# US 12,118,082 B1 · Automated scan engine assignment > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,118,082 B1 - Document ID: US12118082B1 - Status: Granted - Kind: B1 - Application number: 17/588,413 - Filed: 2022-01-31 - Granted: 2024-10-15 - Earliest claimed: 2021-10-28 - Assignees: Rapid7, Inc. - Applicants: Rapid7, Inc. - Inventors: James Cancilla; Paul Miseiko; Emmett Kelly - Web page: https://patentgrep.com/patent/US12118082B1 ## CPC - G06F 21/554: {involving event detection and direct action} - H04L 63/1433: {Vulnerability analysis} - G06F 9/4887: {involving deadlines, e.g. rate based, periodic} - G06F 9/5022: {Mechanisms to release resources} - G06F 9/505: {considering the load} - G06F 2209/5022: Workload threshold - G06F 2221/034: Test or assess a computer or a system - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Various embodiments include systems and methods of automated scan engine assignment. Responsive to determining to initiate a scan of a target asset, a scan engine assignment strategy may be determined for automatically assigning one or more scan engines to perform the scan. Determining the scan engine assignment strategy may include implementing a strategy selection scheme that defines a hierarchy of scan engine assignment strategies, which may include at least one of a passive discovery strategy, an active discovery strategy, or a scan engine subnet strategy. Using the scan engine assignment strategy, the one or more scan engines may be automatically assigned to perform the scan. The scan may be performed using the one or more scan engines. ## Claims ### Claim 1 A system, comprising: one or more hardware processors with associated memory that implement automated scan engine assignment, wherein the one or more hardware processors are configured to: responsive to determining to initiate a scan of a target asset, determine a scan engine assignment strategy for automatically assigning one or more scan engines to perform the scan, wherein, to determine the scan engine assignment strategy, the one or more hardware processors are configured to implement a strategy selection scheme that selects the scan engine assignment strategy from a hierarchy of scan engine assignment strategies according to a following descending order of precedence: (i) an explicit assignment strategy that utilizes one or more user-specified explicit assignment parameters to determine a particular scan engine of the plurality of scan engines to perform the scan, (ii) a target binding strategy that utilizes one or more user-specified target binding parameters to determine a particular scan engine of the plurality of scan engines to perform the scan, (iii) a passive discovery strategy that utilizes reachable target data from a plurality of scan engines to determine the one or more scan engines to perform the scan, (iv) an active discovery strategy that utilizes output data from the plurality of scan engines to determine the one or more scan engines to perform the scan, (v) a scan engine subnet strategy that utilizes subnet data to determine which of the plurality of scan engines are capable of scanning the target asset, and (vi) a random selection strategy that utilizes a random engine assignment scheme to determine the one or more scan engines to perform the scan; automatically assign, using the scan engine assignment strategy, the one or more scan engines to perform the scan; and perform the scan using the one or more scan engines. ### Claim 2 (depends on 1) The system of claim 1, wherein the scan engine assignment strategy is selected based on one or more parameters of a user scan command. ### Claim 3 (depends on 2) The system of claim 2, wherein the one or more parameters specify one or more user preferences that overrides the strategy selection scheme. ### Claim 4 (depends on 1) The system of claim 1, wherein the one or more hardware processors are further configured to: determine that the target asset is capable of being scanned by more than one scan engine; and implement a tie-breaker strategy to select the one or more scan engines to assign to perform the scan. ### Claim 5 (depends on 4) The system of claim 4, wherein the tie-breaker strategy is selected from a plurality of tie-breaker strategies including: a naïve strategy that iterates through a list of the plurality of scan engines to select a first scan engine that is capable of scanning the target asset, a metrics-driven strategy that utilizes metrics associated with each of the plurality of scan engines to select a particular scan engine of multiple scan engines that are capable of scanning the target asset, a fewest engines strategy that identifies a minimum number of scan engines from multiple scan engines that are capable of scanning the target asset, and a most engines strategy that identifies a maximum number of scan engines from multiple scan engines that are capable of scanning the target asset. ### Claim 6 (depends on 5) The system of claim 5, wherein the fewest engines strategy comprises one of: a fewer engines strategy; or a guaranteed fewest engines strategy. ### Claim 7 (depends on 1) The system of claim 1, wherein the one or more hardware processors are configured to initiate the scan of the target asset responsive to receiving a start scan command. ### Claim 8 (depends on 1) The system of claim 1, wherein the target asset comprises an asset that is targeted for the scan, the asset comprising: a single internet protocol (IP) address; a range of IP addresses; a classless inter-domain routing (CIDR) value; or a top-level domain (TLD) name. ### Claim 9 (depends on 1) The system of claim 1, wherein the passive discovery strategy utilizes the reachable target data stored in a reachable target data store to determine the one or more scan engines to perform the scan, wherein the reachable target data is obtained from passive network sensing devices. ### Claim 10 (depends on 1) The system of claim 1, wherein the active discovery strategy utilizes the output data stored at an nmap output data store to determine the one or more scan engines to perform the scan, and wherein: the output data include nmap output obtained from each scan engine of the plurality of scan engines; and the nmap output includes information related to at least one of: one or more hosts that a particular scan engine is capable of reaching; latency between the particular scan engine and the one or more hosts; and one or more ports that are accessible to the particular scan engine. ### Claim 11 (depends on 1) The system of claim 1, wherein the scan engine subnet strategy: utilizes a scan configuration service that obtains the subnet data based on subnets associated with individual scan engines of the plurality of scan engines; and determines whether an internet protocol (IP) address associated with the target asset is within a range of IP addresses associated with a particular subnet associated with a particular