RU2813483C1 - System and method for prioritizing installation of patches on computers in network - Google Patents

Abstract

FIELD: computer engineering.

SUBSTANCE: technical result is achieved due to the fact that: a) obtaining data on computers in the network, wherein the data include information on software (SW) used on the computer; b) determining the presence of vulnerabilities in the SW on at least one computer in the network based on the obtained data; c) at least one patch is identified for each determined vulnerability; d) calculating, for each patch, a final score based on two or more of the following scores: estimation of SW usage frequency, for which presence of vulnerability has been determined; evaluation of use of computer hardware resources; assessment of risks of compromise by viral incidents; evaluation of the data transmission channel to the computer; e) determining the installation priority for at least two patches based on the calculated final score for each said patch; f) installing patches on computers depending on the determined installation priority.

EFFECT: higher degree of security due to prioritization of patches installation on computers in a network.

16 cl, 5 dwg, 3 tbl

Description

Field of technology

The invention relates to information security, and more specifically to a system and method for prioritizing the installation of patches on computers on a network.

State of the art

Today, almost any company collects and stores large amounts of data, including users’ personal data, which is very valuable and often confidential, the infringement of which can harm not only the company, but also compromise users by stealing their personal data. Personal data means any information relating directly or indirectly to a specific or identifiable person.

Nowadays, various cybersecurity protection solutions are used to protect their corporate infrastructure. In addition to security solutions, it is also necessary to promptly update the software installed on computers on the network. The consequences of untimely updates put virtually the entire corporate infrastructure at risk. For example, in 2017, there was an attack on large corporate networks of companies and government services around the world. The attack was carried out using a malicious program known as “Petya (NotPetya)”, which affected computers running the Microsoft Windows operating system, gaining complete control over the entire infrastructure of companies. At the same time, the consequences of this attack could have been minimized if many companies had taken care in advance to ensure that the software was up to date.

One solution to automate the update process is patch management. Patch management is a change management system. This solution helps companies timely install and monitor the necessary updates for software (hereinafter referred to as software). Today, there are many variations of patch management aimed at the entire corporate infrastructure of companies, while prioritizing the installation of updates depending on the criticality of vulnerabilities. However, existing patch management systems not only have useful functions for companies, but also some disadvantages. One of the disadvantages is the use of manual work by information security specialists (hereinafter - IS) to analyze scan results, prioritize the vulnerabilities found and eliminate the identified vulnerabilities in a certain sequence depending on the criticality. This drawback entails a loss of time, during which cybercriminals can manage to compromise the corporate infrastructure of companies. Another disadvantage is that the prioritization of vulnerabilities in patch management is carried out, as a rule, only on the basis of information about the criticality of the vulnerability. Another disadvantage of patch management systems is the lack of analysis of the reasons why a particular patch was not installed on the computer.

One example of solutions known from the prior art is the invention presented in patent US9959111B2 “Prioritization of software patches”. The present invention allows software updates to be prioritized based on the definition of error classes, wherein the process of determining error classes is automated and gives higher priority to security errors.

Also known from the prior art is the invention disclosed in patent application WO2019089389A1 “Systems and methods for prioritizing software vulnerabilities for patching.” The presented invention allows you to prioritize updates based on predicting which software vulnerabilities can be exploited by cybercriminals and therefore have a higher priority for patching.

These inventions are, to one degree or another, aimed at prioritizing updates. However, prioritization based only on the assessment of vulnerabilities does not allow for a full qualitative gradation of priorities, due to the lack of use of other assessment criteria, the use of which can improve the efficiency of the patch management system. Based on the analysis of the prior art, the lack of analysis of the reasons for failures in patch management, due to which a particular patch was not installed on a computer, can carry a serious risk of system compromise and vulnerability.

The claimed technical solution is aimed at improving patch management, ensuring the efficiency of determining priorities for installing patches, as well as expanding the functionality of patch management in terms of analyzing the causes of failures due to which the patch was not installed.

Disclosure of the invention

The objective of the claimed invention is to improve patch management and expand its functionality.

The technical result is to increase the efficiency of determining priorities for installing patches. The specified technical result is achieved through the proposed method for prioritizing the installation of patches on computers on the network.

As one of the embodiments of the present invention, a system for prioritizing the installation of patches on computers on a network is proposed, including a server connected to user computers in a network, wherein the server includes: a) a data collection module associated with an analyzer, said data collection module is designed to obtain data about computers on the network, where the data includes information about the software (hereinafter referred to as the software) installed on the computers; b) an analyzer associated with a patch management module, wherein said analyzer is designed to: determine the presence of vulnerabilities in software on at least one computer on the network based on data received from the data collection module; identifying the presence of at least one patch for each specific vulnerability; calculating for each patch a final score based on two or more of the following scores: account importance score; assessment of the frequency of use of software for which the presence of a vulnerability has been determined; assessing the use of computer hardware resources; assessing the risks of compromise based on virus incidents; assessment of the data transmission channel to the computer; c) a patch management module for: determining installation priority for at least two patches based on the calculated final score for each specified patch; installing patches on computers depending on a specific installation priority.

In yet another embodiment of the system, the data collection module additionally receives data containing at least the following information: user account role; frequency of software use by the user; data transmission channel capacity; information about the availability of software updates; availability of special-purpose software installed on the computer; presence of instant messengers on the computer; use of computer hardware resources.

