can include a natural language processing algorithm configured to identify an underlying concept of a corpus of extracted text from each of the vulnerability descriptions. The topic model can then output a listing of topics, e.g. topic 1 through topic 30, each of which topics can be represented by a series of words and each of which can be ranked according to an importance value. In embodiments, the ranking of the topics can be illustrated as a number between 0.0 and 1.0. The identified or extracted/selected topics, along with the rankings of the importance of such topics for each vulnerability identified will be provided with a series of additional selected features to a labeling system 330, which will be used to further train a machine learning model 350.

[0049] As further illustrated in Fig. 3, additional features of the vulnerability details that can be developed can include a description length 323, e.g. a selected number or length of character strings for a description; a number of vulnerable products identified 324, e.g. various programs such as email, inventory control, spreadsheets, etc. with known vulnerabilities; a number of vulnerable configurations or versions 325; a number of references 326 regarding each vulnerability; whether a Bugtraq ID 327 exists; and a CVSS score 328, which can include a series of CVSS scores for each feature identified 329. Other features the vulnerabilities identified and the details thereof further can be used.

[0050] The labeling system or module 330 will receive the vulnerability features 320, including the series of topics 322 and rankings thereof, as well as the additional set of features including description length 323, number of vulnerable products 324, number of vulnerable configurations 325, a number of references 326, whether a Bugtraq ID 327 exists, and CVSS score(s) 328. The labeling system or module 330 further can exploit other sources for information or data relating to the vulnerability features. For example, the labeling system or module 330 can access historical databases or receive inputs from such databases or other information sources for data regarding exploitation of similar vulnerabilities in the past (see 332). In addition, internal threat intelligence systems 334, such as provided by a managed security service provide (MSSP) reviewing incoming data for threats, further can provide inputs into the labeling system or module 330. The labeling system or module 330 will review the incoming information or data regarding the features of each vulnerability, together with the additional information or data, such as historical vulnerability exploitation data and threat intelligence data provided by an MSSP or other internal source, based on which vulnerabilities have been attacked by which types of attacks, and create labels identifying the various types of attacks and their association with a particular vulnerability. The labels also can include a ranking or likelihood for each attack occurring against the vulnerability. This information will then be used to train the machine learning model 350.

[0051] Fig. 4 is a schematic diagram of the attack class predictor 220, according to one aspect of the present disclosure. The attack class predictor 220 may include sub-circuits or sub-instructions or routines. The attack class predictor 220 may include a pre-processing pipeline or feature extraction module 404 or instructions. The pre-processing pipeline or feature extraction module 404 or instructions may be configured to pre-process or extract features from an input 402. The input 402 may include a one or more vulnerability features of a new vulnerability. The one or more features may include a vulnerability description, vulnerable products, vulnerable configurations, references mentioning the vulnerability, a Bugtraq identifier, a CVSS score, CVSS metrics, other relevant data, or some combination thereof. In an embodiment, the pre-processing pipeline or feature extraction module 404 or instructions may include a topic classifier. The vulnerability description may be applied to the topic classifier and one or more topics may be output. In an example, the output may be a topic vector.

[0052] In a further example, the topic vector may include a particular topic and an associated number or weight. In yet another example, the topic vector may be a two dimensional matrix including a series of at least 30 numbers between 0 and 1, each number indicating a particular topic. The preprocessing pipeline or feature extraction module 404 or instructions may additionally include numerical feature extraction instructions. The numerical feature extraction instructions may take the vulnerability features as an input and output a vector or series of numbers associated with each vulnerability feature. For example, the output may include a number calculated or determined based on the character length of the vulnerability’s description, a number calculated or determined based on the number of vulnerable products, a number calculated or determined based on the number of vulnerable configurations, a number calculated or determined based on the number of references that mention the vulnerability, a 1 or a 0 based on if a Bugtraq identification exists, the CVSS score, and a number determined based on CVSS metrics. Such an output may be considered one or more intermediate inputs, in relation to classifiers or machine learning models utilized in the attack class predictor 220.

