Identifying network vulnerabilities
AssigneeRapid7, Inc.
InventorsJustin Pagano, Roy Hodgman
Life of this patent
Estimating the term…
Abstract
Methods and systems for identifying a network vulnerability. The system may gather data regarding a new or previously unknown network device, and compare the gathered data to one or more known devices that are scanned by a vulnerability assessment device. The vulnerability assessment device may then scan the previously unknown device upon a processor determining the previously unknown device shares at least one feature with a known device that is scanned.
Claims18
A method for identifying a network vulnerability, the method comprising:
- receiving, using an interface, scan configuration data from a vulnerability assessment device, wherein the scan configuration data comprises
- at least one device that is known to the vulnerability assessment device,
- whether the at least one known device is scanned by the vulnerability assessment device, and
- at least one feature related to the at least one known device;
- receiving, using the interface, network activity data including at least one device that is unknown to the vulnerability assessment device;
- determining, using a processor executing instructions stored on a memory and providing a classifier, whether the at least one unknown device shares at least one feature with a known device that is scanned;
- scanning, using the vulnerability assessment device, the at least one unknown device to identify any vulnerabilities of the at least one unknown device after the processor determines the at least one unknown device shares at least one feature with a known device that is scanned;
- and
- updating the scan configuration data in a disabled state and presenting the updated scan configuration data to an operator using a user interface before the vulnerability assessment device scans the at least one unknown device.
A system for identifying a network vulnerability, the system comprising:
- an interface for receiving:
- scan configuration data from a vulnerability assessment device, wherein
- the scan configuration data comprises
- at least one device that is known to the vulnerability assessment device,
- whether the at least one known device is scanned by the vulnerability assessment device, and
- at least one feature related to the at least one known device;
- and
- network activity data including at least one device that is unknown to the vulnerability assessment device;
- and
- a processor executing instructions stored on a memory and providing a classifier,
- wherein the processor is configured to:
- determine whether the at least one unknown device shares at least one feature with at least one known device that is scanned,
- wherein
- the vulnerability assessment device is configured to scan the unknown device to identify any vulnerabilities of the at least one unknown device after the processor determines the at least one unknown device shares at least one feature with a known device that is scanned, and
- update the scan configuration data in a disabled state and present the updated scan configuration data to an operator using a user interface before the vulnerability assessment device scans the at least one unknown device.
The system of claim, 10 wherein
- the classifier is a random forest or a support vector machine classifier.
The system of claim, 10 wherein
- the processor is further configured to issue an alert using a user interface, wherein
- the alert indicates that the scan configuration data should be updated to include the at least one unknown device.
Dependencies are inferred from the claim text.