In yet another embodiment of the system, the analyzer additionally calculates for each patch at least one of the assessments to determine the priority of patch installation: an assessment of the presence of special-purpose software installed on the computer; computer accessibility assessment; assessment based on the availability of Internet access; assessment of the security level of anti-virus protection.

In another embodiment of the system, the analyzer additionally receives feedback after installing patches.

In another embodiment of the system, the feedback data comprises at least one or more categories of information: operating system version; operating system bit depth; Memory; running processes on the computer at the time of patch installation; installed software; information about the last reboot; user activity; availability of access to the Internet; having administrator rights; patch installer data.

In another embodiment of the system, if the installation of at least one patch on a computer fails, the analyzer analyzes the causes of the failure based on feedback data and generates a failure report with recalculated final scores.

In yet another embodiment of the system, the patch management module changes the priority for at least one patch that was not installed based on a crash report with recalculated final scores.

In another embodiment of the system, the patch management module installs patches on computers based on the changed priority.

As another implementation option, a method is proposed for prioritizing the installation of patches on computers on a network, which includes the steps of: a) obtaining data about computers on the network, wherein the data includes information about the software (hereinafter referred to as the software) used on the computer; b) determine the presence of software vulnerabilities on at least one computer on the network based on the data received; c) identify at least one patch for each specific vulnerability; d) calculate for each patch a final score based on two or more of the following scores: account importance score; assessment of the frequency of use of software for which the presence of a vulnerability has been determined; assessing the use of computer hardware resources; assessing the risks of compromise based on virus incidents; assessment of the data transmission channel to the computer; e) determining installation priority for at least two patches based on the calculated final score for each specified patch; f) install patches on computers depending on a certain installation priority.

In yet another embodiment of the method, the additional data obtained is at least information for calculating scores: the role of the user account; frequency of software use by the user; data transmission channel capacity; information about the availability of software updates; availability of special-purpose software installed on the computer; presence of instant messengers on the computer; use of computer hardware resources.

In another embodiment of the method, at least one of the estimates is additionally calculated for each patch to determine the priority of installing the patch: an estimate of the presence of special-purpose software installed on the computer; assessment based on the availability of Internet access; computer accessibility assessment; assessment of the security level of anti-virus protection.

In yet another embodiment of the method, feedback data is additionally obtained after the patches are installed.

In yet another embodiment of the method, the feedback data contains at least the following information: operating system version; operating system bit depth; Memory; running processes on the computer at the time of patch installation; installed software; information about the last reboot; user activity; availability of access to the Internet; having administrator rights; patch installer data.

In another embodiment of the method, if the installation of at least one patch on a computer fails, the reasons for the failure are analyzed based on the feedback data and a failure report is generated with recalculated final estimates.

In yet another embodiment of the method, the priority for patches that have not been installed is changed based on the crash report with the recalculated final scores.

In another embodiment of the method, patches are installed on computers depending on the changed priority.

Brief description of drawings

The accompanying drawings illustrate exemplary embodiments only and should therefore not be considered limiting in scope, other equally effective embodiments may be permitted. Additional objects, features and advantages of the present invention will become apparent from a reading of the following description of the invention with reference to the accompanying drawings, in which:

Fig. 1 presents an example of a block diagram of a system for prioritizing the installation of patches on computers on a network.

Fig. 2 presents an example of a rating database.

Fig. 3 presents an example of a method for prioritizing the installation of patches on computers on a network.

Fig. 4 represents an embodiment of a method for prioritizing the installation of patches on computers on a network.

Fig. 5 shows an example of a computer system with which the present invention is implemented.

Carrying out the invention

Objects and features of the present invention, methods for achieving these objects and features will become apparent by reference to exemplary embodiments. However, the present invention is not limited to the exemplary embodiments disclosed below, but may be embodied in various forms. The substance set forth in the specification is nothing more than the specific details necessary to assist one skilled in the art in fully understanding the invention, and the present invention is defined within the scope of the appended claims.

A number of terms are defined below that will be used in describing embodiments of the invention.

A patch (English patch) or update (English update) is, in particular, an automated, separately supplied software tool that contains the information necessary to fix problems in the software or change its functionality. For example, a number of patches are released to close vulnerabilities so that they cannot be exploited.

Patch management is a change management system.

Virus incidents are a computer incident that occurred as a result of exposure to or through the use of a malicious program (programs).

Exploit (English exploit, exploit) is a computer program, a fragment of program code or a sequence of commands that exploit vulnerabilities in software and are used to carry out an attack on a computer system.

An account is a set of data about a user stored in a computer system, necessary to identify him (authenticate) and provide access to his personal data and settings.

SCADA (abbreviation for Supervisory Control Data Acquisition - supervisory control and data acquisition) is a software package designed to develop or ensure real-time operation of systems for collecting, processing, displaying and archiving information about a monitoring or control object.

The essence of the invention is that patches are determined for software vulnerabilities identified on user computers, and installation priorities for patches are determined based on two or more assessments. Depending on the implementation of the present invention, these estimates take on certain final total values, which allows you to subsequently prioritize the installation of patches according to the installation priority level.

In FIG. Figure 1 shows an example of a block diagram of a system for prioritizing the installation of patches on computers on the network.