[0053] Once one or more intermediate inputs are determined, the one or more intermediate inputs may be applied to one or more attack likelihood classifiers 408A, 408B, up to 408N. Each of the one or more attack likelihood classifiers 408A, 408B, up to 408N may correspond to a particular type of attack. In other words, each attack likelihood classifiers 408A, 408B, up to 408N may correspond to and provide a probability or likelihood that a particular attack may occur. In another embodiment, one attack likelihood classifier may be utilized to provide one or more probabilities that one or more attack types may occur. The output of the one or more attack type classifiers 408A, 408B, up to 408N may be a number indicating whether that particular attack type is associated with the new vulnerability.

[0054] Once the one or more intermediate inputs are applied to the one or more attack likelihood classifiers 408A, 408B, up to 408N, the one or more attack likelihood classifiers 408A, 408B, up to 408N may output a probability indicating a likelihood that a particular attack may occur for the new vulnerability. Each of the resulting outputs of each of the one or more attack type classifiers 408A, 408B, up to 408N, along with the one or more intermediate inputs and/or the input 402, may be transmitted to a post-processing module 412.

[0055] In an embodiment, the post-processing module 412 may aggregate the results of the application of data to the classifiers described above. In another embodiment, the post-processing module 412 may assign a particular attack type label or tag to a new vulnerability. The label or tag may include the attack type’ s name and likelihood that the attack type will occur. The post-processing module 412 may additionally format the labels or tags, such that the labels and tags may be displayed in a user interface in a readable and/or user friendly format for the new vulnerability. The postprocessing module 412 may additionally determine the severity of the vulnerability based on the type of attacks for a new vulnerability, the number of attacks for the new vulnerability, and/or the likelihood that an attack may occur in relation to the new vulnerability.

[0056] In an embodiment, a new vulnerability may include or be associated with a known attack. In such embodiments, the known attack may be considered to have the highest probability of occurring in relation to the new vulnerability. As such, rather than applying the intermediate input to the one or more attack likelihood classifiers 410A, 41 OB, or 4 ION, the likelihood of such an attack may be set to 1. In another example, a known vulnerability associated with a number of attack types and corresponding likelihoods may be updated based on such an input (e.g., an attack actually occurring for the known vulnerability). In such examples, the attack that has occurred may be set to 1 or a 100% likelihood that the attack will occur.

[0057] Figs. 5A and 5B are schematic diagrams of a system 500 to train one or more attack likelihood classifier, according to one aspect of the present disclosure. Various data sources, such as the NVD 508, a private/internal database 510 or repository, and/or a public database 512 or repository, may be utilized to generate a set of training data 502. Such a set of training data 502 may include large amounts of data points. For example, the set of training data 502 may include about 150,000 vulnerabilities and associated vulnerability features, in addition to different attack types known to occur for such vulnerabilities. It will be understood that more or less data may be utilized to train the classifiers.

[0058] Once a set of training data 502 is obtained or determined, the set of training data 502 may be transmitted to a pre-process to a pre-processing pipeline and/or feature extraction module 504. The pre-processing pipeline and/or feature extraction module 504 may operate or be configured to operate as described for the pre-processing pipeline and/or feature extraction module 404. In other words, the pre-processing pipeline and/or feature extraction module 504 may be the same as the preprocessing pipeline and/or feature extraction module 404. As noted above the pre-processing pipeline and/or feature extraction module 504 may include a topic classifier 514 and/or a numerical feature extraction module 516. The topic classifier 514 may determine the topics associated with a set of data based on the description of the vulnerability, using topic detection or topic mapping, through which a series of topics defining a topic vector are selected or generated, with each topic having at least one numerical feature extraction. In embodiments, the topics built or generated by the machine learning model. However, in some embodiments, it could be possible to use topics established from an external source, which can be provided or received as an added feature, in addition to or separate from the machine learning model generated topics, without being generated from the machine learning model.