scan engine; wherein the particular scan engine is automatically assigned to perform the scan of the target asset responsive to determining that the IP address associated with the target asset is within the range of IP addresses. ### Claim 12 A method comprising: implementing, using one or more hardware processors, automated scan engine assignment, wherein the implementing comprises: responsive to determining to initiate a scan of a target asset, determining a scan engine assignment strategy for automatically assigning one or more scan engines to perform the scan, wherein determining the scan engine assignment strategy includes implementing a strategy selection scheme that selects the scan engine assignment strategy from a hierarchy of scan engine assignment strategies according to a following descending order of precedence: (i) an explicit assignment strategy that utilizes one or more user-specified explicit assignment parameters to determine a particular scan engine of the plurality of scan engines to perform the scan, (ii) a target binding strategy that utilizes one or more user-specified target binding parameters to determine a particular scan engine of the plurality of scan engines to perform the scan, (iii) a passive discovery strategy that utilizes reachable target data from a plurality of scan engines to determine the one or more scan engines to perform the scan, (iv) an active discovery strategy that utilizes output data from the plurality of scan engines to determine the one or more scan engines to perform the scan, (v) a scan engine subnet strategy that utilizes subnet data to determine which of the plurality of scan engines are capable of scanning the target asset, and (vi) a random selection strategy that utilizes a random engine assignment scheme to determine the one or more scan engines to perform the scan; automatically assigning, using the scan engine assignment strategy, the one or more scan engines to perform the scan; and performing the scan using the one or more scan engines. ### Claim 13 (depends on 12) The method of claim 12, wherein the scan engine assignment strategy is selected based on one or more parameters of a user scan command. ### Claim 14 (depends on 13) The method of claim 13, wherein the one or more parameters specify one or more user preferences that overrides the strategy selection scheme. ### Claim 15 (depends on 12) The method of claim 12, wherein the implementing further comprises: determining that the target asset is capable of being scanned by more than one scan engine; and implementing a tie-breaker strategy to select the one or more scan engines to assign to perform the scan. ### Claim 16 (depends on 15) The method of claim 15, wherein the tie-breaker strategy is selected from a plurality of tie-breaker strategies including: a naïve strategy that iterates through a list of the plurality of scan engines to select a first scan engine that is capable of scanning the target asset, a metrics-driven strategy that utilizes metrics associated with each of the plurality of scan engines to select a particular scan engine of multiple scan engines that are capable of scanning the target asset, a fewest engines strategy that identifies a minimum number of scan engines from multiple scan engines that are capable of scanning the target asset, and a most engines strategy that identifies a maximum number of scan engines from multiple scan engines that are capable of scanning the target asset. ### Claim 17 (depends on 16) The method of claim 16, wherein the fewest engines strategy comprises one of: a fewer engines strategy; or a guaranteed fewest engines strategy. ### Claim 18 One or more non-transitory computer-accessible storage media storing program instructions that, when executed on or across one or more processors, implement at least a portion of a system that implements automated scan engine assignment and cause the system to: responsive to determining to initiate a scan of a target asset, determine a scan engine assignment strategy for automatically assigning one or more scan engines to perform the scan, wherein, to determine the scan engine assignment strategy, the one or more hardware processors are configured to implement a strategy selection scheme that selects the scan engine assignment strategy from a hierarchy of scan engine assignment strategies according to a following descending order of precedence: (i) an explicit assignment strategy that utilizes one or more user-specified explicit assignment parameters to determine a particular scan engine of the plurality of scan engines to perform the scan, (ii) a target binding strategy that utilizes one or more user-specified target binding parameters to determine a particular scan engine of the plurality of scan engines to perform the scan, (iii) a passive discovery strategy that utilizes reachable target data from a plurality of scan engines to determine the one or more scan engines to perform the scan, (iv) an active discovery strategy that utilizes output data from the plurality of scan engines to determine the one or more scan engines to perform the scan, (v) a scan engine subnet strategy that utilizes subnet data to determine which of the plurality of scan engines are capable of scanning the target asset, and (vi) a random selection strategy that utilizes a random engine assignment scheme to determine the one or more scan engines to perform the scan; automatically assign, using the scan engine assignment strategy, the one or more scan engines to perform the scan; and perform the scan using the one or more scan engines. ### Claim 19 (depends on 18) The one or more non-transitory computer-accessible storage media of claim 18, wherein: the scan engine assignment strategy is selected based on one or more parameters of a user scan command. ### Claim 20 (depends on 18) The one or more non-transitory computer-accessible storage media of claim 18, wherein the instructions, when executed on or across the one or more processors, further cause the system to: determine that the target asset is capable of being scanned by more than one scan engine; and implement a tie-breaker strategy to select the one or more scan engines to assign to perform the scan, wherein the tie-breaker strategy comprises at least one of: a naïve strategy that iterates through a list of the plurality of scan engines to select a first scan engine that is capable of scanning the target asset; a metrics-driven strategy that utilizes metrics associated with each of the plurality of scan engines to select a particular scan engine of multiple scan engines that are capable of scanning the target asset; a fewest engines strategy that identifies a minimum number of scan engines from multiple scan engines that are capable of scanning the target asset; or a most engines strategy that identifies a maximum number of scan engines from multiple scan engines that are capable of scanning the target asset.