The block diagram of the system for prioritizing the installation of patches on computers in the network 100 (hereinafter referred to as the system 100) contains a server 120 that interacts with computers 105 in the network 110. The server 120 includes a data collection module 130, an analyzer 140, a vulnerability database 150, a patch database 160, a rating database 170 and a patch management module 180. For the purposes of this application, computers 105 mean any computing device, in particular a personal computer, laptop, smartphone, tablet, router, storage system, server. Elements of a system for prioritizing the installation of patches on computers on network 100 may be implemented on a computer system, an example of which is shown in FIG. 5.

The system 100 is implemented as follows: the server 120, when interacting with computers 105 through the network 110, using the data collection module 130, receives data about computers on the network, and the data includes information about the software installed on the computers. An example of information about the software is information about the version and date of installation of the software, and the time of use of the software. The data acquisition module 130 sends the received data about the computers 105 to the analyzer 140.

In another embodiment of the system 100, the data acquisition module 130 additionally receives data from the computers 105 that contains at least the following information:

a) the role of the user account;

b) frequency of use of the software by the user;

c) data transmission channel capacity;

d) information about the availability of software updates;

e) availability of special-purpose software installed on the computer;

f) the presence of instant messengers on the computer;

g) use of computer hardware resources.

The analyzer 140 is designed to determine the presence of vulnerabilities in software based on the vulnerability database 150, identify for each specific vulnerability the presence of at least one patch based on the patch database 160, and calculate a final score for each patch based on two or more scores stored in assessment database 170. The analyzer 140 organizes the received data from the data collection module 130 by at least the type of software installed on the computers 105, and then searches for known vulnerabilities related to the software in the vulnerability database 150 to determine the presence of vulnerabilities in the software.

It is worth noting that filling the vulnerability database 150 with information about vulnerabilities is carried out in a particular case using external sources, for example, the following databases: American vulnerability database (English National Vulnerability Database, NVD), database of well-known information security vulnerabilities (English. Common Vulnerabilities and Exposures, CVE), a database of information security threats of the Federal Service for Technical and Export Control (BDU FSTEC). In a particular implementation case, the vulnerability database 150 contains information only about vulnerabilities related to software installed on computers 105, while the list of vulnerabilities is supplemented if new software appears on computers 105.

After determining the presence of vulnerabilities in the software, the analyzer 140 accesses the patch database 160 to search for patches for the detected vulnerabilities. Patch database 160 contains a list of patches related to software on computers 105, and patch database 160 is updated as new software becomes available on computers 105. After identifying at least one patch for each specific vulnerability, analyzer 140 calculates a final score for each patch. , based on two or more of the following assessments:

• assessment of the importance of the account,

• assessment of the frequency of use of software for which the presence of a vulnerability has been determined,

• assessment of the use of computer hardware resources,

• assessment of the availability of special-purpose software installed on the computer,

• assessment of the data transmission channel to the computer,

• assessing the risks of compromise based on virus incidents,

• computer accessibility assessment,

• assessment based on the availability of access to the Internet,

• assessment of the security level of anti-virus protection.

In a particular implementation, each rating has a different scale gradation, reflecting the degree of importance, for example, in the range from 1 to 5 points, where rating 1 is a very low score, rating 2 is a low score, rating 3 is an average score, rating 4 is a high score, score 5 - very high score. In addition, the scores of one assessment can be summed up across several criteria, and the final score can be the sum of two or more calculated scores for each patch. The final score, calculated by adding the scores of two or more calculated scores, indicates the order in which each patch was installed. The given example of a rating scale is not a limitation of the entire implementation, but is only presented as one of the implementation options.

Let us consider in more detail the given ratings stored in the rating database 170, an example of which is presented in FIG. 2, and their criteria.

1. Assessing the importance of the account. This assessment is determined for computer 105 by analyzer 140. Account importance refers to the level of access to corporate infrastructure and confidential data that a particular user account on the computer has. In turn, user accounts are divided into two types - a regular account and an administrator account. The standard user account is intended for everyday work (for example, working in word processors, forwarding mail, watching a movie, etc.), while the administrator account provides full control over the computer. For example, a computer with an "engineer" account is assigned a score of 4 for this criterion because the account has access to corporate infrastructure and sensitive data (for example, access to software development files). Another computer with the “storekeeper” account is assigned a score of 1 for this criterion due to the lack of access to confidential data. The gradation of assessing the importance of an account using the example of Table 1 may look like this.

Table 1. Account importance ratings.

Computer 1 “engineer” 3 Computer 2 "director" 3 Computer 3 “storekeeper” 1 Computer 4 “accountant” 3 Computer 5 "trainee" 2

2. Assessment of the frequency of use of software for which the presence of a vulnerability has been determined. This score is also determined for computer 105 by analyzer 140. Software usage frequency refers to how often the installed software that has been identified as having a vulnerability is used. The assessment is determined by at least several criteria:

• Daily use of installed software on a computer, for example, a score of 3 is assigned to this criterion.

• Using installed software with local administrator rights, for example, this criterion is assigned a score of 5.

• The software remains running when the user is inactive, for example, the user left the computer turned on with an open browser with a large number of tabs; according to this criterion, for example, a score of 4 is assigned.

• The software is installed in autostart and is turned on every time the computer boots; according to this criterion, for example, a score of 2 is assigned.

• Rare use of installed software on a computer, for example, according to this criterion, a score of 1 is assigned. Rare use of installed software on a computer means a situation when such software is launched less than once in a specified time interval and the duration of operation takes no more than a specified duration;

• Failure to use installed software on the computer; this criterion is assigned a score, for example, 1.

