Back to results
US 11,695,793 B2Granted
Vulnerability scanning of attack surfaces
AssigneeMicro Focus LLC
InventorsMing Sum Sam Ng, Sasi Siddharth Muthurajan, Nidhi Govindram Kejriwal, Gerald E. Sullivan, II, Alexander Hoole
Life of this patent
Estimating the term…
Abstract
A method includes: identifying, by a runtime instrumentation agent of a web server, a plurality of attack surfaces of a web application executed on the web server; generating, by the runtime instrumentation agent, a plurality of hash values, where each hash value is generated based on one of the plurality of attack surfaces; and transmitting, by the runtime instrumentation agent, the plurality of hash values to an attack server external to the web server, where the attack server is to determine whether to scan each attack surface based on the plurality of hash values.
Claims20
A method, comprising:
- identifying, by a runtime instrumentation agent of a web server, a plurality of attack surfaces of a web application executed on the web server, wherein each attack surface of the plurality of attack surfaces is an exposed portion of the web application that is identified by the runtime instrumentation agent as being potentially vulnerable to an external attack;
- generating, by the runtime instrumentation agent, a plurality of hash values of the plurality of attack surfaces of the web application, by applying a hash function to compiled binaries of the plurality of attack surfaces;
- and
- transmitting, by the runtime instrumentation agent, the plurality of hash values of the plurality of attack surfaces and identifiers of the plurality of attack surfaces of the web application to an attack server external to the web server,
- wherein the attack server is to:
- compare the plurality of hash values of the plurality of attack surfaces to historical data of attack surfaces to identify a subset of hash values that do not match the historical data of attack surfaces,
- determine a subset of attack surfaces of the web application corresponding to the subset of hash values that do not match the historical data of attack surfaces,
- scan only the subset of attack surfaces of the web application executed on the web server, and
- in response to identifying a vulnerable attack surface based on the scanning of the subset of attack surfaces, perform a predefined mitigation action on the vulnerable attack surface.
6 more elements
An article comprising a non-transitory storage medium storing instructions that upon execution cause a processor to:
- identify a plurality of attack surfaces of a web application executed by a web server, wherein the plurality of attack surfaces are exposed portions of the web application that are identified as being potentially vulnerable to an external attack;
- generate a plurality of hash values of the plurality of attack surfaces of the web application, by applying a hash function to compiled binaries of the plurality of attack surfaces;
- and
- send the plurality of hash values of the plurality of attack surfaces and identifiers of the plurality of attack surfaces to an attack server,
- wherein the attack server is to:
- compare the plurality of hash values of the plurality of attack surfaces to historical data of attack surfaces to identify a subset of hash values that do not match the historical data of attack surfaces,
- determine a subset of attack surfaces of the web application corresponding to the subset of hash values that do not match the historical data of attack surfaces,
- scan only the subset of attack surfaces of the web application executed on the web server, and
- in response to identifying a vulnerable attack surface based on the scanning of the subset of attack surfaces, perform a predefined mitigation action on the vulnerable attack surface.
6 more elements
A system comprising:
- an application server including a first processor and a first storage medium storing first instructions, the first instructions executable by the first processor to:
- detect a plurality of attack surfaces of an application of the application server, wherein each attack surface of the plurality of attack surfaces is an exposed portion of the application that is identified as being potentially vulnerable to an external attack;
- generate a plurality of hash values of the plurality of attack surfaces of the application, by applying a hash function to compiled binaries of the plurality of attack surfaces;
- and
- transmit the plurality of hash values of the plurality of attack surfaces and identifiers of the plurality of attack surfaces of the application to an attack server external to the application server,
- wherein the attack server is to:
- compare the plurality of hash values of the plurality of attack surfaces to historical data of attack surfaces to identify a subset of hash values that do not match the historical data of attack surfaces,
- determine a subset of attack surfaces of the application corresponding to the subset of hash values that do not match the historical data of attack surfaces,
- scan only the subset of attack surfaces of the application executed on the application server, and
- in response to identifying a vulnerable attack surface based on the scanning of the subset of attack surfaces, perform a predefined mitigation action on the vulnerable attack surface.
7 more elements
Dependencies are inferred from the claim text.