View source for 17643205. COMBINING POLICY COMPLIANCE AND VULNERABILITY MANAGEMENT FOR RISK ASSESSMENT simplified abstract (INTERNATIONAL BUSINESS MACHINES CORPORATION)

=COMBINING POLICY COMPLIANCE AND VULNERABILITY MANAGEMENT FOR RISK ASSESSMENT=


==Organization Name==

[[:Category:INTERNATIONAL BUSINESS MACHINES CORPORATION|INTERNATIONAL BUSINESS MACHINES CORPORATION]]


[[Category:INTERNATIONAL BUSINESS MACHINES CORPORATION]]

==Inventor(s)==

[[:Category:Muhammed Fatih Bulut of West Greenwich RI (US)|Muhammed Fatih Bulut of West Greenwich RI (US)]][[Category:Muhammed Fatih Bulut of West Greenwich RI (US)]]

[[:Category:Abdulhamid Adebowale Adebayo of White Plains NY (US)|Abdulhamid Adebowale Adebayo of White Plains NY (US)]][[Category:Abdulhamid Adebowale Adebayo of White Plains NY (US)]]

[[:Category:Lilian Mathias Ngweta of Troy NY (US)|Lilian Mathias Ngweta of Troy NY (US)]][[Category:Lilian Mathias Ngweta of Troy NY (US)]]

[[:Category:Ting Dai of Elmsford NY (US)|Ting Dai of Elmsford NY (US)]][[Category:Ting Dai of Elmsford NY (US)]]

[[:Category:Constantin Mircea Adam of Fairfield CT (US)|Constantin Mircea Adam of Fairfield CT (US)]][[Category:Constantin Mircea Adam of Fairfield CT (US)]]

[[:Category:Daby Mousse Sow of Croton on Hudson NY (US)|Daby Mousse Sow of Croton on Hudson NY (US)]][[Category:Daby Mousse Sow of Croton on Hudson NY (US)]]

[[:Category:Steven Ocepek of Cuyahoga Falls OH (US)|Steven Ocepek of Cuyahoga Falls OH (US)]][[Category:Steven Ocepek of Cuyahoga Falls OH (US)]]

==COMBINING POLICY COMPLIANCE AND VULNERABILITY MANAGEMENT FOR RISK ASSESSMENT - A simplified explanation of the abstract==


This abstract first appeared for US patent application 17643205 titled 'COMBINING POLICY COMPLIANCE AND VULNERABILITY MANAGEMENT FOR RISK ASSESSMENT

==Simplified Explanation==

The patent application describes an apparatus, method, and computer program product that combine policy compliance with vulnerability management to provide a more accurate risk assessment of an environment.

* The method involves training a policy machine learning model using a first training dataset to generate a model that can classify mitigation techniques.
* A vulnerability machine learning model is also trained using a second training dataset to generate a model that can classify weakness types.
* The method further includes mapping the mitigation technique classifications to attack techniques to create a policy mapping.
* Similarly, the weakness type classifications are mapped to attack techniques to create a vulnerability mapping.
* Finally, a risk assessment of a vulnerability is produced based on the policy mapping and the vulnerability mapping.

Potential applications of this technology:

* Cybersecurity: This technology can be used in the field of cybersecurity to assess the risk of vulnerabilities in an environment.
* Risk management: It can assist in identifying and prioritizing vulnerabilities based on their potential impact and the available mitigation techniques.
* Compliance assessment: The technology can help organizations ensure compliance with policies and regulations by assessing the risk associated with vulnerabilities.

Problems solved by this technology:

* Accuracy of risk assessment: By combining policy compliance and vulnerability management, this technology provides a more accurate assessment of the risk associated with vulnerabilities.
* Mapping vulnerabilities to attack techniques: The mapping of vulnerability classifications to attack techniques helps in understanding the potential impact and likelihood of exploitation.

Benefits of this technology:

* Improved risk assessment: The combination of policy compliance and vulnerability management enhances the accuracy of risk assessment, allowing organizations to prioritize and address vulnerabilities effectively.
* Efficient mitigation planning: By mapping vulnerabilities to attack techniques, organizations can better understand the potential impact and plan mitigation strategies accordingly.
* Compliance assurance: The technology helps organizations ensure compliance with policies and regulations by assessing the risk associated with vulnerabilities.


==Original Abstract Submitted==

An apparatus, a method, and a computer program product are provided that combine policy compliance with vulnerability management to provide a more accurate risk assessment of an environment. The method includes training a policy machine learning model using a first training dataset to generate a policy machine learning model to produce mitigation technique classifications and training a vulnerability machine learning model using a second training dataset to generate a vulnerability machine learning model to produce weakness type classifications. The method also includes mapping the mitigation technique classifications to attack techniques to produce a policy mapping and mapping the weakness type classifications to the attack techniques to produce a vulnerability mapping. The method further includes producing a risk assessment of a vulnerability based on the policy mapping and the vulnerability mapping.



[[Category:G06F21/57]]
[[Category:G06F21/56]]
[[Category:G06N5/04]]