For example, if the software is in autostart and is turned on every time the computer boots, and the user uses the installed software on the computer every day, the score is the sum of a set of evaluation criteria and will be equal to 5. In another example, if the installed software is used with local administrator rights, In this case, the software is used daily, the score will be 8.

3. Assessing the use of computer hardware resources. This assessment is also determined for the computer 105 by the analyzer 140. The assessment of the use of computer hardware resources refers to the analysis of a situation in which the user's work session on the computer may be temporarily terminated or slowed down due to overload of computer resources by installing a patch while the user is working on the computer . The score is determined by one of several criteria:

• The user is actively working on the computer, while many programs are running on the computer, which can provoke a conflict between the running software and the installation of the patch; according to this criterion, for example, a score of 4 is assigned.

• The user is actively working on the computer, while the processor is loaded at 100%, for example, the user is editing video, which requires large computing resources of the computer; performs backups, etc., the process of installing patches will significantly reduce the performance of the computer. For this criterion, for example, a score of 2 is assigned.

• The user actively uses the computer, while the computer's processor is loaded with applications running in real time, for example, a video conference session, online video conferencing, etc., the process of installing the patch may interrupt the operation of these applications. For this criterion, for example, a score of 3 is assigned.

• The user's computer is involved in a technological or production process, for example, the technological process is controlled from the console of a SCADA system; control of the operation of a machine with numerical control (abbr. CNC; English computer numerical control), the process of installing patches can disrupt the operation of technological or production processes. For this criterion, for example, a score of 1 is assigned.

• The user's computer is used without CPU load, and the process of installing a patch on the computer will not affect the user's work session. For this criterion, for example, a score of 5 is assigned.

4. Assessing the availability of special-purpose software (hereinafter referred to as special software) installed on the computer. This assessment is also determined for computer 105 by analyzer 140. Special software in the present invention is a set of programs used to solve a certain class of problems, the compromise of which can lead to administrative and financial risks, for example, withdrawal of funds from the organization’s accounts, leakage of confidential information. The assessment is determined by at least several criteria:

• based on the presence of an EDS token, this criterion is assigned a score, for example, 5;

• the presence on the computer of accounting software (for example, 1C: Accounting), banking software, SCADA system software, according to this criterion, for example, a score of 4 is assigned;

• computer user behavior, for example, visiting the web pages of banks, payment systems, according to this criterion is assigned, for example, a score of 3;

• the presence of instant messengers or access to social networks on the user’s computer; according to this criterion, for example, a score of 2 is assigned.

If the user’s computer has, for example, an electronic digital signature token, accounting software or SCADA system software, and if the user actively visits the web pages of payment systems, and there are instant messengers on the computer, a score of 14 is assigned according to these criteria. In another case , if the user has instant messengers on his computer and the user visits the web pages of banks, but does not have, for example, accounting software, a score of 5 is assigned according to these criteria. The above special software is indicated as examples and implies that there may be other types of special software, not specified in the present invention.

5. Evaluation of the data transmission channel to the computer. The specified score is determined for the computer 105 by the analyzer 140. This score is determined based on the bandwidth of the data transmission channel from the server 120 to the computer 105. For example, it is required to install 5 patches on the computer, of which patches numbered 1 and 3 have priority in terms of the criticality of the problems being corrected, and the size of each is 500 megabytes, however, a computer with a network connection duration of less than 15 minutes may simply not have time to download and install patches 1 and 3, and the remaining patches 2, 4, 5 will not download. Initially, lower priority patches 2, 4, 5, having a smaller size compared to patches 1 and 3, for example, 5 megabytes, in this case will become more priority, according to this criterion, for example, a score of 2 is assigned. In another example, there is a need to download and install 5 patches on a large number of computers, suppose , for 1000 computers, where patches numbered 1 and 3 are prioritized in terms of the criticality of the problems being corrected and the size of each is 500 megabytes, while the user’s computers are located on a remote subnet, simultaneous downloading of a large patch to them will reduce the bandwidth of the data transmission channel from the server to computers. For this criterion, for example, a score of 1 is assigned.

6. Assessing the risks of compromise based on virus incidents. This assessment is calculated for computer 105 by analyzer 140. Risks of compromise from virus incidents are understood as cases where attacks using exploits or other malware were recorded on the user’s computer. The assessment is determined by at least several criteria:

• There have never been any virus incidents or exploits on the user’s computer; this criterion is assigned a score, for example, 1.

• There were virus incidents on the user’s computer, but not related to an exploit; according to this criterion, for example, a score of 2 is assigned.

• Network attacks or attacks using exploits were recorded on the user’s computer; for example, a score of 3 is assigned according to this criterion.

• Attacks using exploits against specific vulnerable software on which it is planned to install a patch were recorded on the user’s computer; for example, a score of 4 is assigned according to this criterion.

• Attacks were recorded on the user’s computer using exploits for vulnerabilities identified in specific vulnerable software; for example, a score of 5 is assigned according to this criterion.