[0059] The output of the pre-processing pipeline and/or feature extraction module 504 may then be utilized, with a machine learning model 506, to train a specific attack type classifier and/or an attack likelihood classifier. For example, the set of training data 502 may include data associated with a specific or particular attack type. As such, the output classifier may be associated with that specific or particular attack type. In an embodiment, the machine learning model 506 may comprise a single machine learning model or an ensemble machine learning method. The machine learning model may include a neural network model, a Naive Bayes model, a linear regression model, a logistic regression model, a support vector machine, a decision tree based model, or a k-nearest. An ensemble machine learning method may include two or more of the machine learning models described above or other machine learning models as will be understood by a person skilled in the art. Further, the ensemble machine learning model may utilize various methods to combine the output of a particular supervised machine learning model, such as bagging, boosting, stacking, Bayesian model averaging, Bayesian model combination, or a bucket of models. Other types of machine learning models or ensemble machine learning methods may be utilized, as will be understood by a person skilled in the art. Other methods may be utilized to weight, classify, or categorize the vulnerability features or one or more intermediate inputs prior to training a classifier or applying the data to a classifier, such as one-hot encoding.

[0060] Figs. 6A and 6B illustrate method/process steps for identifying and predicting one or more attack types and a likelihood each of the one or more attack types will occur for new and newly identified vulnerabilities, according to aspects of the present disclosure. It also will be understood that any of the Figs, described herein may implement the method 600, in particular Figs. 1-4.

[0061] At block 602, a system device, a processor, or an attack class predictor module or engine monitors various data sources for new vulnerabilities. The monitoring may be performed continuously or periodically. In embodiments, the attack class predictor module or engine may accept, as an input, new vulnerabilities. For example, if a user and/or security analyst discovers a vulnerability, the user and/or security analyst may provide or send the new vulnerability to the system device, a processor, or an attack class predictor module or engine. As such, the system device, a processor, or an attack class predictor module or engine may include an API, such as an open API, a REST or RESTful API, JSON or XML API, a SOAP API, or other suitable API as will be understood by a person skilled in the art. For example, a user may submit a new vulnerability via email, via a webform, via an HTTP or HTTPS put or post command, or via other suitable methods.

[0062] At block 604, once a specified time period or interval passes, the class predictor module or engine may determine whether a new vulnerability has been detected. In another embodiment, block 602 and block 604 may occur at substantially the same time or near the same time, as such processes may be continuous, e.g., a continuous determination of new vulnerabilities discovered.

[0063] At block 606, if a new vulnerability has been detected, the class predictor module or engine may obtain or receive the associated vulnerability features. The vulnerability features may be received as a list or set of data including identified or extracted text or other reference identifiers for the vulnerability details.

[0064] At block 608, text of the vulnerability description can be applied, transmitted, or provided as an input to a topic model. Such an application may result in topic vectors, as described above. The topic vectors may include a number of key topics and associated weights, e.g., represented as a number 0 to 1. The number of key topics may include at least 30 key topics. It will be understood that more or less key topics may be used. The key topics may describe or generalize key features of a vulnerabilities. The combination of key topics and weights may indicate which attacks may apply to such a vulnerability, at least, when applied to a classifier, e.g., a machine learning trained model.

[0065] At block 610, the system extracts numerical features from the vulnerability features. In such process, the system will determine or calculate a number for each vulnerability feature. Such a number may include values from 0 to 1. Other number ranges may be utilized. For example, the CVSS score may be utilized as is, rather than be converted or normalized to a number from 0 to 1. Once the numerical features are extracted and the topic vector is generated, the numerical features and topic vector may be aggregated to form an intermediate input or one or more intermediate inputs.

[0066] At block 612, the system will apply, transmit, or provide as an input (determined at block 612), the topic vectors and numerical features to an attack likelihood classifier or class predictor or a first attack likelihood classifier or class predictor. Such an application may result in an output that indicates the likelihood that an attack associated with the attack likelihood classifier or class predictor may occur in relation to the vulnerability.

