# US 2021/0243213 A1 · Information collection system, information collection method, medium, and information collection program > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2021/0243213 A1 - Document ID: US20210243213A1 - Status: Published application - Kind: A1 - Application number: 16/973,596 - Filed: 2018-06-12 - Published: 2021-08-05 - Earliest claimed: 2018-06-12 - Assignees: NEC Corporation; B.G. Negev Technologies and Applications Ltd., At Ben-Gurion University - Applicants: NEC Corporation; B.G. Negev Technologies and Applications Ltd., at Ben-Gurion University - Inventors: Yoshiyuki YAMADA; Masaki INOKUCHI; Yoshinobu OHTA; Yuval ELOVICI; Asaf SHABTAI; Ron BITTON - Web page: https://patentgrep.com/patent/US20210243213A1 ## CPC - G06F 21/56: Computer malware detection or handling, e.g. anti-virus arrangements - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - G06F 21/552: {involving long-term monitoring or reporting} - H04L 63/0236: {Filtering by address, protocol, port number or service, e.g. IP-address or URL} - H04L 63/101: {Access control lists [ACL]} - H04L 63/108: {when the policy decisions are valid for a limited amount of time} - H04L 63/1433: {Vulnerability analysis} - H04L 2101/695: using masks or ranges of addresses - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract An information collection system includes: a side-channel information processing unit that derives load information to estimate an impact on the availability of a target machine for active scanning by using side-channel data; an allow list generation unit that generates an allow list including a scan timing and a scan range in which the availability is not affected, the allow list generation unit generating the allow list based on the load information; and an allow list storage unit that stores the allow list. An active scan of the target machine is executed by referencing the allow list stored in the allow list storage unit to collect asset information of the target machine. ## Claims ### Claim 1 An information collection system comprising: at least one processor configured to execute instructions to: derive load information to estimate an impact on the availability of a target machine for active scanning by using side-channel data; generate, based on the load information, an allow list including a scan timing and a scan range in which the availability is not affected; and memory that stores the allow list, wherein an active scan of the target machine is executed by referencing the allow list stored in the memory to collect asset information of the target machine. ### Claim 2 (depends on 1) The information collection system according to claim 1, wherein the scan range is determined by IP address information, and the IP address information is at least one of: an IP address of the target machine; a network address that represents a subnet to which the IP address of the target machine belongs; and an IP address range including the IP address of the target machine. ### Claim 3 (depends on 1) The information collection system according to claim 1, wherein generating comprises determining the scan timing by obtaining a start time of allowed scanning and an end time of allowed scanning as time information which is based on the load information and generating the allow list including the time information when the start time of allowed scanning and the end time of allowed scanning are different from each other. ### Claim 4 (depends on 3) The information collection system according to claim 3, wherein the memory further includes a database to store the allow list connecting the start time of allowed scanning and the end time of allowed scanning with each other for the data items in the allow list. ### Claim 5 (depends on 3) The information collection system according to claim 3, wherein the at least one processor is configured to execute the instructions to: obtain the allow list from the memory and send a scan execution request; execute the active scan in response to receiving the scan execution request; and determine a timing to send the scan execution request based on the start time of allowed scanning and the end time of allowed scanning in the allow list. ### Claim 6 (depends on 1) The information collection system according to claim 1, wherein the side-channel data is traffic data, deriving comprises calculating network load information by processing the traffic data, wherein generating comprises generating the allow list including the scan timing and the scan range by referencing the network load information, wherein the at least one processor is configured to execute the instructions to determine that the active scan is executable on the target machine when the network load information is lower than a threshold. ### Claim 7 (depends on 1) The information collection system according to claim 1, wherein the side-channel data is power consumption data, deriving comprises deriving power consumption load information by processing the power consumption data; wherein generating comprises generating the allow list including the scan timing and the scan range by referencing the power consumption load information, wherein the at least one processor is configured to execute the instructions to determine that the active scan is executable on the target machine when the power consumption load information is lower than a threshold. ### Claim 8 (depends on 1) The information collection system according to claim 1, wherein the side-channel data is control message data, and deriving comprises extracting operating information by processing the control message data, wherein generating comprises generating the allow list including the scan timing and the scan range by referencing the control message data, wherein the at least one processor is configured to execute the instructions to determine that the active scan is executable on the target machine when an operational state of the operating information matches a standby state or a low load state. ### Claim 9 (depends on 5) The information collection system according to claim 5, wherein the at least one processor is configured to execute the instructions to: extract the time information and an IP address information of the target machine that sends a high-load signal; and stop sending the scan execution request in response to receiving the high-load signal, wherein stopping comprises stopping the scan execution request prior to the timing that the active scan is executable based on the start time of allowed scanning and the end time of allowed scanning in the allow list, when a time difference between a current time and the time of receiving the high-load signal is lower than a threshold. ### Claim 10 (depends on 5) The information collection system according to claim 5, wherein the at least one processor is configured to execute the instructions to: send a scan stopping request in response to receiving a high-load signal; stop the active scan of the target machine associated with an IP address information attached with the scan stopping request; and determine to send the scan stopping request when a current time is equal to the time between the start time of allowed scanning and the end time of allowed scanning which are described in the allow list. ### Claim 11 A computer-implemented information collection method comprising: deriving load information to estimate an impact on the availability of a target machine for active scanning by using side-channel data; generating an allow list including a scan timing and a scan range in which the availability is not affected, the allow list being based on the load information; and storing the allow list in memory, wherein an active scan of the target machine is executed by referencing the allow list stored in the memory to collect asset information of the target machine. ### Claim 12 (canceled) ### Claim 13 A non-transitory computer-readable storage medium storing a program that causes a computer to execute: deriving load information to estimate an impact on the availability of a target machine for active scanning by using side-channel data; generating an allow list including a scan timing and a scan range in which the availability is not affected, the allow list being based on the load information; and storing the allow list in memory, wherein an active scan of the target machine is executed by referencing the allow list stored in the memory to collect asset information of the target machine.