7. Assessing computer accessibility. This estimate is calculated for computer 105 by analyzer 140. Computer availability refers to the period of time during which the computer is turned on. The assessment is determined by at least several criteria:

• The user’s computer is turned on 24 hours a day (the computer is available for installing patches), according to this criterion, for example, a score of 1 is assigned,

• The user’s computer starts and works according to a certain schedule, for example, from 8 am to 6 pm from Monday to Friday (the computer is available at a certain time), for example, a score of 2 is assigned according to this criterion,

• The user’s computer starts and works for a short time, for example, every Friday at a certain period of time, or the user’s computer is not available every day, but for 20 minutes (the computer is not always available), for example, a score of 3 is assigned according to this criterion,

• The user's computer is rebooted at certain intervals, such as once a day, a week, or a month, and a certain score is assigned to the criterion depending on the specified period. If the user's computer restarts once a day, for example, a score of 1 is assigned.

8. Assessment based on availability of access to the Internet. This score is determined for each computer 105 by the analyzer 140. This score refers to the methods and means by which users connect to the Internet. The assessment is determined by at least several criteria:

• The user’s computer is not connected to the Internet; this criterion is assigned, for example, a score of 1.

• Connecting the user’s computer to the Internet; according to this criterion, for example, a score of 2 is assigned.

• Connecting the user’s computer to networks that have access to the Internet, for example, connecting to a 3G network, Wifi, according to this criterion, for example, a score of 3 is assigned.

• The connection to the user’s computer is carried out from the Internet, for example, the user’s ability to connect to the computer remotely, according to this criterion, for example, a score of 4 is assigned.

9. Assessment of the security level of anti-virus protection. The specified assessment is calculated for each computer 105 by the analyzer 140. This assessment is understood as an assessment of the state of anti-virus protection, which characterizes the degree of security of the computer. The score is determined by at least the following criteria:

• Application Control is enabled and configured on the user’s computer; for example, a score of 1 is assigned to this criterion.

• A firewall is enabled and configured on the user’s computer; for example, a score of 1 is assigned to this criterion.

• On the user’s computer, the anti-virus protection databases are updated daily, and according to this criterion, for example, a score of 1 is assigned.

• Anti-virus protection has been disabled on the user’s computer; this criterion is assigned, for example, a score of 3.

Analyzer 140 provides final scores for at least two patches to patch management module 180. In turn, the patch management module 180 determines the installation priority for each patch based on the resulting final scores.

In a particular embodiment, the patch management module 180 determines the order of installation of patches according to the following principle: the highest priority is given to patches whose final score is equal to or greater than a specified upper threshold value, for example, equal to 25 points or more; Medium priority is given to patches whose final score is in the range between the established upper and lower threshold values, for example, from 15 to 24 points; Low priority is given to patches whose final score does not exceed the established lower threshold, for example, 14 points or lower. The given example of final assessments is not a limitation of the entire implementation, but is only presented as one of the implementation options.

The calculation of the final scores for each patch, based on two or more scores, is as follows, using the example of Table 2.

Table 2. Calculation of final scores for each patch.

Ratings Comp.1 Comp.2 Comp.3 Comp.4 Comp.5 Account importance rating 5 5 4 2 1 Estimating the frequency of use of software that has been identified as having a vulnerability 5 2 5 3 1 Assessing the use of computer hardware resources 3 1 4 4 5 Assessing the availability of special-purpose software installed on the computer 14 12 2 3 2 Evaluation of the data transmission channel to the computer 1 1 2 2 1 Assessing the risks of compromise based on virus incidents 2 4 2 1 1 Assessing the security level of antivirus protection 1 1 1 1 1 final grade 31 26 20 16 12

In Table 2, computers are distributed as follows: computer 1 with the user account role “director”; computer 2 with the user account role “accountant”; computer 3 with the user account role “engineer”; computer 4 with the user account role “trainee”; computer 5 with the user account role “storekeeper”.

The highest final priority score for installing the patch was received by computer 1 with the user role of the “director” account, and the lowest final score of the priority of installing the patch was received by computer 5 with the user role of the “storekeeper” account. Accordingly, computer 1 with the user role “director” and computer 2 with the user role “accountant” will receive priority installation of patches, because patches for these computers scored a final score of 25 points or higher; patches for computer 3 and computer 4 received a medium priority installation priority, installation of patches will begin after installing patches on computers 1 and 2. A patch for computer 5 with a final score of 12 points received low installation priority, installation of patches on computer 5 will begin after installing patches on computers 3 and 4.

After determining the installation priority for at least two patches, the patch management module 180 installs the patches on the corresponding computers 105 on the network 110 according to the determined patch installation priority.

In another embodiment, systems 100 additionally receive feedback after patches are installed. The server 120 receives feedback from each computer 105 through the network 110 after installing patches with information about the success or failure of patch installation, and this information is sent to the data collection module 130. Next, the data collection module 130 transmits the received information to the analyzer 140. In case of failure patch installation analyzer 140 analyzes the causes of patch installation failure based on feedback data and generates a failure report with recalculated final scores. Reasons for installation failure include, for example, a situation in which the computer 105 shut down while the patch was being installed, or a situation in which the computer's hardware resources were overloaded during the installation of the patches, resulting in an unexpected reboot of the computer, or a situation involving a possible virus incident.

The feedback data received by the server 120 from the computers 105 via the network 110 to the data acquisition module 130 contains at least the following information:

• operating system version,

• bit depth of the operating system,

• Memory,

• running processes on the computer at the time of patch installation,

• installed software,

• information about the last reboot,

• user activity,

• availability of access to the Internet,

• having administrator rights,

• patch installer data.