[0067] At block 614, a determination is made as to whether there are any remaining attack types associated with any other attack likelihood classifier or class predictor. In other words, the system device, a processor, or an atack likelihood circuitry may implement an iterative process or loop that applies the topic vectors and numerical features to one or more attack likelihood classifiers or class predictors, each associated with a particular, different, and/or distinct attack type (see block 616). In some embodiments, the topic vectors and numerical features, may be applied to each attack likelihood classifier or class predictor in parallel with or at substantially the same time as the other attack likelihood classifiers or class predictors. The resulting output of a such a process results in a list of attack types and the likelihood that each attack type may occur in relation to the vulnerability.

[0068] Thereafter, of block 618, an attack type label or tag and an associated likelihood that such an attack may occur in relation to the new vulnerability will be assigned to or associate with the new vulnerability.

[0069] At block 620, the system also may determine, based on the vulnerability features and likelihood that particular attack types may occur, a solution or remedial action associated with such a vulnerability. For example, if an application includes a newly discovered vulnerability, a solution or remedial action may include to disable the application, downgrade the application, upgrade the application, or uninstall the application, in addition to other suitable actions. The system device, a processor, or an attack likelihood classifier or class predictor may determine such a solution based on the severity of the vulnerability.

[0070] At block 622, a severity or criticality of the vulnerability, and potentially each atack associated therewith can be provided, based on the number of associated attack types and the likelihood that each attack may occur, among other factors.

[0071] At block 624, a GUI or portion of a GUI may be generated to display the new vulnerability, the associated vulnerability features, the attack type labels (including the likelihood an attack may occur), a vulnerability solution (if available), and/or the severity of the vulnerability.

[0072] Fig. 7 shows an example of an information handling system 700 capable of administering each of the specific embodiments of the present disclosure and variations thereof. The information handling system 700 can represent the systems of Figs. 1 through 5B The information handling system 700 may include a computer system or processor 702 such as a central processing unit (CPU), a graphics processing unit (GPU), or both. Moreover, the information handling system 700 can include a main memory 704 and a static memory 707 that can communicate with each other via a bus 708. The information handling system 700 includes near-field communications (NFC) device and interface 718, such as an antenna and NFC subsystem. The information handling system 700 can also include a disk drive unit 716, and a network interface device 720. As shown, the information handling system 700 further may include a video display unit 710, such as a liquid crystal display (LCD), an organic light emitting diode (OLED), a flat panel display, a solid state display, or a cathode ray tube (CRT), or other suitable display. The video display unit 710 may also act as an input accepting touchscreen inputs. Additionally, the information handling system 700 may include an input device 712, such as a keyboard, or a cursor control device, such as a mouse or touch pad, or a selectable interface on the display unit. The information handling system may include a battery system 714. The information handling system 700 can represent a device capable of telecommunications and whose can be share resources, voice communications, and data communications among multiple devices. The information handling system 700 can also represent a server device whose resources can be shared by multiple client devices, or it can represent an individual client device, such as a laptop or tablet personal computer.

[0073] The information handling system 700 can include a set of instructions that can be executed to cause the processor to perform any one or more of the methods or computer based functions disclosed herein. The processor 702 may operate as a standalone device or may be connected such as using a network, to other computer systems or peripheral devices.

