Back to results
US 11,632,388 B1Granted
Real-time vulnerability monitoring
AssigneeSecurityProfiling, LLC
InventorsBrett M. Oliphant, John P. Blignaut
Life of this patent
Estimating the term…
Abstract
An apparatus is provided including at least one platform; an intrusion prevention system configured to communicative couple with the at least one platform; a firewall configured to communicative couple with the at least one platform; at least one first data storage configured to communicative couple with the at least one platform; and at least one second data storage configured to communicative couple with the at least one platform. The at least one platform is configured to perform a plurality of operations that collective protect one or more networked devices.
Claims8
A non-transitory computer-readable media storing instructions that, when executed by at least one processor of a system, cause the system to:
- receive a result of at least one operation performed on at least one of a plurality of networked devices, the at least one operation based on first information from at least one first data storage identifying a plurality of potential vulnerabilities including at least one first potential vulnerability and at least one second potential vulnerability, the at least one operation configured for:
- identifying at least one configuration associated with the at least one networked device, and
- determining that the at least one networked device is actually vulnerable to at least one actual vulnerability, based on the identified at least one configuration and the first information from the at least one first data storage identifying the plurality of potential vulnerabilities, such that second information associated with the result is stored in at least one second data storage separate from the at least one first data storage, the second information relating to the at least one actual vulnerability to which the at least one networked device is actually vulnerable;
- cause display a plurality of techniques including a first technique for utilizing an intrusion prevention system component for occurrence mitigation, and a second technique for utilizing a firewall for occurrence mitigation;
- allow receipt of:
- user input causing selection of the first technique for utilizing the intrusion prevention system component for occurrence mitigation;
- user input causing selection of the second technique for utilizing the firewall for occurrence mitigation;
- apply, based on the user input causing selection of the first technique for utilizing the intrusion prevention system component for occurrence mitigation, the first technique for utilizing the intrusion prevention system component for occurrence mitigation;
- apply, based on the user input causing selection of the second technique for utilizing the firewall for occurrence mitigation, the second technique for utilizing the firewall for occurrence mitigation;
- identify:
- for the at least one networked device, a first occurrence including at least one first occurrence packet, and
- for the at least one networked device, a second occurrence including at least one second occurrence packet;
- determine:
- that the first occurrence including the at least one first occurrence packet directed to the at least one networked device is capable of taking advantage of the at least one of the actual vulnerability to which the at least one networked device is actually vulnerable;
- that the second occurrence including the at least one second occurrence packet directed to the at least one networked device is not capable of taking advantage of the at least one of the actual vulnerability to which the at least one networked device is actually vulnerable;
- and
- cause a reporting of at least the first occurrence based on the determination that the first occurrence including the at least one first occurrence packet is capable of taking advantage of the at least one of the actual vulnerability to which the at least one networked device is actually vulnerable.
14 more elements
A non-transitory computer-readable media storing instructions that, when executed by at least one processor of a system, causes the system to:
- access at least one data structure identifying a plurality of mitigation techniques that mitigate effects of attacks that take advantage of vulnerabilities, where:
- one or more of the plurality of mitigation techniques is identified based on an identification of an operating system,
- each mitigation technique is capable of mitigating an effect of an attack that takes advantage of a corresponding vulnerability, and
- each mitigation technique has a mitigation type including at least one of a patch, a policy setting, or a configuration option;
- receive information in connection with at least one of a plurality of devices;
- identify an attack on the at least one device that takes advantage of at least one of the vulnerabilities, based on the information;
- and
- automatically apply at least two of the plurality of mitigation techniques including at least one first mitigation technique of a first mitigation type and at least one second mitigation technique of a second mitigation type to the at least one device, for mitigating an effect of the attack on the at least one device that takes advantage of the at least one vulnerability, by preventing the attack from taking advantage of the at least one vulnerability, where the at least one first mitigation technique of the first mitigation type and the at least one second mitigation technique of the second mitigation type utilize different underlying security technology types that are both supported by a same system component that is capable of identifying the attack and preventing the attack from taking advantage of the at least one vulnerability after the at least two mitigation techniques are automatically applied.
5 more elements
Dependencies are inferred from the claim text.