The recalculation of the final scores for two or more scores by the analyzer 140 for patches that were not installed is as follows: for example, on computers 3 and 5 from Table 2, patch installation failed due to a virus incident. The generated failure report indicates that anti-virus protection was disabled, attacks using exploits for vulnerabilities identified in specific vulnerable software were recorded on the specified computers, and the behavior of users of these computers was recorded, such as visiting the web pages of banks and payment systems. In this case, the criteria for such assessments will change: assessment of the presence of special-purpose software on the computer; assessing the risks of compromise based on virus incidents; assessment of the security level of anti-virus protection. Consequently, the recalculated final score for two or more assessments, taking into account the changed criteria for the patch on computer 3, became 26 points, and for the patch on computer 5 became 19 points. An example with recalculated final grades is presented in Table 3.

Table 3. Example of recalculated final grades.

Ratings Comp.3 Comp.5 Account importance rating 4 1 Estimating the frequency of use of software that has been identified as having a vulnerability 5 1 Assessing the use of computer hardware resources 4 5 Assessing the availability of special-purpose software installed on the computer 3 3 Evaluation of the data transmission channel to the computer 2 1 Assessing the risks of compromise based on virus incidents 5 5 Assessing the security level of antivirus protection 3 3 Recalculated final grade 26 19

In a particular embodiment, analyzer 140 recalculates the final score for computer 105, taking into account increased coefficients for one or more ratings, where the increased coefficient depends on the significance of the evaluation criteria. For example, the final grade is calculated based on the equation: Io = K1 x A + K2 x B + K3 x B + ... + Kn x C, where Io is the final grade, A, B, C, C are grades, K1, K2, K3 , Kn – coefficients. In the present invention, significance refers to the importance of the evaluation criteria by which the patch installation fails. Such a criterion as disabling anti-virus protection is more important than the criterion of restarting the computer. The recalculation of the final grades by increasing the scores of the evaluation criteria by significance is as follows: for example, from Table 2, on computer 3, the installation of patches failed due to a virus incident. The generated crash report indicates that anti-virus protection was disabled, network attacks or attacks using exploits were recorded on the specified computer, and the behavior of the user of this computer was recorded, such as visiting the web pages of banks and payment systems. The criteria for assessments such as assessing the risk of compromise from virus incidents, assessing the security level of anti-virus protection, and assessing the presence of special-purpose software installed on the computer have changed. Based on the failure report, the changed rating criteria are increased by an additional 5 points to the ratings already assigned before the installation failure. Taking into account the additional increase in the score, the recalculated final score for the changed criteria increased by 15 points to 38 points for computer 3. In another example, from table 2 on computer 3, if the crash report indicates that an unexpected reboot of the computer occurred, then the significance This evaluation criterion additionally increases the final score by 2 points and the recalculated final score for computer 3 becomes 22 points.

In another implementation, the patch management module 180 changes the priority for patches that were not installed based on a crash report with recalculated final scores. Using the example of Table 3, the patch control module 180 changes the priority of the recalculated final score patches for computer 3 to high priority, and the priority of the patch for computer 5 changes from low priority to medium priority.

In another embodiment, the patch management module 180 installs patches on the computers 105 based on the changed priority.

In FIG. 3 presents an example of a method for prioritizing the installation of patches on computers in network 300 (hereinafter referred to as method 300).

At step 310, data about computers on the network 105 is obtained by data acquisition module 130, the data including information about the software used on the computer. An example of information about the software is information about the version and date of installation of the software, and the time of use of the software. Additionally, the data obtained is at least information for calculating estimates: a) the role of the user account, b) the frequency of use of the software by the user, c) the bandwidth of the data transmission channel, d) information about the availability of updates for the software, e) the presence of software installed on the computer special purpose, f) the presence of instant messengers on the computer, g) the use of computer hardware resources.

At step 320, the presence of vulnerabilities in the software is determined by the analyzer 140 on at least one computer on the network based on the data received from the data collection module 130. The presence of vulnerabilities is determined using the vulnerability database 150, and the said database contains only information about vulnerabilities related to to software installed on computers. The list of vulnerabilities is expanded when new software appears on computers.

At step 330, at least one patch is identified for each identified vulnerability by analyzer 140. Patches are identified using a patch database 160, said database containing a list of patches related to software on computers. The 160 patch database is updated as new software appears on computers.

At step 340, for each patch, a final score is calculated by analyzer 140 based on two or more of the following scores:

• assessment of the importance of the account,

• assessment of the frequency of use of software for which the presence of a vulnerability has been determined,

• assessment of the use of computer hardware resources, assessment of the availability of special-purpose software installed on the computer,

• assessment of the data transmission channel to the computer,

• assessing the risks of compromise based on virus incidents,

• computer accessibility assessment,

• assessment based on the availability of access to the Internet,

• assessment of the security level of anti-virus protection.

A detailed description of the calculation of the final scores for each patch is discussed in the description of FIG. 1.

At step 350, the installation priority of at least two patches is determined by the patch management module 180 based on the calculated final score for each specified patch.

At step 360, patches are installed on computers by patch management module 180 depending on the determined installation priority.

In FIG. 4 shows an implementation of a method 400 for prioritizing the installation of patches on computers on a network, which is implemented in conjunction with method 300 and begins after step 360.

At step 410, feedback is received after the patches have been installed by data acquisition module 130. The feedback includes at least information about whether the patch was installed successfully or whether the patch installation failed.