[0074] In a networked deployment, the information handling system 700 may operate in the capacity of a server or as a client user computer in a server-client user network environment, or as a peer computer system in a peer-to-peer (or distributed) network environment. The information handling system 700 can also be implemented as or incorporated into various devices, such as a personal computer (PC), a tablet PC, a set-top box (STB), a smartphone, a PDA, a mobile device, a palmtop computer, a laptop computer, a desktop computer, a communications device, a wireless telephone, a land-line telephone, a control system, a camera, a scanner, a facsimile machine, a printer, a pager, a personal trusted device, a web appliance, a network router, switch or bridge, or any other machine capable of executing a set of instructions (sequential or otherwise) that specify actions to be taken by that machine. In a particular embodiment, the computer system 700 can be implemented using electronic devices that provide voice, video or data communication. Further, while a single information handling system 700 is illustrated, the term “system” shall also be taken to include any collection of systems or subsystems that individually or jointly execute a set, or multiple sets, of instructions to perform one or more computer functions. [0075] The disk drive unit 716 or static memory 714 may include a computer-readable medium 722 in which one or more sets of instructions 724 such as software can be embedded. The disk drive unit 716 or static memory 714 also contains space for data storage. Further, the instructions 724 may embody one or more of the methods or logic as described herein. In a particular embodiment, the instructions 724 may reside completely, or at least partially, within the main memory 704, the static memory 706, and/or within the processor 702 during execution by the information handling system 700. The main memory 704 and the processor 702 also may include computer-readable media. The network interface device 720 can provide connectivity to a network 726, e.g., a wide area network (WAN), a local area network (LAN), wireless network (IEEE 702), or other network. The network interface 720 may also interface with macrocellular networks including wireless telecommunications networks such as those characterized as 2G, 3G, 4G, 5G, LTE or similar wireless telecommunications networks similar to those described above. The network interface 720 may be a wireless adapter having antenna systems 732 for various wireless connectivity and radio frequency subsystems 730 for signal reception, transmission, or related processing.

[0076] In an alternative embodiment, dedicated hardware implementations such as application specific integrated circuits, programmable logic arrays and other hardware devices can be constructed to implement one or more of the methods described herein. Applications that may include the apparatus and systems of various embodiments can broadly include a variety of electronic and computer systems. One or more embodiments described herein may implement functions using two or more specific interconnected hardware modules or devices with related control and data signals that can be communicated between and through the modules, or as portions of an application-specific integrated circuit. Accordingly, the present system encompasses software, firmware, and hardware implementations. In accordance with various embodiments of the present disclosure, the methods described herein may be implemented by software programs executable by a computer system. Further, in an exemplary, non-limited embodiment, implementations can include distributed processing, component/obj ect distributed processing, and parallel processing. Alternatively, virtual computer system processing can be constructed to implement one or more of the methods or functionality as described herein.

[0077] The present disclosure contemplates a computer-readable medium that includes instructions 724 or receives and executes instructions 724 responsive to a propagated signal; so that a device connected to a network 728 can communicate voice, video or data over the network 728. Further, the instructions 724 may be transmitted or received over the network 728 via the network interface device 720. In a particular embodiment, BIOS/FW code 724 reside in memory 704, and include machineexecutable code that is executed by processor 702 to perform various functions of information handling system 700.

[0078] Information handling system 700 includes one or more application programs 724, and Basic Input/Output System and Firmware (BIOS/FW) code 724. BIOS/FW code 724 functions to initialize information handling system 700 on power up, to launch an operating system, and to manage input and output interactions between the operating system and the other elements of information handling system 700.

[0079] In another embodiment (not illustrated), application programs and BIOS/FW code reside in another storage medium of information handling system 700. For example, application programs and BIOS/FW code can reside in drive 716, in a ROM (not illustrated) associated with information handling system 700, in an option-ROM (not illustrated) associated with various devices of information handling system 700, in storage system 707, in a storage system (not illustrated) associated with network channel 720, in another storage medium of the information handling system 700, or a combination thereof. Application programs 724 and BIOS/FW code 724 can each be implemented as single programs, or as separate programs carrying out the various features as described herein.

[0080] While the computer-readable medium is shown to be a single medium, the term “computer- readable medium” includes a single medium or multiple media, such as a centralized or distributed database, and/or associated caches and servers that store one or more sets of instructions. The term “computer-readable medium” shall also include any medium that is capable of storing, encoding, or carrying a set of instructions for execution by a processor or that cause a computer system to perform any one or more of the methods or operations disclosed herein.

