Loading patent…
AssigneeMcAfee, Inc.
InventorsStuart C. McClure, George Kurtz, Robin Keir, Marshall A. Beddoe, Michael J. Morton, Christopher M. Prosise, David M. Cole, Christopher Abad
Estimating the term…
A system and method provide comprehensive and highly automated testing of vulnerabilities to intrusion on a target network, including identification of operating system, identification of target network topology and target computers, identification of open target ports, assessment of vulnerabilities on target ports, active assessment of vulnerabilities based on information acquired from target computers, quantitative assessment of target network security and vulnerability, and hierarchical graphical representation of the target network, target computers, and vulnerabilities in a test report. The system and method employ minimally obtrusive techniques to avoid interference with or damage to the target network during or after testing.
A system for determining an operating system of a target computer operably connected to a network, the system comprising:
A system for determining an operating system of a target computer accessible via a network, the system comprising:
A method for determining an operating system of a target computer accessible via a network, the method comprising the steps of:
A method for identifying an operating system of a target computer via a network, the method comprising the steps of:
A system for determining whether a target computer is on a network, the system comprising:
A system for testing the accessibility of a target computer via a network, the system comprising:
A method for determining whether a target computer is accessible via a network, the method comprising the steps of:
A method for assessing the vulnerability of a target computer via a network, the method comprising the steps of:
A method of creating a graphical representation of a network, the method comprising the steps of:
A method for creating a topological representation of a network, said method comprising the steps of:
A method for calculating an objective vulnerability score, said method comprising the steps of:
A method for calculating an objective security score for a network, said method comprising the steps of:
A method for conducting an automated network vulnerability attack, said method comprising the steps of:
A hierarchical network vulnerability report, comprising:
A vulnerability assessment language comprising:
A method for automated application of a known vulnerability on a target computer, the method comprising the steps of:
A method for automated application of known vulnerabilities to target computers of a network, the method comprising the steps of:
Dependencies are inferred from the claim text.
From the US filing history. Foreign family members aren’t listed.
Backward citations are indexed for grants only.
Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks: discovery or management…
Architectural arrangements, e.g. perimeter networks or demilitarized zones: distributed architectures, e.g. distributed firewalls
For detecting or protecting against malicious traffic: by monitoring network traffic
For detecting or protecting against malicious traffic: vulnerability analysis
Term end not estimated
Drawings are temporarily unavailable. Open the PDF at USPTO
1. Field of the Invention
This invention relates to network system security, and more particularly relates to systems and methods for automatic detection, monitoring and reporting of network vulnerabilities.
2. Description of the Related Art
Preferred embodiments of the present invention are described below in connection with the attached drawings in which:
FIG. 1 illustrates one embodiment of a target network;
FIG. 2 illustrates one embodiment of a target computer on the target network;
I. Basic Implementation, Structure and Control Language
FIG. 1 illustrates one embodiment of a target network. The network security system 100 of the present invention is, in one embodiment, at least one Intel-based server running on a Windows 2000 operating system, although any computer system or operating system capable of handling an IP network and capable of large-scale data processing can be used. The network security system 100 may be outside the target network 102 or inside the target network (not shown). In either case, the system 100 is connected to the target network 102 through a network such as the Internet, via one or more nodes 104. The target network 102, in one example, consists of an intranet with a central intranet hub 106. The target network 102 further includes a firewall 108 which blocks some incoming traffic to or outgoing network traffic leaving the target network 102. The target network further comprises a number of hosts 110, defined as within a predetermined range of Internet Protocol (IP) addresses. In some cases, external hosts 112 may lie outside the target network but may nonetheless be connected to the target network 102.
FIG. 2 illustrates one embodiment of a target computer on the target network. In general, a host IP address represents a target computer, as more generally defined below, if the address is in use by the target network. In a simplified representation of a target computer 200 at a host 110, the target computer 200 is running an operating system 202. The operating system preferably contains at least one network TCP/IP stack 204 to provide packet transport, preferably including an interface to provide raw socket 206 connections between the target computer 200 and the network. The physical connection to the network 208 is provided, in one embodiment, by a Network Interface Card (NIC) 210. On an IP network, a packet can be received at any one of 65,536 logical ports 212 at the target computer 200. Similarly, any number of network services 214 can be provided.