In a particular embodiment of method 400, the feedback additionally contains at least the following information: 1) version of the operating system, 2) bitness of the operating system, 3) amount of memory, 4) running processes on the computer at the time of patch installation, 5) installed software, 6 ) information about the last reboot, 7) user activity, 8) availability of Internet access, 9) availability of administrator rights, 10) patch installer data.

At step 420, the causes of patch installation failure are analyzed based on the feedback data and a failure report is generated with recalculated final scores by analyzer 140.

At step 430, the priority for patches that were not installed is changed based on the crash report with the recalculated final scores by the patch management module 180.

At step 440, patches are installed on the computers depending on the changed priority by the patch management module 180.

In FIG. 5 illustrates a computer system on which various embodiments of the systems and methods disclosed herein can be implemented. Computer system 20 may be a system configured to implement the present invention and may be in the form of a single computing device or multiple computing devices, such as a desktop computer, a laptop computer, a notebook computer, a mobile computing device, a smartphone, a tablet computer, a server, a mainframe computer. , embedded device, and other forms of computing devices.

As shown in FIG. 5, the computer system 20 includes: a central processing unit 21, a system memory 22, and a system bus 23 that communicates various system components, including memory, coupled to the central processing unit 21. The system bus 23 is implemented as any bus known in the art. a structure that in turn contains a bus memory or bus memory controller, a peripheral bus, and a local bus capable of interfacing with any other bus architecture. Examples of buses include: PCI, ISA, PCI-Express, HyperTransport™, InfiniBand™, Serial ATA, I2C, and other suitable connections between components of the computer system 20. The central processing unit 21 includes one or more processors having one or more cores. The central processing unit 21 executes one or more sets of computer-readable instructions implementing the methods presented herein. System memory 22 may be any memory for storing data and/or computer programs executed by the central processing unit 21. System memory may include both read-only memory (ROM) 24 and random access memory (RAM) 25. Main input/output system (BIOS) 26 contains the basic procedures that ensure the transfer of information between elements of the computer system 20, for example, when the operating system is loaded using ROM 24.

Computer system 20 includes one or more data storage devices, such as one or more removable storage devices 27, one or more non-removable storage devices 28, or combinations of removable and non-removable devices. One or more removable storage devices 27 and/or non-removable storage devices 28 are connected to the system bus 23 through an interface 32. In one embodiment, removable storage devices 27 and associated computer-readable storage media are non-volatile modules for storing computer instructions, data structures, program modules and other data of the computer system 20. System memory 22, removable storage devices 27, and non-removable storage devices 28 may use various computer-readable storage media. Examples of computer-readable storage media include computer memory such as cache memory, SRAM, DRAM, capacitorless RAM (Z-RAM), thyristor memory (T-RAM), eDRAM, EDO RAM, DDR RAM, EEPROM, NRAM, RRAM, SONOS, PRAM; flash memory or other memory technologies such as solid-state drives (SSDs) or flash drives; magnetic cassettes, magnetic tapes and magnetic disks such as hard disks or floppy disks; optical media such as compact discs (CD-ROMs) or digital versatile discs (DVDs); and any other media that can be used to store the desired data and that can be accessed by the computer system 20.

System memory 22, removable storage devices 27, and non-removable storage devices 28 contained in the computer system 20 are used to store the operating system 35, applications 37, other program modules 38, and program data 39. The computer system 20 includes a peripheral interface 46 for data transfer. from input devices 40 such as a keyboard, mouse, stylus, game controller, voice input device, touch input device, or other peripheral devices such as a printer or scanner through one or more input/output ports such as a serial port, a parallel port , Universal Serial Bus (USB), or other peripheral interface. A display device 47, such as one or more monitors, projectors, or embedded displays, is also connected to the system bus 23 through an output interface 48, such as a video adapter. In addition to the display devices 47, the computer system 20 is equipped with other peripheral output devices (not shown in FIG. 5), such as speakers and other audiovisual devices.

The computer system 20 may operate in a networked environment using a network connection to one or more remote computers 49. The remote computer(s) 49 is a working personal computer or server that contains most or all of the components noted previously in describing the nature of the computer system 20 , presented in Fig. 5. There may also be other devices in the network environment, such as routers, network stations or other network nodes. The computer system 20 may include one or more network interfaces 51 or network adapters for communicating with remote computers 49 over one or more networks, such as a local area network (LAN) 50, a wide area network (WAN), an intranet, and the Internet. Examples of network interface 51 are an Ethernet interface, a Frame Relay interface, a SONET interface, and wireless interfaces.

Embodiments of the present invention may be a system, a method, or a computer-readable medium (or storage medium).

A computer-readable storage medium is a tangible device that stores and stores program code in the form of machine-readable instructions or data structures that can be accessed by the central processing unit 21 of a computer system 20. The computer-readable storage medium may be an electronic, magnetic, optical, electromagnetic, semiconductor storage device, or any suitable their combination. By way of example, such a computer-readable storage medium may include random access memory (RAM), read-only memory (ROM), EEPROM, compact disc read-only memory (CD-ROM), digital versatile disk (DVD) ), flash memory, hard drive, portable computer floppy disk, memory card, floppy disk, or even a mechanically encoded device such as punch cards or embossed structures with instructions written on them.