[0081] In a particular non-limiting, exemplary embodiment, the computer-readable medium can include a solid-state memory such as a memory card or other package that houses one or more nonvolatile, read-only memories. Further, the computer-readable medium can be a random access memory or other volatile re-writable memory. Additionally, the computer-readable medium can include a magneto-optical or optical medium, such as a disk or tapes or other storage device to store information received via carrier wave signals such as a signal communicated over a transmission medium. Furthermore, a computer readable medium can store information received from distributed network resources such as from a cloud-based environment. A digital file attachment to an e-mail or other self-contained information archive or set of archives may be considered a distribution medium that is equivalent to a tangible storage medium. Accordingly, the disclosure is considered to include any one or more of a computer-readable medium or a distribution medium and other equivalents and successor media, in which data or instructions may be stored.

[0082] In the embodiments described herein, an information handling system includes any instrumentality or aggregate of instrumentalities operable to compute, classify, process, transmit, receive, retrieve, originate, switch, store, display, manifest, detect, record, reproduce, handle, or use any form of information, intelligence, or data for business, scientific, control, entertainment, or other purposes. For example, an information handling system can be a personal computer, a consumer electronic device, a network server or storage device, a switch router, wireless router, or other network communication device, a network connected device (cellular telephone, tablet device, etc.), or any other suitable device, and can vary in size, shape, performance, price, and functionality.

[0083] The information handling system can include memory (volatile (such as random-access memory, etc.), nonvolatile (read-only memory, flash memory etc.), or any combination thereof), one or more processing resources, such as a central processing unit (CPU), a graphics processing unit (GPU), hardware or software control logic, or any combination thereof. Additional components of the information handling system can include one or more storage devices, one or more communications ports for communicating with external devices, as well as, various input and output (I/O) devices, such as a keyboard, a mouse, a video/graphic display, or any combination thereof. The information handling system can also include one or more buses operable to transmit communications between the various hardware components. Portions of an information handling system may themselves be considered information handling systems.

[0084] When referred to as a “device,” a “module,” or the like, the embodiments described herein can be configured as hardware. For example, a portion of an information handling system device may be hardware such as, for example, an integrated circuit (such as an Application Specific Integrated Circuit (ASIC), a Field Programmable Gate Array (FPGA), a structured ASIC, or a device embedded on a larger chip), a card (such as a Peripheral Component Interface (PCI) card, a PCI-express card, a Personal Computer Memory Card International Association (PCMCIA) card, or other such expansion card), or a system (such as a motherboard, a system-on-a-chip (SoC), or a stand-alone device).

[0085] The device or module can include software, including firmware embedded at a device, such as a Pentium class or PowerPC™ brand processor, or other such device, or software capable of operating a relevant environment of the information handling system. The device or module can also include a combination of the foregoing examples of hardware or software. Note that an information handling system can include an integrated circuit or a board-level product having portions thereof that can also be any combination of hardware and software.

[0086] Devices, modules, resources, or programs that are in communication with one another need not be in continuous communication with each other, unless expressly specified otherwise. In addition, devices, modules, resources, or programs that are in communication with one another can communicate directly or indirectly through one or more intermediaries.

[0087] The foregoing description generally illustrates and describes various embodiments of the present disclosure. It will, however, be understood by those skilled in the art that various changes and modifications can be made to the above-discussed construction of the present disclosure without departing from the spirit and scope of the disclosure as disclosed herein, and that it is intended that all matter contained in the above description or shown in the accompanying drawings shall be interpreted as being illustrative, and not to be taken in a limiting sense. Furthermore, the scope of the present disclosure shall be construed to cover various modifications, combinations, additions, alterations, etc., above and to the above-described embodiments, which shall be considered to be within the scope of the present disclosure. Accordingly, various features and characteristics of the present disclosure as discussed herein may be selectively interchanged and applied to other illustrated and non-illustrated embodiments of the disclosure, and numerous variations, modifications, and additions further can be made thereto without departing from the spirit and scope of the present invention as set forth in the appended claims.