Sysdig, Inc.

Mattia Pagnozzi

Luca Guerra

Guido Bonomi

A computer-implemented method of managing computer vulnerabilities is disclosed. The method comprises detecting one or more processes running on a particular computing system during a particular period of time including now; and determining a set of active vulnerabilities that are associated with the one or more processes from a plurality of vulnerabilities. The method also comprises determining, for each vulnerability of the set of active vulnerabilities, context metadata related to a process or an application associated with the vulnerability, including how often the application has been executed, for how long the process has run, or when in the particular period of time the process was, is, or will be running. The method further comprises ranking the set of active vulnerabilities based on the context metadata for each active vulnerability to obtain a ranked order; and transmitting information related to the ranking to a device.

Runtime filtering of computer system vulnerabilities

Techniques for selectively remediating vulnerabilities for assets of a computing system is disclosed. The vulnerability management system identifies 'active' vulnerabilities associated with 'active' computing assets that have been determined to be currently running, or to have been recently run, on the system using system call data. By limiting remediation to vulnerabilities associated with software packages of active computing assets, remediation/mediation efforts can be focused on vulnerabilities that may be currently exploited for the system. The list of active vulnerabilities identified for a system may be updated in real time based on continued monitoring of runtime operations of the system. Additional context metadata may be associated with the active vulnerabilities to allow for further prioritization of vulnerability management activities. Vulnerability management actions for particular active vulnerability may include updating a software package, adjusting a set of firewall rules, communicating with a client computing device, and displaying vulnerability information in a GUI.

Growing community of inventors

Milan, Italy

Mattia Pagnozzi