Network security system having a device profiler communicatively coupled to a traffic monitor

A computer program product for providing security to a plurality of hosts on a network, the computer program product comprising computer program code embodied on a computer-readable medium, the computer program code for:

• storing potential vulnerabilities of the hosts in a tree-structured vulnerability tree having nodes representative of characteristics of the host and a set of potential vulnerabilities associated with ones of the nodes;
• evaluating responses of a host of the plurality of hosts to data packets sent over the network to determine characteristics of the host;
• traversing the tree-structured vulnerability tree responsive to the determined characteristics to determine vulnerabilities of the host;
• associating the determined vulnerabilities of the host with one or more attack signatures;
• and
• providing the determined vulnerabilities of the host and their corresponding attack signatures to a traffic monitor, the traffic monitor configured to monitor the network for traffic indicative of attacks exploiting one or more of the determined vulnerabilities of the host.

A distributed computer network security system for detecting an attack on a host on a network having a plurality of hosts, the system comprising:

• a computer-readable medium storing potential vulnerabilities of the hosts in a tree-structured vulnerability tree having nodes representative of characteristics of the host and a set of potential vulnerabilities associated with ones of the nodes;
• a device profiler communicatively coupled with the network, the device profiler configured to evaluate responses of a host of the plurality of hosts to data packets sent over the network to determine characteristics of the host, and further configured to determine vulnerabilities of the host by traversing the tree-structured vulnerability tree responsive to the determined characteristics to determine vulnerabilities of the host, and further configured to associate the determined vulnerabilities of the host with one or more attack signatures;
• and
• a traffic monitor communicatively coupled with the network, the traffic monitor configured to receive the determined vulnerabilities of the host and their corresponding attack signatures from the device profiler, the traffic monitor configured to monitor the network for traffic indicative of attacks exploiting one or more of the determined vulnerabilities of the host.