The system and method of the present invention can be thought of in terms of means. The term "device" as used herein refers to an actual device, component, or group of components implemented in hardware, such as an application-specific integrated circuit (ASIC) or FPGA, or a combination of hardware and software. providing, for example, using a microprocessor system and a set of machine-readable instructions to implement the functionality of a tool that (in the process of execution) turns the microprocessor system into a special-purpose device. The tool may also be implemented as a combination of these two components, with some functions being implemented by hardware alone and other functions being implemented by a combination of hardware and software. In some embodiments, at least a portion, and in some cases all, of the means may be executed on the central processing unit 21 of the computer system 20. Accordingly, each means may be implemented in various suitable configurations and should not be limited to any particular implementation. given in this document.

In conclusion, it should be noted that the information given in the description are examples that do not limit the scope of the present invention as defined by the formula. One skilled in the art will appreciate that in developing any actual embodiment of the present invention, many decisions specific to the particular implementation must be made to achieve specific objectives, and these specific objectives will differ from one embodiment to another. It is understood that such development efforts can be complex and time consuming, but will nevertheless be a routine engineering task for those of ordinary skill in the art using the present disclosure.

Claims (82)

1. A system for prioritizing the installation of patches on computers on a network, including a server connected to user computers in a network, wherein the server includes: a) a data collection module associated with the analyzer, said data collection module is designed to obtain data about computers on the network, and the data includes information about the software (hereinafter referred to as the software) installed on the computers; b) an analyzer associated with a patch management module, wherein said analyzer is designed to: • determining the presence of software vulnerabilities on at least one computer on the network based on data received from the data collection module, • identifying the presence of at least one patch for each specific vulnerability, • Calculate for each patch a final score based on two or more of the following scores: a) assessing the importance of the account, b) assessment of the frequency of use of software for which the presence of a vulnerability has been determined, c) assessing the use of computer hardware resources, d) assessing the risks of compromise based on virus incidents, e) assessment of the data transmission channel to the computer; c) patch management module designed for: • determining installation priority for at least two patches based on the calculated final score for each specified patch, • installing patches on computers depending on a specific installation priority. 2. The system according to claim 1, in which the data acquisition module additionally receives data containing at least the following information: a) the role of the user account, b) frequency of use of the software by the user, c) data transmission channel capacity, d) information about the availability of software updates, e) availability of special-purpose software installed on the computer, f) the presence of instant messengers on the computer, g) use of computer hardware resources. 3. The system according to claim 1, in which the analyzer additionally calculates for each patch at least one of the estimates to determine the priority of patch installation: • assessment of the availability of special-purpose software installed on the computer, • computer accessibility assessment, • assessment based on the availability of access to the Internet, • assessment of the security level of anti-virus protection. 4. The system according to claim 1, in which the analyzer additionally receives feedback after installing the patches. 5. The system according to claim 4, in which the feedback data contains at least one or more categories of information: • operating system version, • bit depth of the operating system, • Memory, • running processes on the computer at the time of patch installation, • installed software, • information about the last reboot, • user activity, • availability of access to the Internet, • having administrator rights, • patch installer data. 6. The system according to claim 4, in which if the installation of at least one patch on the computer fails, the analyzer analyzes the causes of the failure based on feedback data and generates a failure report with recalculated final scores. 7. The system of claim 6, wherein the patch management module changes the priority for at least one patch that was not installed based on the crash report with the recalculated final scores. 8. The system according to claim 7, in which the patch management module installs patches on computers depending on the changed priority. 9. A method for prioritizing the installation of patches on computers on a network, including stages in which: a) receive data about computers on the network, where the data includes information about the software (hereinafter referred to as the software) used on the computer, b) determine the presence of software vulnerabilities on at least one computer on the network based on the data received, c) identify at least one patch for each specific vulnerability, d) calculate for each patch a final score based on two or more of the following scores: • assessment of the importance of the account, • assessment of the frequency of use of software for which the presence of a vulnerability has been determined, • assessment of the use of computer hardware resources, • assessing the risks of compromise based on virus incidents, • assessment of the data transmission channel to the computer; e) determining installation priority for at least two patches based on the calculated final score for each specified patch; f) install patches on computers depending on a certain installation priority. 10. The method according to claim 9, in which the additional data obtained is at least information for calculating estimates under point d): a) the role of the user account, b) frequency of use of the software by the user, c) data transmission channel capacity, d) information about the availability of software updates, e) availability of special-purpose software installed on the computer, f) the presence of instant messengers on the computer, g) use of computer hardware resources. 11. The method according to claim 9, in which at least one of the estimates is additionally calculated for each patch to determine the priority of installing the patch: • assessment of the availability of special-purpose software installed on the computer, • assessment based on the availability of access to the Internet, • computer accessibility assessment, • assessment of the security level of anti-virus protection. 12. The method according to claim 9, in which additionally feedback data is obtained after installing the patches. 13. The method of claim 12, wherein the feedback data contains at least the following information: • operating system version, • bit depth of the operating system, • Memory, • running processes on the computer at the time of patch installation, • installed software, • information about the last reboot, • user activity, • availability of access to the Internet, • having administrator rights, • patch installer data. 14. The method according to claim 12, in which if the installation of at least one patch on the computer fails, the causes of the failure are analyzed based on the feedback data and a failure report is generated with recalculated final estimates. 15. The method of claim 14, wherein the priority for patches that have not been installed is changed based on the crash report with the recalculated final scores. 16. The method according to claim 15, in which patches are installed on computers depending on the changed priority.